Privacy Policy

Application: HistoMaker · https://histomaker.com · Last updated: September 14, 2026

Version bilingue (français + anglais) : politique de confidentialité

HistoMaker is a free online collectible card game about historical figures of France, available at https://histomaker.com. This Privacy Policy explains what personal data the application collects, why it collects it, how it uses, stores, shares and protects that data, how long it keeps it, and how you can access or delete it. It also describes, in a dedicated section, how the application handles Google user data obtained through “Sign in with Google”. In short: only what the game needs to run, an email address, a username and your progress. Nothing is sold, nothing serves targeted advertising, no newsletter is sent without your consent, and you can delete everything in two clicks from the “Mon Profil” tab.

1. Data Controller

HistoMaker is published by an individual, on a personal and non-professional basis. For any question or request regarding your personal data, contact contact@histomaker.com. Legal information is available on our legal notice page.

2. Information We Collect

Account information : email address, username, sign-up date. If you register with a password, the password itself is never stored: our authentication provider keeps only a cryptographic hash.
Google account information (optional) : see section 4, which is entirely dedicated to Google user data.
Game data : cards you own, decks you build, matches you play and their course, victory points, in-game currency (“coins”), unlocked artwork and playmats, and friendships with other players.
Technical logs : IP address, timestamp, requested page and browser type, kept for security, anti-cheating and troubleshooting purposes.
Game newsletter (optional) : your choice, its date, the version of the wording you accepted and your confirmation that you are 15 or older. This is the record of your consent, see section 9.
Display preferences : sound, card size, visual effects. These are stored in your own browser and are never transmitted to us.

We collect no payment data: the game is free and contains no purchase. We do not collect special categories of data (health, political opinions, ethnic origin, sexual orientation) as defined by Article 9 of the GDPR.

3. How We Use Your Information

Create and manage your player account, and authenticate you.
Run the game: save your progress, match you against other players, keep your collection and decks.
Display your username and avatar to the players you interact with (friends list, opponent in a match).
Notify you when a turn-based match is waiting for you.
Send you game news by email, only if you switched it on yourself.
Protect the service: prevent cheating and abuse, diagnose failures.

Under the GDPR, the legal basis is the performance of our contract with you (Article 6(1)(b)) for everything related to your account and the game, and our legitimate interest (Article 6(1)(f)) for security and abuse prevention. Game news by email relies solely on your consent (Article 6(1)(a)), which you can withdraw at any time; keeping a record of that consent is a legal obligation (Articles 6(1)(c) and 7(1)). We do not carry out any automated decision-making producing legal effects concerning you.

4. Google User Data

“Sign in with Google” is an optional alternative to the email-and-password sign-in. This section describes precisely how HistoMaker accesses, uses, stores and shares Google user data.

What we access

Only the following non-sensitive OAuth scopes, and only if you actively choose to sign in with Google:

openid : a unique Google account identifier, used to recognise you across sign-ins.
https://www.googleapis.com/auth/userinfo.email, your email address and its verified status.
https://www.googleapis.com/auth/userinfo.profile, your display name and public profile picture.

We request no other access to your Google account. HistoMaker does not access Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos, or any other Google API containing personal data beyond the three scopes listed above.

How we use it

Your email address identifies your player account and links your Google sign-in to an existing account registered with the same address. It is also used for service messages such as password resets and, only if you switch it on yourself in your profile, for game news (section 9).
Your name and profile picture pre-fill your player profile and are shown to players you interact with. You can change them at any time.
Your Google account identifier is used solely for authentication.

The use of Google user data is limited to providing and improving the sign-in, player-profile and messaging features described above. We do not use Google user data for targeted advertising, whether ours or third parties’, profiling, credit assessment, or to develop or train generalised artificial-intelligence or machine-learning models. We do not sell Google user data, and we do not transfer it to data brokers or information resellers.

How we store it

Google user data is stored in our database, hosted by Supabase within the European Union, and transmitted exclusively over HTTPS/TLS. Database access is restricted to our game server; browsers have no write access whatsoever. We never store your Google password, and we do not retain any long-lived access token or refresh token for your Google account.

How we share it

We do not share Google user data with anyone, apart from the technical service providers listed in section 5, which act solely on our instructions, and except where disclosure is required by a lawful request from a judicial authority. Other players only ever see your username and avatar.

How to withdraw access and delete it

Revoke HistoMaker’s access at any time from myaccount.google.com/permissions. Google will then stop sharing any data with us.
Permanently delete your account and all associated data : including data obtained from Google, from the “Mon Profil” tab inside the game. Deletion takes effect immediately.

6. Data Retention

Account and game data : kept for as long as your account exists.
Inactive accounts : deleted after three years without sign-in, following a warning email.
Technical logs : 12 months maximum.
Game newsletter : your address leaves the mailing list as soon as you withdraw consent; the record of consent and withdrawal is kept for as long as your account exists, then erased with it.
Past matches : they also concern your opponent; after you delete your account they remain in your opponent’s history without your personal data.

7. Data Security

All traffic is encrypted with HTTPS/TLS. Passwords are never stored in plain text. Database write access from browsers is disabled entirely, all game rules are computed server-side so that no client can alter scores or balances, and sensitive endpoints are rate-limited. Access to production data is restricted to the publisher. Despite these measures, no online service is infallible: in the event of a personal data breach likely to result in a high risk to you, you would be informed in accordance with Article 34 of the GDPR.

8. Your Rights

You have the right to access, rectify, erase, restrict and port your personal data, and to object to its processing, as well as the right to give directives concerning your data after your death.

The fastest route: the “Mon Profil” tab inside the game lets you change your password and delete your account immediately, along with all associated data, and to withdraw your consent to game news in one tap. For any other request, write to contact@histomaker.com; we reply within one month. If you are not satisfied, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France : cnil.fr.

9. Game News by Email

New seasons, new cards, events: these emails are sent only if you switched them on yourself in the “Mon Profil” tab. The setting is off when an account is created, is never a condition for any reward, and switching it on requires confirming that you are 15 or older.

What we record : the opt-in or withdrawal, its date, the version of the wording shown and the age confirmation. Nothing else.
What Brevo receives : your email address, and nothing else.
No individual tracking of opens or clicks is linked to your account.
Withdrawal : at any time, by switching the setting off in your profile or by clicking the unsubscribe link included in every email. Both are kept in sync.

10. Cookies

We use strictly necessary cookies only: they keep you signed in. Such cookies are exempt from consent requirements, which is why no cookie banner is shown. We use no advertising cookies, no third-party analytics and no tracking technologies.

11. Children’s Privacy

The game is intended for players aged 15 and over. Below that age, creating an account requires the consent of a parent or legal guardian, in accordance with Article 8 of the GDPR as applied in France. We recommend choosing a username that does not reveal your real identity. Game news by email can only be switched on after confirming that you are 15 or older.

12. Changes to This Policy

This policy may change as the game evolves. The last-updated date appears at the top of this page, and any substantial change is announced inside the game.

13. Contact Us

For any question about this policy or about your personal data, contact us at contact@histomaker.com.