Privacy policy
Last updated: [to fill in: publication date]
Draft: highlighted parts are to be filled in, and the whole is to be reviewed before going live. The French version prevails.
This page explains what data the Derail Party game keeps about you, why, for how long, and how to exercise your rights. The game shows no ads, uses no analytics and sells no data.
Who is responsible
The data controller is the game's publisher: [to fill in: name or company name, address]. Contact for your data: [to fill in: e-mail address].
The data we keep, and why
| Data | Why | Legal basis |
|---|---|---|
| Account: e-mail address, driver name, public ID (#123456), language, password (never in clear: only a scrypt hash), linked accounts (Google, Apple, Steam, Discord: their ID and the address or name they give) | Signing you in, keeping your progress on all your devices | Performance of the contract (the terms) |
| Security: signed-in devices (browser and system type, sign-in and last activity dates), confirmation codes (hashed), two-factor authentication | Protecting your account, warning you of a sign-in from a new device | Legitimate interest (security) |
| Game: games (train length, nuggets, trains derailed, duration, bonuses), statistics, XP and level, quests, achievements, upgrades, cards, chests, items owned, gold and diamond balances and their history, pass | Running the game, the leaderboards and the shop; fighting cheating | Performance of the contract; legitimate interest (fairness) |
| Social: friends, requests, blocks, messages between friends, reports (with the reported player's last messages) | Friends and chat; moderation | Performance of the contract; legitimate interest (moderation) |
| IP address | Limiting abuse (too many requests). Kept in memory only, for a few minutes, never in the database. [to fill in: how long the host keeps its logs] | Legitimate interest (security) |
Your driver name, public ID, level, skin and scores are visible to other players (in games, in leaderboards, and to your friends). Your e-mail address is never shown to anyone.
How long
- Account and progress: as long as the account exists. You can delete it at any time (see below); it is erased for good 30 days after the request, with all the data attached to it.
- Messages between friends: 90 days.
- Reports: 1 year.
- Game details: 30 days (totals stay in the statistics). Quests: 7 days.
- Sessions (signed-in devices): 60 days at most. Links sent by e-mail: 24 h (1 h for a new password). Confirmation codes: 15 minutes.
Who else processes them
- Game hosting: [to fill in: host and country]. Database: [to fill in: database host and country].
- Sending e-mails (confirmation, codes, security alerts): Resend (United States), which receives your e-mail address and the message. [to check: transfer safeguards, e.g. Data Privacy Framework or standard contractual clauses]
- If you sign in with Google, Apple, Steam or Discord, that service already knows you: it only gives us your ID there, and your address or name.
- Fonts: loaded from Google Fonts, which sends your IP address to Google. [to decide: self-host the fonts to remove this transfer]
- Payments (once they open): [to fill in: payment provider], which processes your payment data; the game never sees your card.
On your device
The game uses no cookies. It keeps in your browser's local storage what it needs: your session (to stay signed in) and your preferences (language, graphics and controls settings, chosen name and colour, leaderboard filters). None of it is used to track you.
Your rights
You can access, correct, erase, restrict or object to the processing of your data, and get a copy of it (portability). Right in the game:
- Settings → Data and account → Export my data: a JSON file with everything the game keeps about you.
- Settings → Profile / Sign-in and security: change your name, e-mail, password, linked accounts.
- Settings → Data and account → Delete the account: erased for good after 30 days (signing in again before cancels the deletion).
For anything else: [to fill in: e-mail address]. If you think your rights are not respected, you can complain to your data protection authority (in France, the CNIL: cnil.fr).
Minors
The game is open from [to fill in: minimum age, e.g. 13]. Under [15], a parent's consent is needed to create an account, and any purchase requires a parent's consent.
Security
Traffic is encrypted (HTTPS). Passwords and session tokens are stored hashed, never in clear. Every new device and every sensitive change to the account is reported to you by e-mail.