Privacy Policy
Last updated: November 2, 2026
1. Data controller
The data controller is the publisher of Mysterpiece, identified in the legal notice. For any question about your data: mysterpieceapp@gmail.com.
2. Data we collect
| Category | Data | When |
|---|---|---|
| Account | Email address, password (stored encrypted, never in plain text), artist name, Apple or Google technical identifier if you use those sign-in options | Account creation |
| Game | Games played, scores, artworks found (gallery), rank, game preferences | While you play |
| Questions | Text of the questions you ask during a game | During a game |
| Technical data | Device model, OS and App version, connection and error logs (including IP address) | Automatically |
| Purchases | Status of your purchases and subscriptions, transaction identifiers sent by Apple or Google. We never have access to your payment card details. | When you buy |
| Advertising | Data needed to display ads (device type, language, approximate IP address); if you agree, your device’s advertising identifier and ad interactions | If ads are shown |
| Support | Content of your messages and email address | If you contact us |
With “Continue with Apple”, you can choose to hide your email address; we then receive a relay address provided by Apple. We never collect your real name from Apple or Google.
In guest mode, your progress is stored on your device. No account is created on our servers, but your questions and technical data are processed as described below so that games can work.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your account, save your progress, show leaderboards and the Salon | Performance of the contract (the Terms) |
| Generate answers to your questions during a game | Performance of the contract |
| Send service emails (verification code, password reset) | Performance of the contract |
| Manage your purchases and subscriptions, unlock purchased content | Performance of the contract |
| Show non-personalized ads | Legitimate interest (funding the free version) |
| Show personalized ads and measure their performance | Consent |
| Ensure security, prevent cheating and abuse, fix bugs | Legitimate interest |
| Improve the game using aggregate statistics | Legitimate interest |
| Answer support and data-rights requests | Legal obligation and legitimate interest |
We do not sell your data. It is only used for personalized advertising with your consent.
Advertising and consent
If the App shows ads, you are asked for your choice before any personalized advertising: on iPhone through Apple’s “Allow tracking” prompt and, in the European Union, also through a consent screen listing our advertising partners. If you decline, you can keep playing and will see non-personalized ads. You can change your choice at any time in the App’s or your phone’s settings. An ad-free subscription may also be offered.
4. Your questions and artificial intelligence
The text of your questions is sent to an artificial intelligence provider solely to produce the answer shown in the game. It is not linked to your real name. We recommend that you do not enter any personal information in your questions.
5. What other players can see
Your artist name, scores, rank and, where applicable, your gallery may be visible to other players. Your email address and real name never are.
6. Recipients and service providers
Your data is accessible to the publisher and to the following technical providers, acting on our behalf and under our instructions:
- Supabase: database and authentication. Servers located in France (Paris region).
- Brevo (France): sending service emails.
- Rork: technical platform used to build and run the App.
- Artificial intelligence provider: generating answers to questions.
- Apple and Google: if you use their sign-in service, and for payments for purchases and subscriptions, under their own privacy policies.
- Purchase and subscription management provider, where applicable: verifying purchases and access rights.
- Advertising partners (ad networks), where applicable: displaying and measuring ads. Their list is available on the App’s consent screen.
- Cloudflare: hosting of this website.
Some providers may process data outside the European Union, in particular in the United States. Such transfers are covered by the safeguards provided for by the GDPR: an adequacy decision (EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses.
7. Retention periods
- Account and game data: as long as your account is active. After 3 years of inactivity, the account may be deleted after a warning email.
- After account deletion: erased from our active systems immediately, and from technical backups within 30 days at most.
- Technical logs: 12 months at most.
- Advertising consent choice: kept for 6 months, then asked again.
- Purchase history: as long as required by accounting and tax obligations.
- Support exchanges: as long as needed to handle your request, then 1 year.
8. Security
We use appropriate measures: encrypted connections (HTTPS), passwords stored encrypted, restricted access to data. As no system is infallible, we will notify you and the competent authority of any breach that poses a risk to your rights, as required by law.
9. Children
The App is intended for people aged 13 and over. In France, a minor under 15 may only create an account with the consent of a parent or legal guardian. If you believe a child has provided us with data without permission, contact us and we will delete it.
10. Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data. Under French law, you may also set instructions regarding your data after your death.
To exercise these rights, write to mysterpieceapp@gmail.com from the address linked to your account. We reply within one month. You can also delete your account directly in the App (Profile → Delete my account).
If you believe your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), or with the data protection authority of your country.
11. Trackers
The App only uses advertising trackers (including your device’s advertising identifier) with your consent, as described in section 3. This website does not use analytics or advertising cookies; only strictly necessary technical cookies may be set by our host for security purposes.
12. Changes
This policy may change, for example when new features are added. You will be notified in the App of any significant change. The date of the last update appears at the top of this page.