Last updated: 2026-06-11
Data controller: Robin Clerc, operator of pokerpuzzle.online. Contact for any privacy request: dpo@raceroadmap.com (handled within 30 days, Art. 12.3).
| Category | Data | Legal basis |
|---|---|---|
| Account | email (verified), display name, scrypt password hash + salt, hashed TOTP secret + backup codes | Contract (signup → trainer access) |
| Progress | per-puzzle attempts, scores, decision time, chapter unlocks, ELO, streaks | Contract (the trainer needs your progress to function) |
| Diagnostics / telemetry | schema-versioned event names, hashed user id | Consent — opt-in toggle in Settings, off by default; nothing is sent unless you enable it |
| Reminders | push subscription endpoint, locale, hour, time zone | Consent (explicit subscribe + opt-out) |
| Moderation | proposed/disputed/withdrawn puzzles + admin actions | Legitimate interest (content moderation) |
| Audit log | privileged actions (admin login, lockdown, restore) | Legitimate interest (security + integrity) |
| Backups | encrypted nightly archives of the above | Legitimate interest (durability) |
We do not store your IP address in access logs, and we use no advertising or cross-site tracking cookies. Local storage holds your own progress on your device (strictly necessary for the trainer).
An explicit list, updated on every change:
| Recipient | Purpose | Data | Location |
|---|---|---|---|
| OVHcloud | Hosting (app + database) | All of the above | EU (France) |
| Backblaze B2 / Wasabi | Encrypted off-host backups | Encrypted archives | EU region |
| Browser push services (e.g. Google FCM, Mozilla, Apple) | Delivering reminder notifications you opted into | Push endpoint + notification payload | May include the US (e.g. FCM) — applies only if you enable reminders |
| GlitchTip (self-hosted) | Error diagnostics | Stack traces, hashed user id | EU — only if you enable diagnostics |
GET /api/account/export).POST /api/account/restrict); reversible.Account and progress: while your account is active, plus up to 30 days after deletion (backup rotation). Session tokens expire naturally and are never backed up off-host. Full field-by-field retention is documented internally and available on request.
The trainer is not directed to children under 16 and we do not knowingly collect their data; account creation requires a verified email.
Material breaches are assessed and, where required, notified to the supervisory authority within 72 hours (Art. 33) and to affected users when the risk to their rights is high (Art. 34).
We update this notice when our processing changes; the date above reflects the current version.