Privacy Policy

1. Data controller

The data controller for your personal data is:

Louis BERTRAND, sole trader (micro-entrepreneur) 36 rue Jean Jaurès, 91330 Yerres, France Email: louis.bertrand@magic-cards.fr

For any question about your data or to exercise your rights: contact@magic-cards.fr.

2. Data collected

Account data: email address, display name and profile picture, provided by Google (Google sign-in) or by our identity provider MySSO (SSO sign-in). You can change your name and picture at any time in Settings.

Content you create: decks, cards (front, back, description, uploaded images), shared decks, decks submitted to the public library.

Learning and game data: review history (dates, results, Leitner box of each card), day streaks, daily goals, achievements, tokens, scores (leaderboard, daily quiz, events, duels, MagicTrivial), your friends and pending friend requests, friend streaks.

Activity log: timestamped actions in the app (sign-in, deck creation, AI generation, import, sharing…), used for security, abuse detection and aggregated statistics.

Payment data: payments are processed exclusively by Stripe. We never see or store your card number. We only keep your Stripe customer and subscription identifiers, and your subscription status and renewal date.

Notifications: if you enable them, your browser's push subscription or your phone's notification token.

Emails: your email preference (unsubscribe).

Reports: when you report a bug or a card, the report content, your email, your name and your browser type (user-agent).

Technical data: IP address (used only to rate-limit requests and block abuse, never stored in our database), technical error reports (see section 6).

3. Purposes and legal bases

Performance of the contract (GDPR art. 6.1.b): creating and managing your account, syncing your decks and cards, the review algorithm, progress statistics, the social and game features you use, AI card generation at your request, managing your Pro subscription and token purchases, transactional emails (welcome, failed payment).

Legitimate interest (GDPR art. 6.1.f): service security, abuse and fraud prevention (activity log, rate limiting), technical error monitoring, aggregated usage statistics, weekly recap and service news by email (you can object in one click via the link in every email or in Settings).

Consent (GDPR art. 6.1.a): push notifications (permission requested by your browser or phone, revocable at any time), audience and performance measurement (Vercel Web Analytics and Speed Insights, only if you accept in the cookie banner).

Legal obligation (GDPR art. 6.1.c): keeping invoices and accounting records.

We never sell, rent or share your data for advertising. No decision with legal effects is made solely through automated processing.

4. What other users can see

• Leaderboard, public profile and invitations: your display name, score, streak and profile customisations are visible to signed-in users. Your picture and your decks are only visible to your friends (accepted friend request). • Daily quiz, events, duels and MagicTrivial: your name and score are visible to the other participants. • Shared decks: the content of a deck you share is accessible to anyone with the link, until you delete the share or your account. • Public library: a deck you submit that gets approved becomes a public template, without any mention of your identity (see the Terms for the associated licence).

5. Artificial intelligence (Google Gemini)

When you generate a deck with AI, we send the Google Gemini API the topic or text you entered, along with the list of questions already in your account to avoid duplicates. Gemini is also used to suggest alternative answers for multiple-choice quizzes.

When semantic duplicate detection is enabled, the text of your cards (front and back) is turned into a numeric representation ("embedding") by Gemini and stored next to your cards, never exposed to other users. These representations are deleted together with the matching cards.

Your email, name and identifiers are never sent to Gemini. Avoid entering sensitive personal information in your cards and generation topics.

6. Cookies, local storage and trackers

Strictly necessary (no consent required, ePrivacy directive art. 5.3): • Session: authentication tokens and profile information kept in your browser's local storage (localStorage) and IndexedDB, to keep you signed in. • Offline cache: a local copy of your decks and cards and pending answers, for fast and offline access. • Preferences: theme, language, filters, your cookie choice. • Stripe: technical cookies set by Stripe on its checkout page, required to secure transactions.

Subject to your consent: • Vercel Web Analytics and Speed Insights: anonymised audience and performance measurement (page views, loading metrics), cookie-free. Nothing is sent until you click "Accept".

Your choice (accept or decline) is kept for 6 months, after which the banner is shown again. You can change it at any time in Settings > Notifications & Privacy.

Error monitoring (legitimate interest): when a technical error occurs, a report is sent to Sentry (error message, page without its parameters, browser, internal account identifier). We have disabled sending IP addresses, cookies, headers and request bodies. Sentry sets no cookies.

7. Recipients and processors

Your data is only accessible to the publisher and, within the scope of their tasks, to the following processors, bound by a data processing agreement (GDPR art. 28):

• Google Cloud / Firebase (Google LLC / Google Ireland): database, authentication, image storage. Data hosted in the European Union (europe-west1 region). • Google Gemini (Google LLC): AI content generation (see section 5). • Vercel Inc.: application hosting, configuration, audience and performance measurement (with consent). • Stripe (Stripe Payments Europe Ltd / Stripe Inc.): payments and subscriptions. • Resend (Resend Inc.): email delivery. • Sentry (Functional Software Inc.): technical error monitoring. • Upstash Inc.: request rate limiting (IP address or account identifier, kept for the duration of the limiting window, 24 hours at most). • Expo (650 Industries Inc.), Apple and Google: delivery of mobile push notifications; your browser's push service on the web.

Support: to answer a support request, an administrator may view your account in read-only mode. This access allows no modification or export, and every access is logged.

We may also disclose your data to the authorities where required by law.

8. Transfers outside the European Union

Some processors (Google, Vercel, Stripe, Resend, Sentry, Upstash, Expo) are based in the United States or may process data there. These transfers are covered by the EU–US Data Privacy Framework (adequacy decision of 10 July 2023) for certified companies and, otherwise, by the European Commission's standard contractual clauses.

9. Retention periods

• Account and content: as long as your account is active. • Account deletion: immediate and permanent as soon as you request it (Settings > Danger zone). It erases your sign-in account, profile, decks, cards, images, history, notifications, shares, friends and friend requests, reports and activity log, and deletes your Stripe customer. In past multiplayer games, your name is replaced with "Utilisateur supprimé" (deleted user) to preserve the other players' history. Images used by an approved public template are kept with that template. • Activity log and notification history: 90 days. • Bug reports and the log of administrative actions: 12 months. • Error reports (Sentry): according to our Sentry plan's retention, 90 days at most. • Cookie choice: 6 months. • Invoices and accounting records: 10 years (French Commercial Code, article L123-22), kept by Stripe.

10. Your rights

Under the GDPR and the French Data Protection Act, you have the following rights:

• Access and portability: download all your data as JSON at any time from Settings > "Download my data". • Rectification: edit your name and picture in Settings, or write to us. • Erasure: delete your account from Settings > Danger zone. Deletion is immediate. • Objection: to processing based on legitimate interest, in particular emails (unsubscribe link in every email, or Settings). • Restriction of processing. • Withdrawal of consent: push notifications (Settings or your device settings), audience measurement (Settings > Analytics cookies), at any time and without affecting the lawfulness of prior processing. • Post-mortem instructions: you can set instructions regarding what happens to your data after your death.

For any request: contact@magic-cards.fr. We reply within one month. We may ask you to confirm your identity.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL (cnil.fr) or with your local data protection authority.

11. Minors

MagicCards is open to people aged 15 and over. Below that age, signing up requires the consent of a holder of parental authority (article 45 of the French Data Protection Act). If you believe a child under 15 has given us data without such consent, contact us to have it deleted.

12. Security

• Encrypted communications (HTTPS/TLS) and strict security headers (HSTS, content security policy). • Firestore and Storage access rules: each user can only access their own data; sensitive data (subscription, scores, quiz answers) can only be changed by our servers. • Delegated authentication (Google or MySSO via OpenID Connect/PKCE): MagicCards stores no passwords. • Rate limiting on sensitive operations, role-based and logged administrator access.

In the event of a data breach that puts your rights at risk, we will notify the CNIL within 72 hours and inform you if the risk is high.

13. Changes

This policy may be updated to reflect legal or technical changes. In the event of a substantial change affecting your rights, we will let you know by email or in the app before it takes effect. The last update date is shown at the top of this document.