Privacy policy

Data processed

• Account: identifier, email address and, when signing in with X, the public handle, display name and profile image supplied by the provider.
• Public profile: displayed handle, outbound link, artwork. These are published on the wall, therefore visible to all and indexable.
• Game data: production state, in-game purchases, timestamps, lifetime score, rank history.
• Payments: customer identifier and subscription status. Card details are entered at Stripe and never pass through our servers.
• Technical logs: IP address, timestamp, browser type, kept for security and fraud prevention.
• Outbound clicks: an aggregated, deduplicated counter per entry, with no individual visitor profiling.

Purposes and legal bases

• Providing the service, maintaining the ranking and displaying the public wall: performance of the contract.
• Processing subscriptions and purchases, issuing invoices: performance of the contract and legal obligation.
• Preventing fraud, cheating and abuse, moderating published content: legitimate interest.
• Answering contact requests and reports: legitimate interest and legal obligation.
• Meeting accounting and tax obligations: legal obligation.

Retention periods

• Account and game data: for the life of the account, then erased on deletion.
• Accounting records relating to payments: the statutory retention period applicable to accounting and tax records.
• Technical logs: a limited period, proportionate to the security purpose.
• Hall of fame: kept indefinitely, but anonymised when the corresponding account is deleted.

Recipients and processors

Your data is not sold, rented or shared for advertising purposes. It is processed by the providers strictly necessary to run the service:

• Supabase: database, authentication and realtime.
• Vercel: hosting and delivery of the site.
• Stripe: payment and billing processing.

Some of these providers are established outside the European Union. The corresponding transfers rely on the safeguards provided by the GDPR, in particular the European Commission's standard contractual clauses.

What is public

Your handle, link, artwork, score and your entry's click counter are public by nature: that is the very purpose of the wall. Do not publish information you do not want to be public.

Your rights

You have rights of access, rectification, erasure, restriction, objection and portability, as well as the right to give directions on what happens to your data after your death.

To exercise them: tinymonolithapps@gmail.com. You may also lodge a complaint with the CNIL.

Security

Database access is governed by server-side policies: score and game data cannot be modified from a browser. Traffic is encrypted in transit.

Minors

The service is not intended for people under fifteen. An account created in breach of this rule is deleted upon report.