1. Data controller
Sea Sex and Sun — raison sociale à compléter, Adresse à compléter — contact: contact form. We collect the minimum data the Game needs and never sell it.
2. Data processed, purposes and legal bases
| Data | Why | Legal basis |
|---|---|---|
| Email address, password (stored irreversibly hashed, Argon2id), login codes sent by email | Create and secure the account, log in, verify a new device | Performance of the contract (terms of use) |
| Character name, avatar, language, time zone, in-game city and HQ position, progress, resources, fights, family | Run the Game, rankings, map | Performance of the contract |
| Chat, forum and private messages, blocks and reports | Social features, moderation | Performance of the contract, legitimate interest (community safety) |
| IP address (stored hashed in the security log), browser (simplified fingerprint tied to the session) | Security, preventing fraud and cheating, limiting abuse | Legitimate interest |
| Purchases: product, amount, date, Stripe payment identifiers (never card numbers) | Deliver purchases, accounting, refunds | Performance of the contract, legal obligation (accounting) |
| Affiliate or referral code the player came through | Pay the affiliate or referrer | Legitimate interest |
| Affiliates: email, billing details, IBAN (stored encrypted) | Run the affiliate programme, pay commissions, invoices | Performance of the contract, legal obligation |
3. Cookies
The Game uses no advertising or third-party analytics cookies. Only necessary cookies are set:
- Session: keeps the player logged in (expires after inactivity);
- Trusted device: avoids asking again for an email code on an already verified device (60 days);
- Affiliation (
sss_aff, 30 days): remembers the affiliate link the visitor came from, to pay the affiliate if an account is created; - the browser also keeps a few display preferences (selected tab, banners already seen) in its local storage.
Showcase site analytics: the public presentation pages (home, rules, code of conduct) use the Zenbaki audience measurement tool, without cookies and without cross-site tracking: it counts visits anonymously (pages viewed, referrer, device type) to help us improve the site. It is not loaded in the Game, the affiliate area or the payment pages.
4. Recipients and processors
- Website and database host: Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Genève), Suisse — www.infomaniak.com. Data is hosted in Switzerland, recognised by the European Commission as providing an adequate level of protection;
- Stripe (payments), acting as controller for card data; Stripe may transfer data outside the European Union under standard contractual clauses;
- the email delivery provider;
- Zenbaki (anonymous, cookieless analytics of the showcase site);
- other players only see public information: character name, avatar, level, points, city, family, posted messages.
Map tiles are served by our own server; no personal data is sent to advertising networks.
5. Retention periods
- Account and game data: as long as the account exists. When deletion is requested, the account is deactivated immediately (hidden from other players) and permanently erased after 30 days; during that time, the player can reactivate it by logging back in;
- Chat messages: 7 days; forum messages: as long as the topic exists (author anonymised if the account is deleted);
- Security log (hashed IPs): 12 months;
- Messages sent through the contact form (subject, email, message): 12 months;
- Purchase data and invoices: 10 years (accounting obligation).
6. Security
Encrypted connections (HTTPS), hashed passwords, encrypted IBANs, single-use login codes, cross-site request protection, rate limiting. No measure is infallible: in case of a data breach presenting a risk, the people concerned and the supervisory authority are informed within the legal deadlines.
7. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability of your data, and may set instructions for its use after your death. From the Game (phone › Settings › My account), you can download your data (JSON file) and delete your account. To exercise your other rights, use our contact form and give your account’s email address. You may also lodge a complaint with the French data protection authority, the CNIL, or with your local authority.
8. Minors
The Game is not recommended for players under 16. A minor under 15 may only register with the consent of a parent or legal guardian, who may ask for the account to be deleted at any time.
9. Changes
This policy may change; the date of the last update is shown at the top of the page.