Privacy policy
This translation is provided for convenience. Only the French version is legally binding. Read the French version →
This policy explains which personal data the Temporia app and the temporia.app website process, why, for how long, and how to exercise your rights.
1. Data controller
The data controller is PIXICODE, a French single-member limited liability company (EURL) with a share capital of 1,000 euros, whose registered office is located at 2 Place Jean V, 44000 Nantes, France, registered with the Nantes Trade and Companies Register (RCS) under number 980 083 786, represented by its manager, Emric Pichonnier.
- Contact: temporia@pixicode.dev
- Personal data contact: dpo@pixicode.dev
The legal notice supplements this information.
2. Scope
This policy applies to the Temporia mobile app (iOS and Android) and to the temporia.app website, including its sharing pages. It is drawn up in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the amended French Data Protection Act No. 78-17 of 6 January 1978 (“Informatique et Libertés”).
3. Data we process
We collect the minimum needed for the game to work. Temporia never asks for your name, date of birth, postal address or phone number.
Guest account. On first launch, the app automatically creates a guest account without asking you anything. We record a random player identifier, and your device’s language and time zone. A guest secret is generated and kept in your device’s secure storage; our servers only keep a hash of it. If you uninstall the app without having linked this account to a sign-in method, the secret is lost and the account can no longer be recovered.
Email account. If you create an account with an email address and a password, your address is never stored in plain text: we only keep a cryptographic hash of it (SHA-256 combined with a secret specific to our servers), used solely to recognise you when you sign in. The password is only stored as an Argon2 hash. We therefore never write to you on our own initiative: no newsletter, no promotional messages.
Password reset. If you ask to reset your password, the address you enter is used solely to send you, if it matches an account, a transactional email containing a 6-digit code. This code is single-use and valid for 15 minutes, and we only keep a hash of it. The address you enter is passed to our email delivery provider, Brevo (France), to route the message, and is not stored in plain text by our servers. The number of requests is limited, per address and per IP address, to prevent abuse.
Sign in with Google or Apple. If you use “Sign in with Google” or “Sign in with Apple”, we receive from that service an account identifier specific to it, together with your email address (or the relay address provided by Apple if you chose to hide yours). We only keep the identifier and a hash of the address, never the address in plain text, and then issue our own session tokens.
Profile and social features. Display name (if you choose one), friend code, list of your friends, scores in the weekly friends leaderboard, badges, level and experience points. Your display name and your score for the week are visible to the players you are friends with.
Game data. Games played and each of your card placements, results and scores, daily streaks and streak freezes, coins earned and spent, unlocked archive days, cosmetics and hints used.
Card reports. When you report a card, we record the card concerned, the reason chosen and, if you write one, your comment (500 characters maximum), linked to your player identifier.
Purchases. Temporia+ purchases are processed by Apple (App Store) or Google (Google Play). The app sends our server the proof of purchase provided by the store (purchase token or signed transaction), which our server verifies directly with Apple or Google before linking the purchase to your account. When you buy, the app also gives the store a random technical identifier specific to your account, with no name or address, so that store notifications (renewal, expiry, refund) can be linked to your account. We receive and keep the purchase or transaction identifiers assigned by the store, the product purchased, the dates (purchase, expiry), the purchase status (active, renewed, expired, refunded, revoked), the related events and the status of your Temporia+ entitlements. No banking data is ever shared with us: payment is handled entirely by Apple or Google.
Advertising. The app displays Google AdMob ads: a banner, full-screen ads between two screens, and rewarded videos that you choose to watch. AdMob processes your device’s advertising identifier and ad delivery data, within the limits of your consent (see section 6). When you watch a rewarded video, we create a single-use reward intent, linked to your player identifier, which Google confirms to our servers before the reward is granted.
Consent. Your advertising choices are collected by Google’s consent management tool (compliant with the European TCF framework) and stored on your device. On iOS, your answer to the tracking permission request (App Tracking Transparency) is handled by the system.
App analytics. Only if you allow it in the app’s settings, we measure the use of screens and features with Matomo, a tool hosted on our own servers. Measurements are linked to a pseudonymous identifier, your player identifier.
Notifications. If you allow notifications, we keep your device’s notification token (Firebase Cloud Messaging), your preferences (daily reminder and its time, streak-at-risk alerts), your time zone and the history of notifications sent, which we use to limit their number. The system permission is only requested after a game you have won.
Technical data. App version, platform (iOS or Android), language and IP address, recorded in our servers’ technical logs. Rate-limiting counters, indexed by player identifier or IP address, are kept in memory only. Cheat-detection flags may be attached to a game.
Error and crash reporting. When the app, our servers or our administration tool encounter an unexpected error or a crash, a technical report is sent to GlitchTip, our error tracking tool (compatible with the Sentry SDK), which we run ourselves on a server hosted by OVH in the European Union. The report contains the nature of the error and where in the code it occurred, the last technical steps that preceded it, the app version, the platform, and the device model and operating system. Sending personal data is disabled both in the app and on our servers: the report contains no IP address, screenshot, email address, name, password or session token. It may include a pseudonymous technical identifier (a random installation identifier, or your player identifier if it appears in the error message).
4. Purposes, legal bases and retention periods
| Purpose | Legal basis (Art. 6 GDPR) | Retention period |
|---|---|---|
| Creating and managing your account, letting you play, keeping your progress | Performance of the contract (Art. 6(1)(b)) | Lifetime of the account (a guest account that has not opened the app for 24 months is deleted following the same procedure). After a deletion request: identifiers erased after 30 days, then removed from backups no more than 30 days later (section 11) |
| Keeping you signed in | Performance of the contract (Art. 6(1)(b)) | Access token: 15 minutes. Refresh token: 60 days, revoked on sign-out or account deletion; our servers only keep a hash of it, unusable once the token has expired or been revoked |
| Resetting your password at your request | Performance of the contract (Art. 6(1)(b)) | Reset code: valid for 15 minutes, single use, hash erased no later than two days after it expires. Address entered: not stored in plain text by our servers, only for the time needed to send the email |
| Friends, weekly leaderboards and badges | Performance of the contract (Art. 6(1)(b)) | Lifetime of the account |
| Processing Temporia+ purchases and managing your entitlements | Performance of the contract (Art. 6(1)(b)), then legal obligation (Art. 6(1)(c)) for accounting records | Duration of the subscription or access, then 10 years for purchase events (accounting records, Article L.123-22 of the French Commercial Code) |
| Granting rewards for optional ads | Performance of the contract (Art. 6(1)(b)) | Reward intent: valid for 30 minutes, then kept with the account’s game history (daily cap, fraud prevention) |
| Showing personalised ads | Consent (Art. 6(1)(a)) | Until consent is withdrawn |
| Measuring app usage (Matomo) | Consent (Art. 6(1)(a)) | Until consent is withdrawn; measurements deleted no later than 13 months after collection |
| Sending notifications | Consent (Art. 6(1)(a)) | Notification token and preferences: until notifications are turned off or the account is deleted (token erased immediately). History of notifications sent: lifetime of the account |
| Securing the service, preventing cheating and abuse, rate limiting | Legitimate interest (Art. 6(1)(f)): protecting the service and the fairness of the game | Web server access logs: 12 months at most. Application logs of our servers: continuously erased by rotation (a few days in practice). Rate-limiting counters: in memory only |
| Detecting and fixing errors and crashes (GlitchTip) | Legitimate interest (Art. 6(1)(f)): keeping the app and the service working reliably | Error reports: 90 days, then deleted automatically |
| Handling card reports | Legitimate interest (Art. 6(1)(f)): correcting the game’s content | Lifetime of the account, like the game history (section 11) |
| Answering your requests and the exercise of your rights | Legitimate interest (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) | Time needed to handle the request |
Data needed for the game to work is essential: without it, the service cannot be provided. Processing based on consent is optional, and refusing it does not prevent you from playing.
5. Source of the data
The data comes from you (games played, display name, reports), from your device (language, time zone, technical data), from the identity provider you choose (Google or Apple), from the purchase platform (Apple or Google) and from Google AdMob for reward confirmation. We do not buy any data and do not enrich it with third-party sources.
6. Advertising and consent
On first launch, a consent screen compliant with the European framework asks whether you accept personalised advertising. On iOS, the system also asks for tracking permission (App Tracking Transparency). If you refuse, non-personalised ads are still shown: they are not based on your behaviour.
Rewarded videos are always optional. Temporia+ removes forced ads.
In the European Economic Area and the United Kingdom, the “Ad choices” entry in the app’s Settings reopens the consent form: you can change or withdraw your choice there at any time, as easily as you gave it.
You can withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand: reset or delete the advertising identifier in your device’s settings, refuse tracking in iOS privacy settings, or clear the app’s data (Android) or reinstall it. Since your choice is stored only on the device, the consent screen is then shown to you again at the next launch.
7. Recipients and processors
Your data is never sold, rented or transferred to third parties for commercial purposes. Access is limited to the following, each within its own remit:
- authorised PIXICODE staff, within the limits of their duties;
- OVH SAS (France), host of our servers, our database and the website;
- Google Ireland Limited, for advertising (Google AdMob), notification delivery (Firebase Cloud Messaging), Sign in with Google, and purchases made on Google Play;
- Apple Distribution International Ltd., for Sign in with Apple, purchases made on the App Store and notification delivery on iOS;
- Brevo (France), our email delivery provider, solely to deliver the password reset emails you request.
App analytics (Matomo), error tracking (GlitchTip), authentication and the game database run on our own infrastructure, hosted by OVH.
The game’s cards are prepared from events published by Wikidata, with the help of artificial intelligence tools. These tools only process those events: no player data is ever sent to them.
8. Transfers outside the European Union
Our servers are hosted in the European Union. Some of our processors (notably Google and Apple) belong to groups that may process data outside the Union, in particular in the United States. These transfers are governed by the adequacy decision on the EU-US Data Privacy Framework where the recipient has joined it, or failing that by the standard contractual clauses adopted by the European Commission, in accordance with Articles 44 et seq. of the GDPR.
9. Security
Exchanges between the app, the website and our servers are encrypted (TLS). Email addresses are only stored as hashes, passwords as Argon2 hashes, and reset codes as hashes with a limited number of attempts. On your device, sign-in secrets are kept in the system’s secure storage (Keychain on iOS, encrypted storage on Android). Refresh tokens are rotated on every use and can be revoked; our servers only keep a hash of them. Access to production data is restricted to the people who need it. The database is backed up every day; backups are encrypted before being copied off our servers, within the European Union, and kept for 30 days.
10. Your rights
In accordance with Articles 15 to 22 of the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to give instructions on what happens to your data after your death. Where processing is based on your consent, you can withdraw it at any time.
To exercise these rights, write to dpo@pixicode.dev. Since we do not know your email address, please tell us how to find your account:
- email account: write to us from that address; we recompute its hash to find the matching account;
- guest, Google or Apple account: give us your friend code, shown on your profile in the app.
We reply within one month of receiving the request; this period may be extended by two months for complex requests. Proof may be requested if there is reasonable doubt about your identity.
If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (cnil.fr), or with the supervisory authority of your country of residence.
11. Account deletion
You can delete your account at any time from the app: Settings › Account › Delete my account. You can also request deletion without the app, by email: the steps are described on the Delete your account page.
- Immediately, the account is deactivated: all your sessions are revoked; if you signed in with Apple, the authorization granted to Temporia is revoked with Apple; you are removed from your friends’ lists and leaderboards, and your device’s notification token is erased.
- 30 days later, your sign-in identifiers (Google and Apple identifiers, hashes of your email address and password, hash of the guest secret), your display name and your friend code are permanently erased. The remaining game history (games, scores, streaks, badges, coin transactions) is no longer linked to any sign-in method or any name: it is kept in pseudonymised form, only for game statistics.
- For up to 30 more days, erased data may remain in our encrypted backups (section 9), which are only used to restore the service after an incident and are deleted after 30 days.
We also keep Temporia+ purchase events (accounting records) for the legal retention period for accounting records and, if you had consented to them, Matomo audience measurements until they are deleted no later than 13 months after collection. Details are on the Delete your account page.
Please note: deleting your account does not cancel a Temporia+ subscription. Cancel it from your App Store or Google Play account settings, otherwise it will keep renewing.
12. Minors
Temporia is reserved for people aged 13 or over. We do not knowingly collect data about children under 13: if we learn that an account belongs to a child under that age, we delete it.
In France, under Article 45 of the French Data Protection Act, a minor under 15 cannot consent alone to processing based on consent (personalised advertising, Matomo analytics, notifications): between the ages of 13 and 15, the agreement of a holder of parental authority is required in addition to the minor’s own. If you are a parent and believe your child has provided us with data without your agreement, write to dpo@pixicode.dev.
13. The temporia.app website
The temporia.app website sets no cookies, performs no audience measurement and shows no ads. It does not load any resources from third-party servers.
Like any web server, our server records the IP address, date, requested page and browser used in its technical logs, for security purposes. These logs are kept for 12 months at most.
Sharing links of the form temporia.app/p/… open an invitation page that is the same for everyone.
The information they contain (challenge number, result grid, streak) is intended only for the app
and includes no data that could identify you.
14. Changes
This policy may change, in particular to reflect new features or changes in regulations. The date of the last update appears at the bottom of the page. In the event of a substantial change, you will be informed in the app.
15. Contact
Any question about this policy or your data can be sent to dpo@pixicode.dev or to temporia@pixicode.dev.
Last updated: