Privacy Policy

1. Data controller

The data controller is [à compléter] , [à compléter] , whose address is [à compléter] .

For any question regarding your data, or to exercise your rights: [à compléter] .

2. Data collected

Registered account

• username, shown to other players;
• email address, used as the login identifier;
• password, never stored in plain text: only a cryptographic hash (scrypt) is stored;
• rating, role, and the account's creation and update dates.

Guest account

A username, appended with a random suffix. No email address, no password: this account cannot be logged back into later.

Sign-in via Google

If you choose to sign in or register via Google, your browser communicates directly with Google, not with this service — we never see your Google password. Google then sends us your email address, the name associated with your Google account, and an identifier unique to that account, which we use to create your account or recognize you on a future visit. Google does not act here as a processor for this service: it is a third party you choose to use, in the same way as a link you would follow yourself to another site.

Games

Games played online are stored: players, moves, timestamps, time remaining on the clocks, and result. Local mode sends nothing to the server.

Password reset

A reset request creates a single-use token. Only a hash of this token is stored, never the link itself, alongside the account identifier and the expiry date. The link is sent by email to the account's address, via the sending provider mentioned in point 5.

Technical data

• IP address : processed on the fly to limit the number of registrations and login attempts per address. The counters live in the server's memory and are reset at each counting window. It may also appear in the server's technical logs.
  For a guest account only, the address at the time of creation is additionally kept with the account: it is used to flag to moderators that a new guest account shares its address with an already-banned account, without automatically blocking or identifying anyone — a human operator decides what happens next. Retention period at point 4. A registered account keeps none.
• Tab identifier : a random identifier, generated by your browser and unrelated to your account, which feeds the count of connected players. It is kept in memory for a few dozen seconds after your last sign of activity.

The service uses no audience measurement tool, no advertising network, and no third-party tracker.

3. Purposes and legal bases

Providing the service

Account creation, matchmaking of players, running and history of games, ranking. Legal basis: performance of the Terms of use accepted by using the service.

Recovering access to your account

Sending, at your request only, a password reset link to the account's address. Legal basis: performance of the terms of use. No other email is sent to you — the service sends neither newsletters nor promotional messages.

Security and abuse prevention

Rate limiting on registration, login, and matchmaking, technical logs enabling diagnosis of an incident. Legal basis: the operator's legitimate interest in keeping the service available and protecting it against abuse.

4. Retention periods

• Registered account : kept for as long as the account exists, and deleted on request.
• Guest account : kept for the duration of the game and the validity of the associated token, i.e. 30 days at most. Its creation address (see point 2) follows the same period: deleted along with the account.
• Session tokens : 30 days, or immediately revoked upon logout.
• Games : kept for history and ranking purposes. They can be dissociated from the account: when an account is deleted, they may be kept in a form that no longer allows you to be identified.
• Reset tokens : 1 heure, and destroyed as soon as they have been used or a new request replaces them.
• Technical logs : 12 mois.
• Backups : the databases are backed up daily; deleted data disappears from backups once their rotation completes.

5. Recipients and hosting

Your data is neither sold nor rented nor transferred to third parties for commercial purposes. It is accessible only to the operator and its hosting providers, acting as data processors:

• [à compléter] — [à compléter] : hosting of the site, the API, and the games database.
• Supabase, Inc.: hosting of the accounts database, region [à compléter] .
• [à compléter] : delivery of the password reset email. Only the recipient's address is sent to them.

Where one of these regions is located outside the European Union, the transfer is governed by the European Commission's standard contractual clauses provided for in the corresponding data processing agreement.

6. Cookies and local storage

Authentication relies on a bearer token sent in the HTTP header of requests, not on a session cookie — the service sets none for this purpose.

Three pieces of information are written to your browser's storage without being requested from you, all strictly necessary for the operation of the service you are requesting:

• stt.session (local storage): your login token, so you don't have to authenticate on every page. Cleared on logout.
• stt.theme (local storage): your light or dark theme preference.
• stt.tab-id (session storage): the tab identifier feeding the count of connected players. It disappears when the tab is closed.

None of this information is used for advertising purposes or cross-site tracking. You can clear it at any time from your browser's settings; you will then be logged out.

7. Security

• exchanges with the service are encrypted over HTTPS;
• passwords are hashed with scrypt, making their original value unrecoverable, even by the operator;
• direct access to the databases is restricted to the addresses of the server that operates them;
• reset links are single-use, expire, and are stored only as a hash: access to the database does not allow one to be reconstructed;
• a player's email address is never sent to other players: only the username, guest status, and rating are shared.

8. Your rights

In accordance with Regulation (EU) 2016/679 and the French Data Protection Act (loi Informatique et Libertés), you have the right to access, rectify, erase, restrict, object to, and port the data concerning you.

These rights are exercised by email at [à compléter] . A response will be provided within one month. Proof of identity may be requested if there is reasonable doubt as to the identity of the requester.

If the response does not satisfy you, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy — TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

9. Changes to this policy

This policy may evolve along with the service. The version in force is the one published on this page; its update date appears at the top.