Privacy Policy

This Privacy Policy is intended to inform users of the Atlas Carta application about how their personal data is collected, used, stored, and protected.

Particular importance is given to the protection of privacy and the processing of personal data in accordance with applicable regulations.

Atlas Carta is the name of the gaming service.

For questions about your personal data or to exercise your rights, use the contact form on the official website.

Depending on how the Application is used, the following data may be collected.

3.1 Account and profile

• Player ID: a technical identifier assigned to each account, which is not secret and does not by itself give access to the account;
• a technical device identifier, created on first launch and kept in the phone's secure storage (Keychain on iOS, Keystore on Android), which links the account to the device;
• Application language, chosen username and selected avatar;
• country, which the user is not asked for: it is determined automatically from the phone's region settings or, failing that, from the connection's IP address (see 3.2);
• where applicable, the identifier of the Apple or Google account associated by the user (only the account identifier provided by Apple or Google is stored).

Age and gender are no longer requested. For older accounts created with the former email sign-up, which no longer exists, the first name, last name, email address, year of birth, gender and password (stored only in secure, hashed form) may still be retained.

3.2 Technical data

• session tokens;
• platform used and Application version;
• push notification token, when the user allows notifications;
• IP address, processed for security, abuse prevention and proper operation of the service;
• when the country cannot be inferred from the phone's settings, the connection's IP address is sent to an external geolocation service (api.country.is), which returns only the country; the IP address is not stored for this purpose;
• advertising identifiers and technical data processed by advertising and audience measurement partners (see section 9);
• data necessary for connection, technical compatibility and protection of the service.

3.3 Game data

• rankings, leagues, seasons, level and progression;
• game statistics for each game;
• match history and associated metadata;
• tournament participation and rewards earned (virtual tokens, medals);
• balance and movements of virtual tokens and bonuses;
• data relating to friends, blocks and reports.

3.4 Purchases

• transaction information (product purchased, amount, date, transaction identifier) provided by Apple's App Store, Google Play or Stripe. The publisher never receives full card numbers.

3.5 Messages, support and account recovery

• free text sent to the team through the Application's "Suggestions" form;
• information provided through the contact form or in support requests;
• account recovery requests: username, first name, last name, approximate age, gender, country, contact email address, games played, approximate number of tokens and level, as well as the user's free-text message;
• transfer and recovery codes, which are single-use and valid for a limited time.

3.6 Security data

• technical logs;
• information related to errors, crashes or incidents;
• reasons for sanctions or bans, where applicable.

Personal data is processed for the following purposes:

• automatically creating, managing and securing accounts and linking them to the device;
• enabling the optional association of an Apple or Google account and the recovery of the account on a new device (transfer code, recovery request);
• providing access to online matches, private tables with friends and tournaments;
• managing matchmaking, rankings, leagues, progression and match history;
• granting and managing virtual tokens, bonuses and rewards;
• processing in-app purchases and payments;
• displaying advertising, including personalized advertising subject to consent where required, and measuring the effectiveness of advertising campaigns;
• sending push notifications, when the user has allowed them;
• adapting the Application to the user's language and country;
• receiving and reviewing players' suggestions;
• ensuring the security of the Application and preventing fraud, abuse and mass account creation;
• providing assistance and responding to support requests;
• sending transactional emails, in particular access recovery codes;
• detecting, logging and fixing technical errors;
• complying with applicable legal and regulatory obligations;
• enabling users to exercise their rights.

Depending on the processing concerned, data is processed on one or more of the following legal bases:

• performance of the service, in particular for account creation, login, account recovery, access to the game, progression, rankings, and management of matches, tournaments, tokens and purchases;
• legitimate interest related to security, fraud prevention, moderation, abuse management, error correction, improvement of the service and the defense of rights;
• compliance with legal obligations when retention is required for accounting, tax, evidentiary or compliance purposes;
• consent, where required by applicable regulations, in particular for personalized advertising, tracking permission on iOS and push notifications.

Some data is necessary for the service to work: the technical device identifier, session tokens, username and game data. Without it, the account cannot be created or used under normal conditions.

Other data is optional, in particular:

• the association of an Apple or Google account;
• permission for push notifications;
• consent to personalized advertising and tracking permission on iOS;
• sending suggestions, a support request or a recovery request.

Declining these optional items does not prevent you from playing, but may limit some features, for example recovering the account on a new device.

Personal data is accessible, within the limits of their respective duties, to:

• persons authorized to operate and administer the service;
• authorized technical providers involved in the operation, security, support or provision of the service;
• the relevant distribution platforms and payment providers (Apple, Google, Stripe) for transactions;
• advertising and audience measurement partners, under the conditions described in section 9;
• competent authorities, where required by law.

Public profile elements, in particular the username, avatar and rankings, are visible to other players.

The Application and the official website rely on third-party providers, each for its own purpose:

• hosting and technical infrastructure for the game servers;
• Google: advertising (Google AdMob and its consent form), Sign in with Google, Google Play and its in-app purchases;
• Apple: Sign in with Apple, the App Store and its in-app purchases;
• Meta (Facebook): software development kit measuring installs and events in the Application, and the Meta Pixel on the website;
• Stripe: card payment processing;
• Resend: emailing a code when the team approves an account recovery request, and forwarding messages submitted through the website contact form;
• api.country.is: country detection from the IP address, when the phone's settings are not sufficient;
• Vercel: hosting of the official website and website audience measurement (Vercel Analytics);
• an internal messaging tool that alerts the team to support and recovery requests;
• tools for detecting and tracking technical errors and for protection against abuse.

Each of these providers processes the data entrusted to it in accordance with its own privacy policy.

The Application displays advertising through Google AdMob (rewarded videos, interstitial ads and other formats). These ads may be personalized, meaning tailored to the user's interests based on advertising identifiers and technical data from the device. Players who have made a purchase are exempted from some ads.

Where required by regulations, a consent form provided by Google is shown before any processing for personalized advertising. If consent is refused, non-personalized ads may still be shown.

The Application also uses Meta's (Facebook) software development kit to measure installs and certain usage events in the Application, in order to evaluate the effectiveness of advertising campaigns. On iOS, tracking permission (App Tracking Transparency) is requested; if it is refused, the device's advertising identifier is not shared.

The official website uses Vercel Analytics to measure its traffic and the Meta Pixel to measure the effectiveness of advertising campaigns.

Your choices: in addition to the consent form and the tracking permission on iOS, you can at any time limit ad tracking or reset your advertising identifier in your device's privacy or advertising settings.

Unless a future change is expressly announced, Atlas Carta does not collect, in the mobile Application:

• precise geolocation: only the country is determined, as described in section 3;
• photos, videos or content from the camera;
• the user's files;
• full card numbers;
• free-text messages between players: in-game communication is limited to predefined quick messages.

The only free text collected is what users themselves send to the team: the "Suggestions" form, account recovery requests and the contact form.

Data is kept for no longer than necessary for the purposes for which it is processed.

For guidance:

• account data is kept for as long as the account exists;
• when account deletion is requested, the account is kept for a 30-day period, during which the request can be canceled, and is then permanently deleted, unless legal or security reasons require otherwise;
• accounts created automatically but never completed (no username) are deleted after 30 days;
• transfer codes expire after 10 minutes and recovery codes after 72 hours;
• account recovery requests are kept for the time needed to process them;
• technical logs, security elements and information necessary for fraud prevention may be kept for a reasonable period necessary for security, incident investigation and the defense of rights;
• transaction-related data may be kept for the period required by legal, accounting or evidentiary obligations;
• support requests and suggestions may be kept for the time needed to process them and then archived if necessary in case of dispute.

Data is hosted on technical infrastructure operated for the service, directly or through authorized technical providers. The official website is hosted by Vercel.

Limited local storage is used on the user's device: the phone's secure storage (Keychain on iOS, Keystore on Android) holds the technical device identifier and session tokens, and other local storage holds preferences and certain technical functions needed for the Application to work properly.

Appropriate technical and organizational measures are implemented to protect personal data against destruction, loss, alteration, unauthorized disclosure, or unlawful access.

These measures include, as applicable:

• the use of secure communications;
• secure storage of certain session elements;
• access protection;
• account verification mechanisms;
• measures to prevent abuse, fraud, and unauthorized access.

However, as no security measure provides an absolute guarantee, the user acknowledges that zero risk does not exist in the transmission or storage of data.

Certain technical service providers or platforms may process data from countries other than the user's country of residence.

Where applicable, appropriate safeguards are implemented in accordance with applicable regulations.

Subject to the conditions set out in applicable regulations, users have, in particular, the following rights:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object, where applicable;
• right to data portability, where applicable;
• right to withdraw consent where processing is based on consent.

Users may exercise their rights through the contact form on the official website, stating their username or Player ID.

Reasonable proof of identity may be requested when necessary to process the request securely.

Users may request the deletion of their account directly from the Application's Settings, or through the contact form on the official website.

The account then enters a 30-day period during which the Application displays "Account deletion in progress"; during this period, the user can cancel the deletion.

At the end of this period, the account data is permanently deleted, except where retention remains necessary:

• to comply with a legal obligation;
• to prevent fraud;
• to establish, exercise or defend legal claims;
• for the security of the platform.

Accounts created automatically but never completed (no username chosen) are deleted after 30 days.

Atlas Carta is not intended for children under 13 years of age.

If an account is created in violation of this rule, appropriate measures may be taken, including the suspension or deletion of the account concerned.

This Privacy Policy may be amended at any time to reflect changes to the Application, its features, its processing activities, or applicable regulations.

The version in effect is the one published on the official website or made accessible from the Application.

For any question regarding this Privacy Policy or the processing of personal data, you may use the contact form on the official website.