Privacy Policy

Version 1

1. Data controller

The publisher of 2-12-10. For any question about your data: hello@2-12-10.com.

2. Data we collect

• Profile: nickname, color, avatar (optional), language, notification preferences, date and version of the Terms of Use you accepted.
• Email (optional): only to recover your account, with a link or a 6-digit code sent to that address.
• Game content: photos played, clues, votes, points and statistics, groups joined.
• Notifications: tokens provided by Apple or Google to send you notifications, and device type (iOS or Android).
• Security: IP address, used to limit abuse (repeated attempts, mass sending).
• Reports: reported content, reason and comment, author of the report, moderation decision.
• App error reports: when the app hits an error, the technical description of the error, the last actions before it (screens visited and buttons tapped, without their content), the screen concerned, the app version, the device and system type, and the phone’s language and time zone. These reports contain neither your identifier, nickname, email, IP address nor photos; codes, tokens and secret links are masked.
• Server error reports: when the server hits an error, the technical description of the error, the address called (without its parameters or secret codes and links), the last technical operations before it (database queries without their values, technical messages without their context) and the server version. These reports contain neither your identifier, your IP address nor the content of your requests (text, photos, email).

Photos are chosen in your phone’s photo picker: the app only accesses the photos you select, never your whole library, and does not use the camera. They are re-encoded on our servers, and their metadata (EXIF, including GPS location) is removed.

Our web pages (invitations, Terms of Use, this page) set no cookies and use no analytics or tracking tools.

3. Purposes and legal bases

• running the game (account, groups, rounds, votes, ranking, history) and sending you the round notifications you turned on: performance of a contract (the Terms of Use you accept);
• letting you recover your account by email: performance of a contract, at your request, if you add an address;
• limiting repeated attempts, moderating reported content and suspending accounts that break the rules: legitimate interest in keeping the service secure, preventing abuse, protecting players and enforcing the rules of the service.
• detecting and fixing app and server errors: legitimate interest in keeping the service working and stable.

Right to object: you can object at any time, on grounds relating to your particular situation, to processing based on legitimate interest, by writing to hello@2-12-10.com. We will then stop that processing, unless there are compelling legitimate grounds (for example, handling a pending report).

No advertising, no ad profiling, no sale of data.

4. Who sees your content

Your photos, clues and votes are only visible to members of the groups where they are played, and only when the game rules allow it: the storyteller and the author of each photo stay secret until the results. Photos are served through temporary links that expire after a few minutes.

The moderation team can view reported content, in a tool with secured access. It is alerted to each new report by an email that only gives its type and reason: not the reported content, the comment or the nicknames involved.

If a moderation measure concerns you (photo or clue removed, group name replaced, profile reset, account suspended), you are informed by email if your address is confirmed, otherwise by notification, with its reason. This message only names the item concerned (for example “your photo from October 12”), without the reported content or the author of the report.

The content of the notifications you turn on (group name, a new member’s nickname, and the owner’s nickname when a group is deleted) is sent to Apple’s notification service (APNs) or Google’s (Firebase Cloud Messaging) so it can be delivered to your device. These services may temporarily keep an undelivered notification so it can be delivered.

5. Processors and transfers

• API and database hosting: Laravel Cloud (Laravel Holdings Inc., United States), EU Central region (Frankfurt, Germany). Laravel is certified under the EU–US Data Privacy Framework.
• Photo storage: Cloudflare R2 (Cloudflare, Inc., United States), in a storage space restricted to the European Union: photos are stored in the European Union. Cloudflare is certified under the Data Privacy Framework and also applies the European Commission’s standard contractual clauses.
• Email delivery (sign-in and verification codes and links, report alerts to moderators, moderation notices): Resend (Resend, Inc., United States), certified under the Data Privacy Framework; its data processing agreement also provides for the standard contractual clauses.
• Notifications: Google Firebase Cloud Messaging (Google LLC, United States), certified under the Data Privacy Framework. Google may process this data in any country where it or its subprocessors have facilities.
• Notifications on iPhone: Apple Push Notification service (Apple), under the terms Apple applies to app developers.
• App and server error monitoring: Sentry (Functional Software, Inc., United States), in its European Union region: error reports are stored in the European Union. Sentry applies the European Commission’s standard contractual clauses.

6. Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration or disclosure, including encrypted communications, access control and temporary links for photos.

7. Retention periods

• Inactive account: an account you have not used for one year is automatically deleted, along with its data, as described in the “Deleting your account” section;
• Account without a group: an account that belongs to no group for one month (since it was created or since it left its last group) is automatically deleted, along with its data, in the same way;
• Profile and email address: as long as your account exists;
• Game content: according to the retention rules for groups and rounds described below. A photo uploaded but never played is deleted after 24 hours;
• A group’s rounds (clues, photos, votes, points): as long as the group exists. If you leave or are removed from a group, all the photos you played in it are deleted, including the one in the current round: they disappear from the group’s history. Your clues, votes and points remain;
• Sign-in codes and links: 15 minutes. App session: expires after one year without use;
• Notifications: notification tokens are kept as long as your account exists and the token remains valid. A token that Apple or Google reports as invalid is deleted. Turning notifications off in the app stops sending, without deleting the token, so they can be turned back on later. The notifications themselves may be kept temporarily by Apple or Google to allow delivery, according to their own retention mechanisms;
• IP address: anti-abuse counters of one hour at most. Host’s technical logs: 7 days;
• Reports: deleted one year after they are handled;
• App and server error reports: 90 days at most at Sentry.

8. Deleting your account

You can delete your account at any time from the app (Profile) or from the Delete my account page, once you have handed your groups over to other players. An account left unused for one year, or that belongs to no group for one month, is also deleted automatically, in the same way. Your avatar, photos, email and notification tokens are erased; your photos also disappear from the groups’ history. Your nickname disappears: in other players’ history, you appear as “Deleted player”. Your points remain in the groups’ ranking and statistics, attached to “Deleted player” instead of your nickname.

9. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data. To exercise them: hello@2-12-10.com. You may also lodge a complaint with your data protection authority (in France, the CNIL: cnil.fr).

10. Minimum age

2-12-10 is intended for people aged 13 or over.

11. Changes

If this policy changes significantly, the app asks you to accept it again before you keep playing. The current version is shown at the top of this page.