Privacy policy

In short

Kolapic doesn't ask for your name, your email or a password. Your account is a random nickname, your games and your statistics, tied to your browser by a sign-in cookie.

Your images are analyzed by OpenAI, then Kolapic only keeps their score. No ads, no data sold, and visits are only counted anonymously, without cookies.

If you leave a tip, you pay it on Stripe's page, which receives your email and your card. This payment isn't tied to your game account.

Data controller

Jonathan Prévost, publisher of Kolapic (see the legal notice), reachable at kolapic.outplayed119@passmail.net.

The data processed

Your account: the random nickname, the language of the interface, the creation date, your statistics (games played, concepts found, streaks) and the fingerprint of your sign-in token, never the token itself.

Your games: for each image, its number, its score and its date; for each answer typed, its text, its level and its date; the number of images and answers used each day.

Your images: your browser shrinks and re-encodes them, which erases their metadata (including the GPS location), then they are sent to OpenAI to be analyzed. Kolapic doesn't keep them: the thumbnails you see stay in your browser. Avoid sending photos where someone recognizable hasn't agreed.

Your IP address: Cloudflare receives it to route each request and for the bot check. Kolapic doesn't record it.

Your tip, if you leave one: you pay it on Stripe's page, which receives your email, your card and your country. Kolapic never sees your full card number: Stripe shows it the amount, the date, your email, the cardholder's name and the last digits of the card. The payment is tied neither to your nickname nor to your game account.

Why

To run the game you asked for: your account, your games, your statistics. This is the performance of the service (Article 6(1)(b) of the GDPR). Without it, you can't play.

To protect the game from bots and abuse, and to limit its cost: bot check, daily quotas, technical logs. This is the legitimate interest of the publisher (Article 6(1)(f) of the GDPR).

To count visits and measure how long pages take to load, anonymously and without cookies, to improve the game. This is the legitimate interest of the publisher (Article 6(1)(f) of the GDPR).

To collect your tip, at your request (Article 6(1)(b) of the GDPR), and to keep the accounting record of payments, as the law requires (Article 6(1)(c) of the GDPR).

Cookie and storage in your browser

Kolapic sets a single cookie: the sign-in cookie, which holds a random token. Essential to the game, it requires no consent. It lasts 400 days and is extended on each visit.

Your browser also keeps the theme you chose and the thumbnails of your images. They never leave your device, and deleting your account erases these thumbnails.

The bot check (Cloudflare Turnstile) runs when you start playing and when you send an image. It receives your IP address and technical signals from your browser (browser used, connection fingerprint) to tell a human from a bot, without any cookie. Cloudflare also uses them to improve its detection, without trying to identify or profile you.

The audience measurement (Cloudflare Web Analytics) counts visits: for each page viewed, your browser sends Cloudflare the address of the page, the one you came from, your browser, your system and load times. It sets no cookie, keeps nothing in your browser and doesn't follow you from one site to another: Kolapic only sees anonymous totals (pages viewed, countries, browsers). Limited in this way, it is exempt from consent under the CNIL's rules. To object, block the address static.cloudflareinsights.com: most ad blockers already do.

The payment page of the tip is on Stripe's site, which sets its own cookies there, in particular to fight fraud. Kolapic sets none for the tip.

Who receives this data

Cloudflare hosts the site and the database, provides the bot check and counts visits.

OpenAI analyzes the images, and the typed answers that aren't in the list of accepted answers. The contract is with OpenAI Ireland Ltd, acting as a processor. OpenAI doesn't use this data to train its models, but may keep it for up to 30 days in its abuse monitoring logs, and longer for an image flagged as illegal, kept for review.

Stripe processes tip payments. The contract is with Stripe Payments Europe, Limited, in Ireland, acting as a processor for the payment, and as a controller for its own obligations (fraud prevention, financial regulation).

This data may be processed in the United States. For Cloudflare, the transfer relies on the Data Privacy Framework and on the standard contractual clauses of the European Commission; for OpenAI, on these standard contractual clauses; for Stripe, on the Data Privacy Framework and these clauses.

• Cloudflare's privacy policy
• Cloudflare Turnstile and privacy
• Data sent to the OpenAI API
• Stripe's privacy policy

How long

Your account and your games are kept as long as you play, or until you delete your account. An account without activity for 400 days is deleted with all its data: this is also the lifetime of the cookie, after which the account can no longer be reached.

Technical logs, which contain neither IP address nor player identifier, are erased by Cloudflare after a few days.

Visit statistics are anonymous totals, without IP address or identifier, which Cloudflare keeps for a few months.

The details of a tip (amount, date, email) are kept for 10 years, the retention period for accounting records.

Your rights

To erase your account, use the “Delete my account” button at the bottom of this page, from the browser you play in. Your nickname, games and statistics are erased right away and for good, along with the sign-in cookie and the thumbnails in this browser. A tip, which isn't linked to your account, stays in the accounting records.

You can ask to access your data, correct it, erase it, restrict its processing or receive a copy, object to its processing, and set instructions for what happens to it after your death, by writing to kolapic.outplayed119@passmail.net. As your account has neither name nor email, give your nickname, shown in the game; for a tip, the email given to Stripe.

If, after making your request, you believe your rights aren't respected, you can lodge a complaint with the CNIL, the French data protection authority.