Privacy Policy
Effective October 2, 2026
Cevatan is an online board game, playable on cevatan.com and in the Android and iOS apps. The game requires no account: no email, no password, no real name.
Contact for any question or request about your data: [email protected]
1. Data we process
- Nickname you choose to play (shown to the other players of the game).
- Random device identifier, created by the app or browser, used to get you back to your seat in a game. It does not identify you.
- Game data: your moves, in-game chat messages, scores.
- Technical data: IP address (abuse protection and rate limiting), server logs, and on the website a technical session cookie.
- Storage on your device: nickname, preferences (sound, board view) and ongoing games, kept locally.
- Advertising (apps and the game on the website): see section 3.
2. Why, and on what legal basis
- Running the game (rooms, online games, rejoining a game): performance of the service you request.
- Securing the service and preventing abuse: legitimate interest.
- Usage statistics (number of games, duration, modes played): legitimate interest.
- Showing an ad when a game starts in the apps: consent, or legitimate interest for non-personalized ads, depending on your choice (section 3).
3. Advertising
The Android and iOS apps show one ad (image or video) when a game starts, served by Google AdMob (Google Ireland Limited in Europe). On cevatan.com, the game likewise shows one ad when a game starts, and ads may appear on the website's pages; they are served by Google AdSense, which uses cookies or similar technologies. During this short break, the game waits for the players watching the ad (40 seconds at most).
- Google may use the device's advertising ID (or, on the website, advertising cookies), IP address and technical information (model, OS, language) to serve ads, measure them and prevent fraud.
- In the European Economic Area, the UK and Switzerland, a consent screen appears when you first open the app or visit the website: you can accept or refuse personalized ads. Without consent, only non-personalized ads (or no ads) are shown.
- On iPhone, the app asks for tracking permission (App Tracking Transparency). You can refuse it or withdraw it in Settings › Privacy › Tracking.
- You can change your choices at any time with the “Ad choices” (“Choix publicitaires”) button in the game menu (on the website: the “Privacy and cookie settings” link shown by Google), and reset or disable the advertising ID in your device settings or clear your browser cookies.
Learn more: how Google uses data.
4. Retention
| Data | Retention |
|---|---|
| Room and game (nicknames, moves, chat) | Deleted a few minutes after the game ends or the players leave |
| Game history (nicknames, scores, duration, mode) | 12 months, then deleted automatically |
| IP address for rate limiting | A few minutes |
| Website session cookie | 2 hours |
| Data stored on your device | Until you erase it (uninstall, browser data) |
5. Recipients and hosting
- Railway (game server hosting) and Cloudflare (network and security).
- Google: AdMob (advertising in the apps), AdSense (advertising on the website) and Google Fonts (website fonts).
These providers may process data outside the European Union, notably in the United States, with the safeguards required by the GDPR (European Commission standard contractual clauses or the EU-US Data Privacy Framework). We do not sell your data for money.
6. Your rights
You have the right to access, correct, erase, object to and restrict the processing of your data, and to withdraw your consent at any time. Write to [email protected] with your nickname and, if possible, the room code. We reply within one month. You can also lodge a complaint with your data protection authority (in France, the CNIL).
7. United States residents
Some US states (including California, Virginia, Colorado, Connecticut, Utah and Texas) give you additional rights.
- Categories of personal information collected in the past 12 months: identifiers (random device ID, advertising ID, IP address) and internet or other electronic network activity (in-game interactions). They come from you and your device, and are used for the purposes in sections 2 and 3. We do not collect sensitive personal information.
- “Sale” or “sharing”: we do not sell your data for money. However, providing the advertising ID and device data to Google (AdMob, AdSense) for personalized ads may be considered a “sale” or “sharing” (targeted advertising) under these laws.
- Right to opt out: use the “Ad choices” button in the game menu (“Do Not Sell or Share My Personal Information”), turn on “Limit Ad Tracking” or “Delete advertising ID” in your device settings, or email us.
- Other rights: to know what data we hold, access it, correct it and have it deleted. An authorized agent may act on your behalf. We respond within 45 days and may verify your request (nickname, room code). If we decline, you can appeal by replying to our message.
- Non-discrimination: exercising these rights does not affect your access to the game.
- We do not knowingly sell or share the personal information of consumers under 16.
8. Children
Cevatan can be played by everyone. If you are under the age of digital consent in your country (15 in France, 13 to 16 elsewhere), ask a parent before accepting personalized ads.
9. Changes
This policy may change as the game evolves. The date at the top of the page shows the latest update.