Privacy policy

Data we collect

• Account: name, email, avatar and ID provided by Google at sign-in.
• Votes: vote value, account ID or anonymous fingerprint stored in a cookie.
• Submissions: game name, description, URLs, screenshots and categories you send.
• Technical: truncated or hashed IP address for rate limiting and anti-spam, error and audit logs.
• Analytics: anonymous aggregated statistics, only after your consent.

Purposes and legal bases

• Providing the service (account, votes, game pages): performance of the contract.
• Moderating submissions and preventing abuse: legitimate interest.
• Anonymous audience measurement: consent.
• Complying with legal obligations and responding to requests: legal obligation.

Cookies

Strictly necessary cookies are used for the login session and to prevent repeated votes. They do not require consent.

Analytics cookies (Umami, no advertising tracking) are only loaded after you accept the cookie banner. You can change your choice at any time by clearing site data in your browser.

The “Qui de nous ?” game

To play, you choose a nickname, a color and optionally a photo. This information is only visible to the other players in the room.

Photos are stored with the room in our self-hosted Redis, after explicit consent, and automatically deleted with the room (6 hours maximum). Rooms are private, accessible by code or link, and never indexed.

Anecdotes and answers are visible in the room and deleted with it. A session token is stored in your browser storage so you can keep your seat after a refresh.

Retention periods

• Account: as long as the account exists, then deleted within 30 days.
• Anonymous votes: up to 12 months.
• Rejected or archived submissions: up to 24 months.
• Game rooms, nicknames, photos, anecdotes and answers: up to 6 hours after the room ends.
• Technical logs: 90 days.

Recipients and processors

Data may transit through Google (authentication), Cloudflare (network and protection), our VPS host (infrastructure) and our self-hosted analytics tool. We never sell personal data.

Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, object and port your data. Email [email protected] to exercise these rights. You may also contact your local data protection authority.

Security

Traffic is encrypted (HTTPS), secrets are stored outside the code, administrator access is restricted and regular backups are performed.