Privacy policy

1. Data controller

Théo Dubuisson EI, 22 RUE Alsace Lorraine 76140 Le Petit-Quevilly FRANCE. Contact: [email protected].

2. Data collected

Account: email address, username, password (stored only in irreversibly hashed form), creation date. If you sign in with Google or Discord: your account identifier with that service, and the name, email address and profile picture it sends us.

Security: the IP address and browser type associated with each sign-in session.

Game: your game region, packs opened, cards and hypeCoin movements (and later your auctions and trades).

Premium: your subscription status and dates and your Stripe customer identifier. Your payment data (card, billing address) is processed directly by Stripe: Vidcollectors never sees or stores it.

3. Why, and on what legal basis

Running your account and the game, and sending you necessary emails (address confirmation, password reset): performance of the terms of use.

Managing your Premium subscription: performance of the sales contract. Keeping invoices: legal obligation.

Protecting the service and fighting cheating (multiple accounts, manipulation of rarities or prices): legitimate interest.

Your data is not used for advertising or ad profiling, and is never sold.

4. YouTube API Services

Vidcollectors uses YouTube API Services to display public information about videos (title, thumbnail, duration, view count, channel). The Google Privacy Policy applies to these services: https://policies.google.com/privacy

Vidcollectors does not access any data from your YouTube account. Signing in with Google is only used to identify you (name, email address). You can revoke Vidcollectors' access to your Google account at any time: https://myaccount.google.com/permissions

5. Cookies and local storage

Vidcollectors only uses cookies needed for the service: the session cookie that keeps you signed in, temporary cookies for Google or Discord sign-in, and a security cookie that helps detect multiple accounts. No advertising or analytics cookies, so no consent is requested.

Your browser also stores your sound preference (on or off) locally. It is not sent to us.

6. Who processes your data

Our providers, only to run the service: Neon (database, hosted in the European Union, Frankfurt), Railway (site hosting), Scaleway (sending emails, hosted in France), Stripe (Premium payments), Sentry (technical error reports, hosted in the European Union), Cloudflare (domain name and email routing), and Google or Discord if you use them to sign in.

Some of these providers are based in the United States. Transfers are covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

7. Retention periods

Account and game data: as long as your account exists. An account with no sign-in for 3 years is deleted, after a warning email. An account whose address was never confirmed is deleted after 30 days.

Premium invoices and accounting records: 10 years, as required by law.

Sessions (IP address, browser): deleted when the session expires, that is after 7 days without a visit, or as soon as you sign out.

After an account is deleted, the cards it owned are removed and records of its trades with other players are anonymised.

8. Your rights

You can access, correct and erase your data, request a copy in a reusable format, object to processing or request its restriction. Email [email protected]: we reply within one month.

You can also lodge a complaint with your data protection authority (in France, the CNIL: https://www.cnil.fr).

9. Security

Encrypted connections (HTTPS), irreversibly hashed passwords, encrypted and verified connection to the database, data access limited to the publisher.

10. Changes

This policy may change. The update date is shown at the top of the page; for significant changes, you will be notified by email or on the site.