Privacy policy

whodabest keeps the scores of your game nights. To do that, we need a little data about you. This page explains which data, why, and what you can do with it. Any question: privacy@whodabest.app.

The data we keep

Your account

• your email address and username;
• your password or passkeys, handled by our sign-in service (Keycloak): we never see your password;
• the date you accepted the terms of use;
• your profile picture, if you add one.

Your game activity

• the groups you belong to, your role and the name you use there;
• the recorded matches: game, date, players, scores and results;
• what follows from them: rankings, Elo ratings, seasons, tournaments, statistics and achievements;
• the match photos you add.

Notifications

• the app's notifications and your settings;
• if you allow push notifications: an identifier of your device, its platform (iOS or Android) and its language.

The Premium subscription

• the state of a subscription bought in the App Store (Apple) or Google Play, which we receive through RevenueCat, our subscription management provider: product, start and end dates. Payment happens at Apple or Google: we never have access to your bank details.

What we don't keep

• the answers to the app's welcome questionnaire stay on your phone;
• the website uses no advertising trackers or analytics. It only keeps your preferred language in a cookie.

Why

We don't sell your data and don't use it for advertising.

Who sees what

• Members of your groups see your username, picture, matches, results and statistics in those groups.
• Our providers, only for what they need:
  • Apple and Google (buying the subscription in their stores);
  • RevenueCat (tracking subscriptions bought in the stores);
  • Google Firebase Cloud Messaging (push notifications);
  • Mailjet (account emails);
  • Vercel (website hosting);
  • the host of our servers (app, database and photos).

Some of these providers may process data outside the European Union; they then do so with the safeguards provided by the GDPR (standard contractual clauses).

How long

As long as your account exists. When you ask to delete it, you have 30 days to change your mind (just sign in again and cancel), then it is erased:

• your account, email, picture, match photos, notifications, devices and achievements are deleted;
• in your groups, your matches stay so that the other players' rankings stay fair, but they are credited to an anonymous "Ancien joueur" (former player);
• the groups you owned go to another member, or are deleted if you were alone in them.

Apple and Google keep billing data for as long as the law requires. The purchase history kept by RevenueCat is deleted with your account.

Your rights

• Access and portability: download all your data from the app (Profile › Account › Download my data).
• Rectification: change your username and picture in the app.
• Erasure: delete your account from the app (Profile › Account › Delete my account), or write to us.
• Objection and restriction: write to privacy@whodabest.app.
• Complaint: you can contact your data protection authority (in France, the CNIL: www.cnil.fr).

Minimum age

whodabest is open from 15 years old. Below that age, a parent's consent is needed.

Security

Traffic with the app is encrypted, passwords are handled by our sign-in service and never stored in plain text, and photos are private: only the group's members can see them, through temporary links.

Changes

If this policy changes in an important way, we'll tell you in the app.