This policy describes the personal data processed by Ludodrop and how it is protected.

Personal data collected on Ludodrop is processed by: Thomas Deleflie (hereinafter “the Publisher”).

Contact: through the contact form.

Depending on how you use the site, the following data may be collected:

The data is used to:

• allow user accounts to be created and managed,
• run the game (collection, market, leaderboard, duels),
• ensure the site works properly and securely (preventing abuse),
• answer requests sent through the contact form.

Only with your consent, Ludodrop measures its audience (Google Analytics) to understand how the site is used and improve it. Ludodrop shows no advertising.

To improve the site, Ludodrop also measures the speed of its pages: display time, page concerned, screen type, site opened in the browser or installed app. These figures are aggregated, with no cookie, no identifier and no link to your account.

Processing is based on:

• performance of the contract: running the user account and the game,
• legitimate interest: security and improvement of the service.
• consent: audience measurement (Google Analytics), which can be withdrawn at any time.

• Account and game data: kept for as long as the account exists.
• Profile picture: kept until it is replaced or deleted by the user, or the account is deleted.
• Contact data: for as long as needed to handle the request.
• Technical security data: IP addresses are used for anti-abuse limits in encrypted form (hash), for a limited period proportionate to security needs. A non-reversible hash of the sign-up IP and of the last login is kept with the account, for as long as it exists, to detect multiple accounts (legitimate interest: fairness of the game and of the economy between players).
• Speed measurements: aggregated, anonymous figures, kept 30 days.
• Visit statistics: kept for at most 14 months in Google Analytics, then deleted.

The username and profile picture are visible to other players (leaderboard, market) and may constitute personal data when a person is identifiable.

Users remain responsible for the content they publish. They can edit or delete it at any time from their profile.

The data is accessible only:

• to the site's Publisher and authorized persons involved in administering and managing the service, within the limits of their respective duties,
• to the technical providers needed to run the service (hosting, infrastructure, sending emails).

The site is hosted on an OVHcloud VPS. The main application data remains stored in MongoDB Atlas, according to the region and security settings configured for the service. The data is never sold.

If you accept audience measurement, visit statistics are processed by Google Ireland Limited (Google Analytics). Data may be transferred to the United States, under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses. Ludodrop never shares this data with Google for advertising purposes.

Reasonable technical and organizational measures are in place to protect personal data (encrypted passwords, secure connections, anti-abuse limits).

Since no Internet transmission can guarantee absolute security, total protection cannot be ensured.

In the event of a data breach posing a risk to users, they will be informed in accordance with the GDPR.

Under the GDPR, you have the following rights:

• access to your data,
• rectification,
• erasure,
• restriction of processing,
• objection,
• portability.

You can download all your data (JSON file) and delete your account at any time from the Security tab of your profile, and exercise your other rights through the contact form. You will receive an answer within one month at most, in accordance with applicable regulations.

You also have the right to lodge a complaint with the CNIL, the French data protection authority: https://www.cnil.fr

This policy may be changed at any time to reflect changes to the site or to regulations.