What we collect (not much), why, for how long, and how to take back control. No ad tracker, no cookie banner to click.
Last updated: 18 September 2026
DAHULAB, SAS, 57 rue Raymond Poincaré, 54000 Nancy, France. For any question about your data: contact@zapclash.com.
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Guest player: nickname, avatar (emoji or photo), random device identifier, answers, scores, tricks played | Run the game, show results to the other players and on the TV | Performance of the requested service (Art. 6(1)(b) GDPR) | Room deleted no later than 30 days after the end; abandoned lobbies purged after 6 h. Device identifier: session lifetime (120 min of inactivity) |
| Account: nickname, email, password (hashed, never readable), avatar or photo, creation date, last visit date | Identify you, retrieve your scores, reset your password | Performance of the contract (Terms) | For as long as the account exists. With no signed-in visit for 3 years, a reminder email is sent; without a sign-in within 30 days, the account is deleted automatically |
| Game history: results of each game (rank, score, correct answers, rounds won, tricks), badges | Your profile, the public leaderboard, badges | Performance of the contract | For as long as the account exists. On deletion, history is anonymised (no longer linked to you) |
| Account security: two-factor secret, recovery codes, passkeys (public key only) | Protect your account if you enable these options | Performance of the contract | For as long as the option is active |
| Session: session identifier, IP address, browser (user-agent) | Keep you signed in, protect against abuse (CSRF, rate limiting), recognise a TV screen | Legitimate interest (security) and performance of the service | 120 min of inactivity; “remember me” cookie: until you sign out |
| Server logs: IP, URL, date, response code, errors | Diagnose outages, detect attacks | Legitimate interest (security, legal obligation to retain connection data) | 12 months maximum |
| Contact: what you write to us by email | Reply to you | Legitimate interest | For as long as it takes to handle the request, then 1 year |
We do not ask for a real name, date of birth, phone number or postal address. We take no automated decision producing legal effects concerning you. The leaderboard is a simple sort by score.
If you choose a photo as your avatar, it is cropped to a square, re-encoded as a 256 px JPEG and stripped of its metadata (EXIF, including geolocation). It is stored under a random name on our servers and shown to the players in your rooms, on the TV screen if there is one, and on your public profile if you have an account. It is deleted when you pick another one, when you switch back to an emoji, or when your account is deleted. A guest photo is erased within 24 hours of the room being deleted.
Do not use someone else’s photo without their consent, or a photo of a minor.
/joueur/… and, for the cumulative score, on the leaderboard. Your email never appears.Profile and leaderboard pages can be indexed by search engines. Game rooms are not.
ZapClash only uses cookies and storage that are strictly necessary for the service to work, exempt from consent within the meaning of the CNIL. So there is no banner to accept.
| Name | Type | Role | Duration |
|---|---|---|---|
zapclash-session | Cookie | Session: keeps your nickname, room and sign-in | 120 min of inactivity |
XSRF-TOKEN | Cookie | Protection against forged requests | Same as the session |
remember_web_… | Cookie | “Remember me” if you tick the option | Until you sign out |
zapclash.sound | localStorage | Sound on or off | Until you clear it |
zapclash.ios-home | localStorage | Stop showing the “add to Home Screen” tip | Until you clear it |
| PWA cache | Service worker | Show an offline page and load faster | Until an update or you clear it |
No Google Analytics, no pixel, no third-party cookie. If we one day add audience measurement, it will either be exempt from consent (anonymised, hosted by us) or subject to your prior agreement; this page will be updated.
If you use the “Cast to TV” button (Chromecast), the Google Cast SDK is loaded from Google’s servers, which may then receive your IP address. That load only happens in a room, on compatible browsers, and only if the feature is enabled on the service. See Google’s privacy policy.
Your data is processed by DAHULAB and by the following technical providers only:
No data is sold, rented or shared for advertising. We do not transfer your data outside the European Union, except in the Chromecast case, covered by Google’s standard contractual clauses. We may have to disclose data upon requisition by a competent judicial or administrative authority.
If a data breach is likely to expose you to a risk, we will inform you and notify the CNIL within the legal time limits.
Under the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the rights of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to set instructions for what happens to them after your death.
If you believe your rights are not being respected, you may lodge a complaint with the CNIL (3 place de Fontenoy, 75007 Paris).
Account creation is reserved for people aged 15 and over (digital majority age in France). We do not knowingly collect data from younger people; if you are a parent and think a child has created an account, write to us and we will delete it. Playing as a guest in a room creates no account and keeps nothing beyond the game.
This policy may evolve with the service. The update date is at the top of the page; for a material change (new processor, new purpose, audience measurement), account holders will be informed by email or by a message on the site.