Privacy Policy for the game "Hexalinea"

The data controller is Wincea (Vincent Ponsonnet), the publisher of the Game. This policy covers the Game and the pages of wincea.com on which it runs. For any question about your data, write to contact@wincea.com.

Wincea does not collect data that directly identifies you (real name, postal address, precise location). The Game only stores:

• an anonymous player identifier, generated automatically on your first visit;
• the nickname and four-digit tag you choose, or the guest name automatically assigned to you when you first submit a score;
• your scores, the matching season, and the date they were achieved;
• your game progress (the Game's save file), handled as an opaque block of data that we do not inspect;
• your email address, only if you choose to create an account (see section 4).

This processing is based on the performance of the game service (Article 6(1)(b) GDPR): the information is necessary for saving your progress and running the leaderboard. The Game contains no advertising and builds no advertising profile.

The Game and the site set two cookies, both strictly necessary, and no others.

• "wincea_token" — your player identity, set the first time you play. It holds a random token of which only the SHA-256 fingerprint is stored in our database: the token itself never leaves your browser. HttpOnly, Secure, SameSite=Lax, expiring after two years.
• "wincea_oauth_state" — set for the ten minutes a Google sign-in lasts, so that we can check the reply coming back from Google matches the request that left your browser. It is deleted as soon as the sign-in completes.

Both are strictly necessary to the service you asked for (saves, leaderboard, sign-in security) and therefore require no prior consent. Neither the Game nor the site sets any advertising or third-party tracking cookie, and audience measurement runs without cookies (see section 6).

You can play without ever creating an account: your progress is kept against the anonymous identifier in your cookie. Signing in only serves to pick that progress up on another device.

A single method is offered, and it needs no password: Google Sign-In. Google passes us your Google account identifier and your email address. We never receive your password, nor the rest of your profile.

Your email address is used solely to attach your games to your account. It is never used for marketing and never shared with third parties. Creating an account is part of the service you request (Article 6(1)(b) GDPR).

Your progress is stored locally in your browser, then copied to our servers so it can be restored on your other devices or after you change browser. That copy is attached to your anonymous player identifier (or to your account, if you created one). Its contents are opaque to us: we do not inspect them and do not use them for any other purpose. Clearing the site data in your browser removes the local copy; to delete the server-side copy, write to contact@wincea.com.

The site uses Umami to measure traffic (page views, referrer, device type). Umami runs without cookies and without any persistent identifier: the resulting statistics are aggregated and cannot identify you or follow you across sites. This processing relies on our legitimate interest in understanding how the site is used (Article 6(1)(f) GDPR).

We rely on the following processors:

• Railway (Railway Corp., USA): hosting for the site, the Game, and the PostgreSQL database holding nicknames, scores, and saves.
• Google (Google Ireland Ltd / Google LLC): Google Sign-In, if you use it. No other Google service is called: the site's fonts are served from our own servers.
• Umami (Umami Software, Inc., USA): cookie-free audience measurement.

These providers are located, wholly or partly, in the United States. The corresponding transfers are governed by the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), in accordance with Article 46 GDPR.

Your data is kept for as long as your player identifier remains active, and at the latest until you ask us to delete it. Email sign-in tokens expire after thirty minutes. Under the GDPR you have the right to access, rectify, erase, restrict, object to, and port your data. To exercise these rights, write to contact@wincea.com: on request we delete the nickname, scores, progress and, where applicable, the account attached to your identifier. You may also lodge a complaint with your national supervisory authority (in France, the CNIL).

The Game is a tactical puzzle suitable for all ages. Wincea does not target children and does not knowingly collect any personal data from them; beyond the freely chosen nickname and the optional email address, no information is ever requested from the player. We reserve the right to amend this policy to remain compliant with applicable regulations; any change is reflected in the "Last updated" date at the top of this page. For any question, write to contact@wincea.com.