SC Compagnon

Privacy policy — website

SC Compagnon — Optional web account — Version 2026-10-11

Scope and controller

This policy covers sctmg-iacompagnon.com and .net and their optional web account. The iOS and Android apps remain offline and do not connect to Supabase. Their separate on-device privacy policy applies.

The controller is Olivier Saleur, micro-entrepreneur, 15 rue des Îles, 60340 Saint-Leu-d'Esserent, France (SIRET 106 671 837 00016). Contact: support@sctmg-iacompagnon.com — +33 9 72 16 41 97.

Playing without an account

An account is optional. Games, dice, game logs, settings and imported game data remain on your device, in browser storage. No ongoing game is uploaded. Clearing site data can permanently remove local saves; export important files first. The website adds no advertising or audience-measurement SDK. The hosting service still handles the technical connection data needed to serve the website.

Account data and purposes

We process your email address, a random account identifier, account creation and verification information, language preference and authentication/session information to provide and secure the account you request. Login codes expire after ten minutes. Without an email address we cannot provide a web account, but you can still play locally.

When you choose to save or import them, we store eligible personal army and map compositions and cumulative match statistics. The counters describe results, factions and opponent difficulty, including difficulty-by-faction results where available. Random source identifiers, revisions and update dates prevent duplicate imports; source identifiers are generated by the app, not hardware or advertising identifiers. Crossed counters cover only games recorded since that feature was introduced. Older results are not inferred.

You can add an optional display name with a unique server-assigned suffix and preferences for future profile visibility. Today your profile, statistics and insignia are private. Insignia are computed from your declared results; they do not certify competitive performance. Earned insignia remain when a statistics source is removed. The First hour insignia is reserved for accounts created within six months after the public launch.

These account, storage, import/export and personal insignia features rely on performance of the service contract you request (GDPR Article 6(1)(b)). Clicking to accept the terms does not constitute consent to advertising or email-open tracking. There is no public directory, public profile or leaderboard in this version, and no automated decision producing legal or similarly significant effects.

Mission details, player names recorded in games, game logs, full game states, rules, card images and Command Center content are excluded from account uploads. Avoid adding personal or confidential information to names of armies, maps or your display name.

Connection metadata, including IP addresses, event times and technical logs, is also processed to operate, diagnose and protect the service against abuse. We rely on our legitimate interests in security and reliable delivery for those purposes (Article 6(1)(f)). Support requests are processed to answer you and exercise your rights; handling statutory rights requests also fulfils our legal obligations (Article 6(1)(c)).

Recipients and international transfers

Access to application records is restricted to your authenticated account by database controls. The operator may access data where needed for support, security or legal duties. We do not sell your personal data.

  • Supabase provides authentication and the account database. The SC Compagnon project's primary database and Auth service are hosted in Ireland (eu-west-1). Supabase's data processing addendum covers processing on our behalf and includes standard contractual clauses for relevant international transfers. Its subprocessor list identifies additional providers.
  • Brevo (Sendinblue) delivers requested login and account-deletion verification codes. It receives the destination email address, sender, subject, temporary code, message language and delivery metadata. It receives no armies, maps, statistics or insignia. No marketing contact-list synchronization is implemented. Brevo identifies hosting in France, Germany and Belgium; its contractual DPA, Appendix 3 also covers support/subprocessor access outside the EEA and the applicable transfer safeguards.
  • Cloudflare Turnstile (Cloudflare, Inc., United States) protects code requests against automated abuse, such as mass requests that would block code delivery for everyone. The check is loaded only on the account screen, when you request a code to sign in, receive a new code or delete your account; other pages do not load it. According to Cloudflare's Turnstile privacy addendum, it processes signals such as your IP address, TLS fingerprint, User-Agent header, and the site key with its origin, to tell people from bots; the addendum states that the purpose is not to identify, profile or target individuals. Cloudflare acts as our processor to provide the check, and as an independent controller when it uses these signals to improve its bot detection. The addendum states no retention period. Our legal basis is our legitimate interest in securing the account service (Article 6(1)(f)); without this check, no code can be sent. Cloudflare's privacy policy relies on the EU-U.S. Data Privacy Framework for transfers from the EEA and, for other transfers or as a fallback, on standard contractual clauses.
  • GitHub Pages serves the static website and processes technical access data such as IP addresses. Its privacy statement explains international processing and safeguards.

EU hosting of the primary database does not mean every technical, support or security operation takes place in the EU. You can ask the controller for information about the applicable transfer safeguards and a copy where appropriate.

Login emails and opening measurements

Only requested authentication emails are sent. Our templates contain no external image or link, but Brevo can add email-tracking technology. Per-contact consent management is enabled and tracking for unknown consent is set to No. Nevertheless, a test email generated an opening event marked as anonymized, alongside identified send/delivery events. We therefore do not claim that these messages contain no tracking or that no opening data is collected.

Brevo presents these measurements as serving delivery and service operation. SC Compagnon makes no use of open data: not for advertising, player profiling, insignia or rankings. An anonymized report alone does not prove that the initial collection is anonymous or exempt from consent. In October 2026 we therefore asked Brevo to switch this tracking off entirely for our emails and to confirm it in writing; this policy will be updated once Brevo replies. If the tracking cannot be switched off, we will consider another email provider.

You may object to processing based on legitimate interests by contacting the controller. Blocking remote images in your email client can limit pixels; you can still type the code manually. This technical option does not replace your privacy rights.

Retention and deletion

  • Account and application records: kept while the account exists, unless you remove individual records earlier. Permanent account deletion requires a new email code verified within the last five minutes. It removes the account, active sessions, profile/preferences, stored statistics, armies, maps and earned insignia from the active database. Access to application records also requires an existing account and session, so a previously issued token alone is insufficient after deletion.
  • Browser data and exported files: kept until you clear or delete them. Deleting an online account does not erase device copies, downloads or files sent to other people. Browser sessions are removed when you sign out locally; copies of local game data remain.
  • Supabase technical logs: the current Free plan advertises a one-day API/database log window and a one-hour Auth audit-log window. The optional copy of Auth audit logs in the project database is disabled. These plan windows are not a promise that every internal provider security record is erased on the same schedule.
  • Brevo transactional logs: configured for one month, with processing of automatic deletion taking up to a further 24 hours. Email preview storage is disabled for new messages. Sending necessarily processes the code; disabling previews does not remove your received email or its mailbox copies. Account deletion does not itself call Brevo to erase delivery logs. Any suppression entry needed to prevent unwanted or undeliverable mail is handled separately, while that prevention remains necessary; it is reviewed when a rights request is handled.
  • Recovery copies and internal provider records: the current Supabase Free plan does not include project backups accessible to us; no additional operator cloud backup has been configured for these accounts. This does not prove that providers hold no internal recovery copies. Published provider documents do not establish an exact deadline for all such copies following deletion of a single SC Compagnon account. We do not promise immediate erasure of them. Specific residual retention and erasure requests can be addressed to the controller and relayed to the provider.
  • Support and rights correspondence: retained for the time needed to resolve the request and necessary follow-up. At closure we review whether continued retention is justified; unnecessary attachments and extracts are deleted. If a legal duty or dispute requires restricted retention, only the necessary information is retained for that duty or dispute, and the reason and applicable duration or criteria are explained on request.

Browser storage and file sharing

Browser storage keeps local games, settings and the authenticated session needed for the requested service. It is not used by SC Compagnon for advertising. Sign out on shared devices, and remove local files or site data if necessary after keeping the exports you need.

Sharing is an explicit JSON export, not public publication. Recipients can retain copies. Review a file before sending it. An account export contains your email and private profile information; share individual army or map exports when you only intend to share those creations.

Your rights

Your space lets you export stored application data in JSON: profile, preferences, armies, maps, statistics and insignia. This file does not include every authentication or provider security log. You can request those additional personal data, where applicable, through the contact above. Access rights do not require disclosure of passwords, active codes or session secrets.

You may request access, rectification, erasure, restriction or portability where applicable, and object to processing based on legitimate interests. We use proportionate identity checks, normally your authenticated account or verified email, rather than routinely asking for identity documents. We respond without undue delay, normally within one month; a lawful extension for a complex or numerous request is explained within that first month. You may complain to the CNIL or your competent supervisory authority.

The service is not directed at children. Contact the controller if you believe a child has provided personal data.

Changes

We update the version and explain material changes before they apply. Public community features or connecting iOS/Android to Supabase would require a separate release and updated privacy information; neither is enabled here.