Privacy policy

1. Data controller

The data controller is Boussard Quentin EI, a sole trader (French micro-entreprise) and publisher of Reliquarium.

• — Address: 3 rue Platon, 75015 Paris, France
• — SIRET: 818 076 580 00039
• — Contact for any question about your data: contact@reliquarium.fr

No data protection officer (DPO) has been appointed, as this is not mandatory for this activity. The contact above handles all requests.

2. In short

• — We only collect what is needed to run the site: your account, your player profile and your activity in events.
• — We never sell, rent or hand over personal data, and we never use it for advertising.
• — The site uses no advertising cookies, no audience measurement tool and no third-party tracker.
• — Payments are handled by Stripe: Reliquarium never sees or stores your banking details.
• — You can request the deletion of your account at any time from your profile settings or by e-mail.

3. Creating an account: sign in with Discord or Google

Reliquarium does not use passwords. You sign in with your Discord account or your Google account; authentication is handled by Supabase Auth, our hosting provider. When you sign in, the chosen provider sends us, with the consent you give on its own screen:

• — a technical identifier specific to your account with that provider;
• — your e-mail address;
• — your public name or username as shown on that account;
• — the address of your profile picture (avatar).

This information is stored in the authentication system (Supabase Auth), together with the account creation and last sign-in dates. Your e-mail address is never displayed on the site: it is only used to identify your account and is only visible to the publisher, in the moderation tool. We do not send you any marketing e-mail.

For a Discord account, your Discord username and avatar are used by default as your display name and profile picture. For a Google account, you choose your own username when you first sign in, so your Google name is not used as your display name. Until a username is set, a neutral name ("Joueur-" followed by four characters) is displayed in its place: neither your Google name nor your e-mail address is ever used as your display name.

4. Use of data obtained from Google

If you sign in with Google, Reliquarium only requests the basic "Sign in with Google" permissions: your Google identifier, your e-mail address, your name and your profile picture. We do not access any other data from your Google account (no Gmail, Drive, Calendar or contacts).

This data is used exclusively to authenticate you, create and secure your account, and display your player profile (profile picture; your Google name is never displayed publicly). It is never sold, rented or shared with third parties (other than the technical providers listed in section 13, which process it on our behalf), and is never used for advertising, profiling or to train artificial intelligence models.

Reliquarium's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Reliquarium's access at any time from the "Security" page of your Google account (third-party connections), and request the deletion of the data already received (see section 17).

5. Player profile and game data

By using the site, you create data linked to your profile and your gaming activity:

• — profile: username, avatar, preferred language, preferred faction, followed or pinned organizations, unlocked and displayed titles, visual customization (color, banner, frame) and, for Légende subscribers, the social media handles you choose to display;
• — narrative campaigns: reported battles (players, armies, side, result, map zone, date, optional notes);
• — tournaments: registration, link to your army list if you provide one, pairings and scores;
• — registrations to events with reserved participation: status of your registration and, where applicable, an internal note from the organizer (not public);
• — friendly match log: matches you report (date, game system, format, armies, scores, notes) and the name or account of your opponent; a match reported against a registered player awaits their confirmation;
• — the Forge: your painting projects, their progress and the photos you add, public or private as you choose;
• — organization creation requests and account deletion requests.

6. Painting contests

When you enter a contest, we store your player name, the name of the miniature, the description and the photos you upload (3 at most), the chosen category and, if the organizer provides for it, a free-text field and jury feedback.

Photos are re-encoded by our server to WebP; the metadata of the original file (EXIF data, including any location of the shot) is not kept. They are stored in Supabase Storage and are publicly accessible through their address once your entry has been approved by the organizer.

Your votes (gold, silver, bronze) are stored with your identifier to guarantee one vote per rank and per category. They are never displayed individually: only aggregated scores and rankings are published.

Photos are kept as long as the event remains published on the site. You can ask for your photos to be deleted at any time at contact@reliquarium.fr.

7. Play contacts (Discord, Steam)

For tournaments played remotely, you can enter your Discord username and your Steam friend code. These contacts are only shared if you have ticked the dedicated consent box (the date of this consent is recorded), and only with your opponent in the current round, so that you can arrange your game. They are never displayed publicly.

You can withdraw your consent at any time from your profile: unticking the box erases your contacts, which immediately stop being shared.

8. Push notifications

If you enable notifications, your browser gives us a technical subscription address (and the associated encryption keys), which we store with the chosen alert types and organizations. Notifications are delivered through your browser's push service (for example Google for Chrome, Mozilla for Firefox, Apple for Safari).

You can disable them at any time from the site or your browser settings; an expired or revoked subscription is deleted automatically.

9. Organizations and organizers

Clubs and associations that organize events have an organization page (name, logo, description, links and social media, contact link) and a list of members with their role (administrator, moderator…).

An organizer can set up a Discord webhook to announce their events on their own Discord server. These announcements only contain event information (title, description, date, visuals), never player data.

For their own events, organizers see the information needed to run them: registrations, reported battles, contest entries awaiting approval, aggregated statistics.

10. Payments and subscriptions

Supporter (organizations) and Légende (players) subscriptions are paid via Stripe. Payment takes place on Stripe's secure page: your banking details are entered and stored by Stripe, never by Reliquarium.

We only keep the Stripe customer and subscription identifiers, the subscription type and its expiry date, in order to enable the matching features. Stripe informs us of the subscription status (creation, renewal, cancellation). Stripe also processes payment data for its own obligations (fraud prevention, legal obligations); see Stripe's privacy policy.

11. Security and abuse prevention

To protect the service, we limit the number of certain requests (player search, votes, registrations, payments…) per IP address or per account. These counters are only kept in memory, for one hour at most, and are never stored in the database.

For narrative campaigns, an internal trust score is computed per organization from the history of its validated battles; it is used to allow or not the automatic validation of some battles. It concerns organizations, is not public and does not lead to any decision producing legal effects concerning you.

The publisher may suspend an account in case of abuse. Like any online service, our server and our providers (Supabase, OVH) record technical logs (IP address, date, requested page) to keep the service secure and running. These logs are kept for 12 months at most, then deleted.

Data is exchanged exclusively over an encrypted connection (HTTPS). Database access is restricted to the site's server; tables cannot be accessed directly from your browser.

12. Purposes and legal bases

• — Managing your account, your profile and your participation in events (campaigns, tournaments, contests, match log, Forge): performance of the service you use (contract, art. 6(1)(b) GDPR).
• — Paid subscriptions and invoicing: performance of the contract (see the Terms of sale) and compliance with our accounting and tax obligations (legal obligation, art. 6(1)(c)).
• — Sharing your play contacts with your tournament opponent and sending push notifications: your consent (art. 6(1)(a)), which you can withdraw at any time.
• — Security, abuse and fraud prevention, request rate limiting, organization trust score: the publisher's legitimate interest in protecting the service and its users (art. 6(1)(f)).
• — Answering your requests and handling your rights: legal obligation and legitimate interest.

13. Recipients and processors

Your data is processed by the publisher and, for the technical needs of the service, by the following providers:

• — Supabase Inc.: database, file storage and authentication. Data hosted in the European Union (AWS region eu-west-1, Ireland).
• — OVH SAS: server hosting the site, France.
• — Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (United States): subscription payments.
• — Discord Inc. (United States) and Google (Google Ireland Ltd. / Google LLC, United States): identity providers at sign-in. Discord and Google avatars are displayed from these providers' servers.
• — Google LLC (Google Fonts): the site's fonts are loaded from Google's servers, which receive your IP address in the process.
• — Browser push services (Google, Mozilla, Apple…): only if you enable push notifications.
• — Discord: account deletion requests are reported to the publisher through a private Discord channel (username and account identifier).

Event organizers access the information described in section 9. Other users see the public information described in section 15. No data is sold or shared for commercial or advertising purposes. Data may finally be disclosed to authorities upon a legal request.

14. Transfers outside the European Union

The database and files are hosted in the European Union. Some providers (Supabase, Stripe, Discord, Google) are companies established in, or using sub-processors in, the United States or other countries outside the EU; data may therefore be accessed from or transferred there. These transfers are governed by the standard contractual clauses adopted by the European Commission and, for certified companies, by the EU–US Data Privacy Framework.

15. What is public, what stays private

Public and visible to everyone, including without an account: your player profile (username, avatar, titles, customization, displayed social media, preferred faction, public Forge projects), your results and battles in events, tournament standings, painting contest galleries and rankings, and the confirmed matches of your friendly match log (without notes; the name of an opponent without an account is hidden).

Private: your e-mail address, your play contacts (shared only with your opponent, with your consent), your individual votes, your match log notes, your private Forge projects, your notification subscriptions, your payment information, organizers' internal notes and contest entries that have not been approved.

Player profiles are not listed in the sitemap sent to search engines, but a public profile page may be indexed if it is reachable through a link.

16. Retention periods

• — Account and profile: as long as your account exists. You can request its deletion at any time from your profile settings.
• — Game data (battles, tournaments, contests, match log, Forge): as long as your account exists; after the account is deleted, only narrative battle and tournament results are kept, in anonymized form (see section 17).
• — Play contacts: until you withdraw your consent (which erases them).
• — Notification subscriptions: until they are disabled or expire.
• — Anti-abuse counters: in memory only, one hour at most.
• — Invoicing data: accounting records are kept for 10 years, as required by law (article L123-22 of the French Commercial Code).
• — Deletion requests: the record of a processed request (identifier, username, date) is kept for 3 years, so that we can show it was handled.

17. Account deletion

You can request the deletion of your account from the "Settings" tab of your profile, or by e-mail at contact@reliquarium.fr. The request is processed within 30 days:

• — deleted: your authentication account (e-mail address, Discord or Google identifier, sessions); your player profile (username, avatar, play contacts, social media handles, preferences, customization, titles); your push notification subscriptions; your Forge projects, their steps and their photos; the games you reported in your friendly match log; your event registrations; your painting contest entries, with their photos and the votes and jury feedback they received; the votes you cast; your organization memberships and your organization creation requests;
• — anonymized: your narrative campaign battles, your tournament registrations and your tournament matches, which are part of other players' history. Your identifier is removed, your name is replaced with "Joueur supprimé" (deleted player) and scores are kept, so as not to distort their results and standings. Likewise, a friendly match reported by another player against you stays in their log, with "Joueur supprimé" as the opponent;
• — painting contests: since your entries and your votes are deleted, a contest's ranking, which is computed from the votes, is recalculated (entries ranked below yours move up, and those you voted for lose the corresponding points);
• — organizations: if you are the only administrator of an organization, it is not deleted, because its events are part of other players' history. We will then ask you to appoint another administrator before the request is processed; otherwise, the organization stays online without an administrator;
• — a record of the request (technical identifier of the deleted account, date and status) is kept, without your username.

An ongoing paid subscription must be cancelled from the Stripe customer portal before deletion (otherwise we cancel it when processing the request). Your customer record and invoices at Stripe are not deleted, due to the legal obligation to keep accounting records stated above; they are no longer linked to any Reliquarium account.

18. Cookies and local storage

Reliquarium sets no advertising or audience measurement cookies and uses no analytics tool (no Google Analytics or equivalent). No consent banner is therefore required. The site only uses your browser's local storage (localStorage), for strictly necessary or convenience items:

• — your sign-in session (Supabase token), required to stay signed in;
• — your display language (i18nextLng);
• — interface preferences: support reminder, onboarding steps of the admin area, event registration pending sign-in;
• — matches saved by the former test version of the friendly match log, for accounts that used it.

The site may also install a service worker (app mode and notifications). You can erase this data at any time from your browser settings; you will then be signed out.

19. Your rights

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights over your data:

• — right of access and to obtain a copy;
• — right to rectification (most profile information can be edited directly on the site);
• — right to erasure;
• — right to restriction of processing;
• — right to data portability (export of your data in a readable format);
• — right to object to processing based on legitimate interest;
• — right to withdraw your consent at any time, without affecting processing already carried out;
• — right to set instructions regarding your data after your death.

To exercise these rights, write to contact@reliquarium.fr from the address linked to your account or stating your username. We reply within one month, which may be extended by two months for complex requests; we may ask for additional information to verify your identity.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (French data protection authority, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr) or with the supervisory authority of your country of residence.

20. Minors

The site is open to players of all ages. In France, a minor can consent alone to the processing of their data from the age of 15; below that age, the agreement of a holder of parental authority is required for processing based on consent (play contacts, notifications). Sign-in providers set their own minimum age (13 for Discord and Google in France, unless stricter local rules apply). Paid subscriptions are reserved for adults or minors authorized by their parents.

A parent or guardian can request the deletion of a minor's account at contact@reliquarium.fr.

21. Changes to this policy

This policy may change, in particular when new features are added. The date of the last update appears at the top of the page. In the event of a significant change, a notice will be displayed on the site.