Privacy Policy for the game "Hexalinea"

The data controller is Wincea (Vincent Ponsonnet), the publisher of the Game. This policy covers the Game and the pages of wincea.com on which it runs. For any question about your data, write to contact@wincea.com.

The leaderboard database stores only:

• a random player identifier, represented in the database by the SHA-256 fingerprint of the token sent by the browser;
• the public nickname you choose, or the pre-filled random guest name;
• the score, season, game, and submission date.

It does not store your real name, postal address, email address, precise location, or game save. Guest and chosen nicknames are not necessarily unique; the anonymous identifier separates scores submitted from the same browser. Processing the identifier, nickname, and score is necessary to provide the optional leaderboard you request (Article 6(1)(b) GDPR). Moderation and anti-cheat rely on Wincea’s legitimate interest in protecting the service and its users (Article 6(1)(f) GDPR). No advertising profile is created.

When the leaderboard is used, the site sets one cookie that is necessary to provide it: "wincea_token". It contains a random token which is sent to Wincea with leaderboard requests; only its SHA-256 fingerprint is stored in the database. The cookie is HttpOnly, Secure, SameSite=Lax and expires after two years. It is used solely to associate scores submitted from the same browser. The Game and site set no advertising cookies. Umami audience measurement uses no cookie (see section 6).

Wincea offers no player account, sign-in method, password, or cross-device synchronization. No Google identity or email address is requested or stored. Saving a score to the leaderboard remains optional.

The current run and game settings are stored only in the browser’s session storage so that reloading the page does not lose them. They are never copied to Wincea servers. The browser clears them when the tab or browser session ends. A different browser or device cannot restore them.

The site uses Umami Cloud to measure page views, referrer, country, browser, operating system, device type, and screen size. Umami does not set a cookie. According to the provider, the IP address is used for approximate geolocation but is not stored. A session identifier is derived from a hash of the IP address, browser information, and website identifier with a rotating salt; it is not used to identify you or follow you across websites. This processing relies on Wincea’s legitimate interest in measuring and improving the site (Article 6(1)(f) GDPR).

We rely on the following processors:

• Railway (Railway Corp., USA): hosting for the site, the Game, and the PostgreSQL database holding anonymous identifier fingerprints, nicknames, and scores.
• Umami (Umami Software, Inc., USA): cookie-free audience measurement described in section 6.

These companies are established in the United States and may process data there. Transfers outside the European Economic Area are governed by the safeguards provided by the processors, including the European Commission’s Standard Contractual Clauses where applicable.

The "wincea_token" cookie expires after two years. Browser session data is erased when the tab or session ends. Leaderboard identifiers, nicknames, and scores are kept while the relevant current or archived leaderboard remains published, unless deletion is requested earlier. Audience measurement data is retained according to the settings and retention rules of Umami Cloud.

Under the GDPR you have rights of access, rectification, erasure, restriction, objection, and, where applicable, portability. Write to contact@wincea.com to exercise them. We may ask for the nickname, approximate score, and submission date needed to locate the entry and verify the request, without requesting disproportionate information. You may also lodge a complaint with your supervisory authority, including the CNIL in France.

The Game is a tactical puzzle suitable for all ages. Wincea does not target children and does not knowingly request directly identifying information from them. The only information entered by a player is the optional public nickname used when a score is saved; players should not put personal information in it. We may amend this policy when the service or applicable rules change; the date above identifies the current version. For questions, write to contact@wincea.com.