Privacy policy

The data controller is À COMPLÉTER, publisher of UDaPimp. Full contact details are given in the legal notice.

For any question about your data, or to exercise your rights: À COMPLÉTER.

• No payment data: the game is free and has no payment mechanism at all.
• No name, postal address or phone number is ever requested.
• No geolocation, no advertising profiling, no selling of data.
• No email is ever sent: your address is only a sign-in identifier.
• Audience measurement starts only after you agree, and stops the moment you withdraw.

Game data is kept for as long as your account exists. Inactive accounts are not deleted automatically: since no email can be sent, an account cannot be warned before being erased, and deleting it without notice would do more harm than keeping it. You can delete your account whenever you like, in one click.

UDaPimp has a competitive side. Other players can see:

• your nickname and your Boss level, on the season leaderboard;
• your nickname in the scouting reports and confrontation notifications that involve you;
• the cards you expose in competitive play.

Other players can never see: your email address, your date of birth, your PimpChat conversations or your Keepsake Box. Once an account is deleted, its nickname disappears from other players’ history and shows as “Unknown”.

Choosing a nickname that does not reveal your real identity remains the best protection.

Data is never sold, rented or traded. It is shared only with the providers strictly needed to run the service, who act on instruction and cannot use it for their own purposes:

Data may also be disclosed to the competent authorities where the law requires it.

⚠️ À COMPLÉTER — the hosting region must be filled in `src/content/legal/editeur.ts`: it determines whether data is transferred outside the European Union, which must be disclosed here.

Browser notification services are operated by Google, Mozilla and Apple, which may involve a transfer outside the European Union. These notifications only work if you explicitly turned them on, and you can turn them off at any time from your Account screen.

• Traffic to and from the site is encrypted (HTTPS).
• Passwords are stored as salted scrypt hashes, never in clear text. Nobody, not even the publisher, can read your password.
• The session cookie is unreadable by JavaScript, restricted to this site and sent over HTTPS only. Signing in again invalidates previous sessions.
• Every game action is validated on the server, which also protects your save from tampering.

Automated checks watch for abnormal action rates and collusion between accounts. They can flag an account and, where a breach is established, suspend its access.

You have the right to ask for a human review of any measure affecting you, to be told the reason for it and to contest the decision: write to À COMPLÉTER. No other automated processing has a significant effect on you, and there is no profiling for advertising purposes.

The General Data Protection Regulation gives you the following rights, which you can exercise directly:

• Access and portability — from your Account screen, the “Export my data” button immediately downloads all of your data as a readable, reusable JSON file.
• Erasure — from your Account screen, “Delete my account” permanently erases your account and the associated data, after confirmation with your password.
• Withdrawal of consent — audience measurement is set from the Cookies and trackers page or from your Account screen; notifications are set from your Account screen. Withdrawal does not affect what was done beforehand.
• Rectification — the game does not yet have a profile-editing screen: write to À COMPLÉTER to have your email address, nickname or date of birth corrected.
• Objection and restriction — for processing based on legitimate interest (anti-cheat, error reports), write to À COMPLÉTER explaining your situation.

A request sent by email is answered within one month. Proof of identity may be requested if there is reasonable doubt about who is making the request.

Two limits worth stating plainly: data already sent to PostHog and Sentry is not erased automatically when you delete your account — write to us to have it removed at those providers. And confrontation history kept by other players remains, but your nickname there becomes “Unknown”.

If, after contacting us, you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr. If you live in another EU country, you may also contact your own supervisory authority.

UDaPimp is restricted to people aged 18 and over, and age is checked at sign-up. No data belonging to a minor should ever be processed. If we are made aware of an account belonging to a minor, it will be deleted without delay: report it to À COMPLÉTER.

This policy may be updated to reflect how the service or the applicable rules evolve. The date of the latest update appears at the top of the document. Where a change is substantial, players are told about it inside the game.