Privacy Policy

Application: HistoMaker · https://histomaker.com · Last updated: September 8, 2026

Version bilingue (français + anglais) : politique de confidentialité

HistoMaker is a free online collectible card game about historical figures of France, available at https://histomaker.com. This Privacy Policy explains what personal data the application collects, why it collects it, how it uses, stores, shares and protects that data, how long it keeps it, and how you can access or delete it. It also describes, in a dedicated section, how the application handles Google user data obtained through “Sign in with Google”. In short: only what the game needs to run, an email address, a username and your progress. Nothing is sold, nothing serves advertising, and you can delete everything in two clicks from the “Mon Profil” tab.

1. Data Controller

HistoMaker is published by an individual, on a personal and non-professional basis. For any question or request regarding your personal data, contact contact@histomaker.com. Legal information is available on our legal notice page.

2. Information We Collect

Account information : email address, username, sign-up date. If you register with a password, the password itself is never stored: our authentication provider keeps only a cryptographic hash.
Google account information (optional) : see section 4, which is entirely dedicated to Google user data.
Game data : cards you own, decks you build, matches you play and their course, victory points, in-game currency (“coins”), unlocked artwork and playmats, and friendships with other players.
Technical logs : IP address, timestamp, requested page and browser type, kept for security, anti-cheating and troubleshooting purposes.
Display preferences : sound, card size, visual effects. These are stored in your own browser and are never transmitted to us.

We collect no payment data: the game is free and contains no purchase. We do not collect special categories of data (health, political opinions, ethnic origin, sexual orientation) as defined by Article 9 of the GDPR.

3. How We Use Your Information

Create and manage your player account, and authenticate you.
Run the game: save your progress, match you against other players, keep your collection and decks.
Display your username and avatar to the players you interact with (friends list, opponent in a match).
Notify you when a turn-based match is waiting for you.
Protect the service: prevent cheating and abuse, diagnose failures.

Under the GDPR, the legal basis is the performance of our contract with you (Article 6(1)(b)) for everything related to your account and the game, and our legitimate interest (Article 6(1)(f)) for security and abuse prevention. We do not carry out any automated decision-making producing legal effects concerning you.

4. Google User Data

“Sign in with Google” is an optional alternative to the email-and-password sign-in. This section describes precisely how HistoMaker accesses, uses, stores and shares Google user data.

What we access

Only the following non-sensitive OAuth scopes, and only if you actively choose to sign in with Google:

openid : a unique Google account identifier, used to recognise you across sign-ins.
https://www.googleapis.com/auth/userinfo.email, your email address and its verified status.
https://www.googleapis.com/auth/userinfo.profile, your display name and public profile picture.

We request no other access to your Google account. HistoMaker does not access Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos, or any other Google API containing personal data beyond the three scopes listed above.

How we use it

Your email address identifies your player account and links your Google sign-in to an existing account registered with the same address. It is also used for service messages such as password resets.
Your name and profile picture pre-fill your player profile and are shown to players you interact with. You can change them at any time.
Your Google account identifier is used solely for authentication.

The use of Google user data is limited to providing and improving the sign-in and player-profile features described above. We do not use Google user data for advertising, profiling, credit assessment, or to develop or train generalised artificial-intelligence or machine-learning models. We do not sell Google user data, and we do not transfer it to data brokers or information resellers.

How we store it

Google user data is stored in our database, hosted by Supabase within the European Union, and transmitted exclusively over HTTPS/TLS. Database access is restricted to our game server; browsers have no write access whatsoever. We never store your Google password, and we do not retain any long-lived access token or refresh token for your Google account.

How we share it

We do not share Google user data with anyone, apart from the technical service providers listed in section 5, which act solely on our instructions, and except where disclosure is required by a lawful request from a judicial authority. Other players only ever see your username and avatar.

How to withdraw access and delete it

Revoke HistoMaker’s access at any time from myaccount.google.com/permissions. Google will then stop sharing any data with us.
Permanently delete your account and all associated data : including data obtained from Google, from the “Mon Profil” tab inside the game. Deletion takes effect immediately.

5. How We Share Information

We never sell or rent your personal data. It is processed by the following service providers, acting on our instructions only:

Supabase, Inc. : database and authentication. Hosting within the European Union.
Cloudflare, Inc. : website hosting and protection against attacks (United States).
Render Services, Inc. : game server (United States).
Google LLC : only if you choose to sign in with Google (United States).

Transfers to the United States are governed by the European Commission’s Standard Contractual Clauses and, where applicable, by these companies’ certification under the EU–U.S. Data Privacy Framework. Data may also be disclosed to a judicial authority upon lawful request.

6. Data Retention

Account and game data : kept for as long as your account exists.
Inactive accounts : deleted after three years without sign-in, following a warning email.
Technical logs : 12 months maximum.
Past matches : they also concern your opponent; after you delete your account they remain in your opponent’s history without your personal data.

7. Data Security

All traffic is encrypted with HTTPS/TLS. Passwords are never stored in plain text. Database write access from browsers is disabled entirely, all game rules are computed server-side so that no client can alter scores or balances, and sensitive endpoints are rate-limited. Access to production data is restricted to the publisher. Despite these measures, no online service is infallible: in the event of a personal data breach likely to result in a high risk to you, you would be informed in accordance with Article 34 of the GDPR.

8. Your Rights

You have the right to access, rectify, erase, restrict and port your personal data, and to object to its processing, as well as the right to give directives concerning your data after your death.

The fastest route: the “Mon Profil” tab inside the game lets you change your password and delete your account immediately, along with all associated data. For any other request, write to contact@histomaker.com; we reply within one month. If you are not satisfied, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France : cnil.fr.

9. Cookies

We use strictly necessary cookies only: they keep you signed in. Such cookies are exempt from consent requirements, which is why no cookie banner is shown. We use no advertising cookies, no third-party analytics and no tracking technologies.

10. Children’s Privacy

The game is intended for players aged 15 and over. Below that age, creating an account requires the consent of a parent or legal guardian, in accordance with Article 8 of the GDPR as applied in France. We recommend choosing a username that does not reveal your real identity.

11. Changes to This Policy

This policy may change as the game evolves. The last-updated date appears at the top of this page, and any substantial change is announced inside the game.

12. Contact Us

For any question about this policy or about your personal data, contact us at contact@histomaker.com.