Privacy policy

The data controller is the publisher of the site, identified in the legal notice. For any question about your data, write to hello@gameforever.app.

Taking part in duels requires neither sign-up nor personal details. Three technical items are processed, solely to guarantee the integrity of the ranking:

• An anonymous token, randomly generated and stored in your browser (localStorage). It contains no personal information and serves to count your vote on the same match-up only once per 24-hour period.
• The vote itself: the two games shown, your choice, the timestamp and the response time (a vote submitted in under 0.5 seconds is excluded from the ELO calculation).
• A fingerprint of your IP address, obtained by hashing (SHA-256) combined with a secret application key. The address in clear text is never written to the database nor to our application logs; the fingerprint only serves to cap the voting rate.

This processing rests on our legitimate interest: keeping a reliable ranking, protected against automated votes, without imposing an account or a captcha.

The account only serves to keep your personal top 10, your duel history, your streaks and to comment. It rests on three pieces of data: a username (public), an email address (never displayed, used for login and password recovery) and a password, stored exclusively in hashed form.

On sign-up, the anonymous token of your browser is attached to your account: you therefore keep the history of the votes cast before signing up. This processing is necessary to provide the service you request by creating an account.

Your address is used first for your sign-in and for password recovery: those messages always go out, without them you could not take your account back. It is then used for two families of emails you control from your settings: the summary of your notifications (a reply to one of your posts, people agreeing, a badge unlocked), on by default and switched off in one click; and emails about the ranking and your games (your streak, the moves in your top, one reminder after a long absence), which only go out if you asked for them. Each of these messages carries an unsubscribe link that takes effect immediately, without signing in. We send nothing else, and your address never leaves our servers and those of our sending provider.

You can also open your session with Google, if you prefer. That path is only taken on a click: until you use that button, no data goes to Google. When you do, you are redirected to Google, which sends us back a stable account identifier, your email address, the name shown on your Google profile and its picture. We never receive your Google password, and we only keep what makes up your account here. The picture is taken only when the account is created: it is then copied onto our servers to become your avatar, which you can change or remove from your settings. It is never displayed from Google, and never taken again afterwards. You can remove the link at any time from your settings, once you have set a password.

• No sale or transfer of data, to anyone.
• No profiling, no tracking of your browsing from one site to the next.
• No third-party tracker, no embedded social network button. Fonts, scripts and game covers are served from our own servers: the only call to a third party is the audience measurement described below, and it waits for your consent. The "Continue with Google" button is an exception only at the moment you click it, since that is precisely what you are asking it to do.

So long as you have not accepted that measurement, browsing GameForever therefore triggers no request to a third-party server: your IP address is passed to nobody other than our host, as on any website.

To know how many people read the site and which pages interest them, we use Google Analytics 4. This measurement is optional: it starts only after your explicit consent, asked for by the banner shown on your first visit.

• Until you accept, no Google script is downloaded and no data leaves our servers. Declining takes nothing away: duels, ranking, search and comments work exactly the same.
• If you accept, two cookies (_ga and _ga_<identifier>) are set to tell visits apart and measure the pages viewed. They carry neither your username, nor your email address, nor your votes.
• The recipient is Google Ireland Limited, acting as a processor. Data may be processed in the United States, framed by the European Commission standard contractual clauses and by the EU / US Data Privacy Framework.
• Google advertising signals stay denied in all circumstances, including after your consent: what we measure serves neither to target you, nor to feed Google advertising audiences.

The legal basis for this measurement is your consent. You can change your mind at any time from the "Cookies" link in the footer, as easily as you gave it; without an answer from you, the question is asked again after 6 months.

Here is everything that may be written on your device:

• Local storage (localStorage): anonymous voting token, the number of duels you have voted on from this browser (used to offer you an account, and never sent off your device), display preferences such as the language, and your answer to the consent banner.
• An authentication cookie, only if you log in to an account, so that you do not have to log in again on every visit. It expires after 30 days without a visit, and immediately if you log out.
• Audience measurement cookies, set by Google Analytics only if you have accepted, and expiring after 13 months.

The first two are strictly necessary to run the service: they require no consent. The third ones do, and that is the only reason a banner is shown at all.

• Votes: kept without time limit in anonymous form, since they are the raw material of the world ranking.
• IP fingerprints and technical logs: kept for 12 months at most, then deleted.
• Account: kept until it is deleted, which you can request at any time from your settings. The cookie that keeps you logged in expires after 30 days without a visit.
• Audience measurement: cookies expiring after 13 months, statistics kept for 14 months at most by Google. Your answer to the banner stays 6 months in your browser.

If an account is deleted, your email address, your profile, your personal top 10 and your history are erased. Your votes still count in the world ranking and your posts stay on the debate threads, signed “Former member”, but strictly anonymously: nothing links them to you any more.

Under the General Data Protection Regulation (GDPR), you have a right of access, rectification, erasure, portability, restriction and objection regarding the data concerning you, as well as the right to withdraw your consent to audience measurement. To exercise it, write to hello@gameforever.app: we reply within one month at most.

If you consider that your rights are not respected, you may lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

This policy evolves with the site. Every version is dated at the top of the page and any substantial change (new data collected, new recipient) is flagged there. The online version prevails.