Privacy policy
What data Memoluz processes when you play, why, for how long, and what your rights are. This page is a translation: if the two versions differ, the French version prevails.
Data controller
- Controller
- Théo Attali, private individual, publisher of the site
- Contact
- contact@memoluz.com
Full identity of the publisher and the host: see the legal notice.
In short
No account, no email address required, no cookies, no analytics, no advertising, no trackers.
A game's nicknames and scores are deleted automatically two hours after its last activity, or thirty minutes after it ends. Your solo personal bests stay on your device.
Data processed
- Game data: your nickname, your answers and scores, and the game's timings.
- Session token: a random identifier kept in your tab's storage (sessionStorage) to reconnect you to your game. The server keeps only a hash of it.
- Solo personal bests: your best score per game and per difficulty, kept in your browser's storage (localStorage). They are never sent to the server.
- IP address, used only briefly: to limit the number of games created from the same address, and by Cloudflare Turnstile's anti-bot check. That check only loads once you start creating a game: when the nickname field of the “Create a game” form is selected or you press that button, never just for visiting the site or joining a game. The IP address is not stored in the games or in the logs.
- Error reports: when a technical error occurs, a report is sent to Sentry with your browser and operating system type, the page concerned (without the game code) and a technical description of the error. It contains no IP address, nickname or game code.
Purposes and legal bases
- Running the game (nicknames, answers, scores, reconnection) and solo mode (personal bests): legitimate interest in providing the game you started or joined (Article 6(1)(f) GDPR).
- Limiting abuse (rate limits, anti-bot check): legitimate interest in protecting the service and its players (Article 6(1)(f) GDPR).
- Spotting technical errors in the game: legitimate interest in keeping the service working (Article 6(1)(f) GDPR).
Recipients and transfers
- Cloudflare, Inc. hosts the site and the games, and provides the Turnstile anti-bot check. To do so, Cloudflare processes technical data (IP address, browser), including in the United States. Cloudflare is certified under the EU–US Data Privacy Framework, which governs these transfers. The server's request logs are turned off. See Cloudflare's privacy policy.
- Functional Software, Inc. (Sentry) receives the error reports, stored in its European Union region. Sentry is certified under the EU–US Data Privacy Framework. The reports contain no IP address, nickname or game code. See Sentry's privacy policy.
- OVH SAS is only the registrar of the domain name: it receives no player data.
- No data is sold, rented out or shared for advertising.
Retention periods
| Data | Retention period |
|---|---|
| Nicknames, answers, scores | Deleted automatically two hours after the game's last activity, or thirty minutes after it ends |
| Session token | Until the tab is closed; its hash on the server is deleted with the game |
| Solo personal bests | On your device, until you clear the site's data |
| IP address for the game-creation limit | Kept for one minute in a rate-limit counter at Cloudflare |
| Error reports | Up to 90 days at Sentry |
Your rights
The GDPR gives you the following rights over your data:
- access: find out what data relates to you;
- rectification: have inaccurate data corrected;
- erasure: have your data deleted;
- objection: object to processing based on legitimate interest;
- restriction: have processing put on hold;
- portability: get your data back in a readable format.
To exercise them, write to contact@memoluz.com. In practice, a game's data deletes itself two hours after its last activity, and with no account, nothing can then link it back to you. Your solo personal bests are erased when you clear the site's data in your browser.
Memoluz carries out no automated decision-making that produces legal effects concerning you, and no profiling.
You can also lodge a complaint with the CNIL, the French data protection authority:
- Address
- 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
- Website
- www.cnil.fr
Changes
The date of this policy's last update is shown at the top of the page.