Privacy policy

Data controller

[TO COMPLETE: publisher's identity, see the legal notice]. Contact about your data: [TO COMPLETE: dedicated email address].

[TO COMPLETE if appointed: data protection officer]

Children first

In France, a child under 15 cannot consent alone to the processing of their data (GDPR, article 8, and French Data Protection Act, article 45). A child profile therefore only exists if a parent creates it and gives consent (recorded with its date).

The child has no email or password: they pick their profile on a device that their parent has switched to child mode, with an optional 4-digit code.

We never ask the child for their surname, photo, date of birth, address or location.

Data collected

Parent: first name, email address, password (stored encrypted, never readable), date the terms were accepted.

Child: nickname, school year, avatar chosen from a list, optional 4-digit code (encrypted), exercise results, facts learned by heart, milestones reached, rewards set by the parent.

Teacher: first name, email address, encrypted password, classes and homework. For children registered by their parents, the teacher only sees the nickname, avatar and exercise results.

Security logs (sign-ins, account creation and deletion): technical identifiers only, with no nickname or content.

Why, and on what basis

Providing the service and tracking progress: performance of the contract with the parent or teacher, and consent of the holder of parental authority for the child.

Securing accounts (attempt limits, logs): legitimate interest.

No data is sold or used for advertising or profiling.

Cookies and storage

Only strictly necessary cookies are used: parent or teacher session, device in child mode, language. They do not require consent. No analytics or advertising cookies.

Focus mode keeps the day's session in the device's browser until it is sent to the server.

The Aces League keeps the chosen sport and country on the child's profile; in demo mode, this choice stays in the device's browser.

Retention

Data is kept as long as the account exists. Parents can reset progress or delete a child's profile, or their own account, at any time: deletion is immediate and permanent.

[TO COMPLETE: retention period for security logs, for example 12 months; deletion of inactive accounts, for example after 3 years without sign-in, with prior notice]

Recipients and hosting

Only the publisher and its technical processors have access: website hosting (Vercel), database (Neon), email delivery [TO COMPLETE: provider]. Data is stored in the European Union; if a processor is based outside the EU, standard contractual clauses govern access. [TO CHECK at deployment]

Your rights

You can access, correct, delete and retrieve your data and your child's, and withdraw your consent at any time: from the parent area or by writing to [TO COMPLETE: email address].

You can also lodge a complaint with the CNIL (www.cnil.fr).