Privacy policy
This document describes what Glou et Glous does with your data. It was written from how the app actually works and has not yet been reviewed by a lawyer.
Who is responsible?
Glou et Glous is published by Thiey Solutions, 1750 Route départementale 6085, 06460 Saint-Vallier-de-Thiey (France). For any question about your data, see the contact below.
What data is stored?
- Your email address (to create and recover your account).
- Your password, if you choose that method: it is stored only in scrambled (hashed) form, never in clear text. If you sign in with Google, we receive your email address confirmed by Google, not your Google password.
- Your team (GlouGlous or GlousGlou), your browser language at sign-up, the account creation date and the date of your last activity.
- Each of your clicks: date and time, team, and a status (pending, validated or rejected) used to limit cheating. Clicks are limited to 1000 per day.
- An internal flag if your account is judged suspicious (for example clicks too regular to be human).
What is it used for?
- Running the game: signing you in, assigning you to a team, counting your clicks and moving the hole in real time.
- Protecting the game against bots and cheating.
- Producing administration statistics (number of sign-ups, clicks per team and per day, ranking of the most active players).
- No advertising, no commercial profiling, no data resale.
Cookies and browser storage
- A session cookie, needed to stay signed in (30 days at most).
- A language cookie (NEXT_LOCALE).
- A small local storage entry so you are not shown the same daily message twice and milestone messages do not repeat.
- If the Cloudflare Turnstile anti-bot check is enabled, it may set its own technical items at sign-up.
- No advertising cookies and no audience trackers.
8:30 pm reminder (optional)
- If you turn the reminder on from your account menu, your browser sends us a technical address for notifications (specific to your device), your time zone and your language. They are used only to send you, around 8:30 pm local time and only if you haven't played yet that day, a short sentence inviting you to come. No advertising.
- You can turn the reminder off at any time from the same menu or from your browser settings. This data is deleted when you turn the reminder off or delete your account.
Reminder emails
- If you have a verified account, have not turned notifications on and have not played for several days, we may send you a short reminder email, at most twice a week. It uses your email address and your language, nothing else.
- Every email contains a one-click link to stop receiving them. The sign-in emails you ask for keep arriving. This data is deleted when you delete your account.
Who receives your data?
- Railway: hosting of the application server (Western Europe region, Amsterdam).
- Neon: database (Central Europe region, Frankfurt).
- Resend: sending of sign-in and confirmation emails.
- Google: only if you choose to sign in with Google.
- Cloudflare: domain name management (DNS), protection of the site (traffic goes through their servers) and anti-bot verification (Turnstile) at sign-up and sign-in. Cloudflare sees visitors' IP addresses. Hosting providers may log IP addresses for technical security reasons.
- Several of these providers are based in the United States: your data may therefore be processed outside the European Union, under the contractual safeguards these providers offer. The application's data is hosted in Europe (Amsterdam and Frankfurt).
For how long?
- Your account data and your clicks are kept as long as your account exists and stays active.
- An account with no activity at all (sign-in or click) for 24 months is deleted automatically, along with its clicks. Sign-in links expire after 15 minutes and sessions after 30 days.
Your rights
- You can ask for access to your data, its correction, its erasure (deletion of your account), restriction of or objection to its processing, and portability.
- Write to the contact address below. You can also contact your data protection authority (in France, the CNIL: cnil.fr).
- There is no account-deletion button in the app yet: deletion is currently done on request by email.
Money and sponsored campaigns
At this stage, Glou et Glous has no real-money transactions and no sponsored campaigns. This policy will be updated before any such change.