Privacy policy
Last updated: 5 November 2026
In short
This policy explains what Hauntable does with your personal data, under the General Data Protection Regulation (GDPR) and the French Data Protection Act. We collect what the game needs and nothing more: no advertising, no analytics, no tracker, and nothing is ever sold.
Who is responsible
The controller is Hauntable's publisher, [À compléter : prénom et nom], [À compléter : adresse postale] (see the legal notice). For any question or request about your data: contact@hauntable.io.
What we collect, why, and on what basis
- Your account. When you sign in with Google, Google gives us your name, email address, profile picture and account identifier, plus access keys that we store encrypted and never use. You then pick a public handle. This is to create your account and recognise you. Basis: the performance of the terms of use (a contract). Your name and email address are never shown to other players.
- Guest accounts. A random identifier, with no name or email address. Basis: the terms of use.
- Your games. Matches and their shots, results, ratings and their history, practice results, the shot of the day, quests, daily rewards, tournaments, favourite matches, saved match settings, items unlocked, coins and gems and the record of what you earned and spent. This is the game itself: playing, rankings, replays, the market, and checking that nobody cheats. Basis: the terms of use.
- Friends. Friend requests, friends and blocked players. While you are connected, your friends see that you are online; that status is only kept in the server's memory. Basis: the terms of use.
- Sessions and security. Each sign-in opens a session that records the IP address and the browser it came from. IP addresses are also counted, in memory only, to limit how many connections, messages and guest accounts can come from one address. This is to keep you signed in and to protect accounts and servers from abuse. Basis: our legitimate interest in keeping the game secure.
- Moderation. Whether an account is banned, penalties for leaving matches, and reports about players. Basis: our legitimate interest in a fair and safe game.
- Welcome email. One email, in your language, when you create an account with Google. No newsletter, no advertising. Basis: our legitimate interest in welcoming new players.
- Notifications. If you turn them on in the settings, we keep your browser's push subscription (an address at its push service and the keys that encrypt messages to it) and your language, to tell you about invitations, friend requests and tournament matches. Basis: your consent, which you withdraw by turning them off in the settings or in your browser.
- Emails you send us. To answer them. Basis: our legitimate interest in answering you.
- Error logs. Our servers log their errors with the account concerned, never with an IP address, to fix them. Basis: our legitimate interest in a game that works.
No decision that significantly affects you is made automatically. Pairing players by rating is part of the game.
What other players see
Everyone, even without an account, can see your handle, your ghost and the items you wear, your ratings and their curve, your wins and games played, your public, ranked and public-tournament matches and their replays, your place on the leaderboards and on the shot of the day's board, and your tournaments. Search engines can index the leaderboards. Your Google profile picture can show beside your handle where your ghost does not. Your friends also see when you are online. Your email address and Google name are never shown.
Who handles your data
- The publisher, and the moderators they appoint, for support and moderation.
- Hetzner Online GmbH (Germany) hosts the servers, the database, the cache and the backups. Processor.
- Cloudflare, Inc. (United States): the site's pages and files go through its network, which protects them from attacks and caches the files. Cloudflare sees visitors' IP addresses and requests. The game connection itself goes straight to our server. Processor.
- Resend, Inc. (United States) sends the welcome email: it receives your email address. Processor.
- [À compléter : fournisseur du stockage S3 des sauvegardes et pays, ou retirer si non utilisé] keeps a copy of the backups, encrypted with a key it does not have. Processor.
- Google handles signing in with Google under its own privacy policy. Profile pictures are loaded from Google's servers by the browser of whoever sees them, which gives Google that browser's IP address.
- Push services: if you turn on notifications, your browser's maker delivers them (Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge). Their content is encrypted end to end: the service only sees that a message goes to your browser.
- Public authorities, only when the law requires it.
Transfers outside the European Union
Our servers and database are in Germany. Cloudflare and Resend, and for sign-in and notifications Google, Apple, Microsoft and Mozilla, are based in the United States or may handle data there. These transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework for the companies certified under it, and otherwise on the Commission's standard contractual clauses in their data processing terms. You can ask us for a copy of these safeguards.
How long we keep it
- Account and game data: as long as the account exists. When you ask, we delete it within one month.
- Guest accounts: deleted, with everything in them, 30 days after they were made.
- Sessions, with their IP address and browser: until you sign out, or 7 days after their last use.
- IP addresses counted against abuse: in memory, an hour at most.
- Push subscriptions: until you turn notifications off, sign out on that device, or the push service drops them. Only an account's 10 latest devices are kept.
- Cache: copies of what public pages show, in memory, for a few seconds to a few minutes.
- Backups: encrypted, kept 14 days on our server, and their copy off the server 30 days. Deleted data is gone from them within 30 days.
- Error logs: [À compléter : durée, par ex. 30 jours].
- Emails you send us: as long as needed to deal with them.
- When an account is deleted, the matches it played against others stay in those players' history and replays, under the handle it had then. Reports are deleted with the account that made them or that they concern.
Your rights
You can access your data, have it corrected or deleted, restrict its use, object to its use when it rests on our legitimate interest, receive the data you gave us in a reusable format, withdraw your consent at any time, and set instructions for what happens to your data after your death.
To do so, or to delete your account, write to contact@hauntable.io from your account's email address, with your handle. There is no delete button in the game: we delete the account and everything attached to it on request. We answer within one month, which can be extended by two months for a complex request.
If you think your rights are not respected, you can complain to the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
Minimum age
Hauntable is for people aged 15 and over. Under 15, a parent must agree before you create an account: in France, 15 is the age from which you can consent on your own to an online service. If you are a parent and your child under 15 made an account without your agreement, write to us and we will delete it.
Security
Connections are encrypted (HTTPS), Google's access keys are encrypted in the database, backups are encrypted with a key kept off the server, and access to the servers and to moderation tools is restricted.
Changes
We update this page when what we do with your data changes; the date at the top says when. Important changes are announced in the game.