Privacy Policy

Last updated: 11 October 2026

This policy explains what personal data Unicards (unicards.fr) collects, why, and your rights under the EU General Data Protection Regulation (GDPR) and French law.

1. Who is responsible

The data controller is DATATOY SASU, 13 rue Parrot, 75012 Paris, France (RCS Paris 938 493 301). Contact for any privacy question or request: gabriel@datatoy.fr.

2. Data we collect

Account (optional)	Email address, name (optional), password hash (we never store your password), or — with Google sign-in — your Google account identifier, name, email and profile picture address. Sign-in count, date of last sign-in, role.
Your sets	Set settings, cards, mechanics, uploaded set symbols, and the layout preferences of the editor.
Uploaded images	Images you upload for card art (stored with a random file name). Images you link by URL are fetched by our server to render your cards.
Public showcase (opt-in)	Whether you opted in for a set, the date of your consent, excluded cards, and the moderation status of each submitted card. Showcased cards are shown publicly with your account name.
Feedback & review prompt	The optional private rating (1–5) and comment you send, and whether we already asked you for a review (so we don't ask again).
Cookies	Only strictly necessary cookies: `fc_session` (keeps you signed in, 30 days, HttpOnly) and `fc_oauth_state` (a few minutes, protects Google sign-in). No advertising or analytics cookies, no trackers — so no cookie banner is needed.
Browser storage (localStorage)	Sets created without an account, editor layout, and small flags (first visit, visit days and answers for the review prompt). These stay in your browser and are not sent to us unless you sync a set to an account.
Technical data	IP address and request information, used transiently for security and rate limiting and kept in server logs for a limited period.

3. Why we use it (legal bases)

Providing the service you ask for — accounts, sync, uploads, rendering, exports (performance of the contract, art. 6(1)(b) GDPR).
Security, abuse prevention and moderation (our legitimate interest, art. 6(1)(f)).
The public showcase of your cards and the optional feedback (your consent, art. 6(1)(a) — you can withdraw it at any time).

We do not sell your data, do not use it for advertising and do not make automated decisions about you.

4. Who processes it

Google Cloud (Google Cloud France, 8 rue de Londres, 75009 Paris) — hosting of the application, database and uploaded images, in the europe-west1 region (Belgium).
Google — only if you choose “Continue with Google” to sign in.
Stripe (Stripe Payments Europe Ltd.) — only if you make a voluntary donation; Stripe processes the payment and the data you give it under its own privacy policy. We receive the donation amount and the details you enter on Stripe's page (such as name and email), never your card details.
Trustpilot — only if you click “Rate on Trustpilot”; you then use Trustpilot's site under its own policy.

Some of these providers may process data outside the EU; such transfers are covered by the European Commission's standard contractual clauses and/or the EU–US Data Privacy Framework.

5. How long we keep it

Account, sets and uploaded images: as long as your account exists; deleted when you delete a set or ask us to delete your account.
Sessions: until you sign out or after 30 days.
Showcase data: until you withdraw your consent or delete the set (removed from the gallery immediately).
Feedback: up to 3 years. Technical logs: a limited period for security.

6. Your rights

You can access, correct, delete or export your data (Export ▸ CSV also gives you your sets), restrict or object to its processing, and withdraw any consent at any time. Write to gabriel@datatoy.fr; we answer within one month. You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

7. Children

Accounts are for people aged 15 or over, or younger with the consent of a parent or guardian.

8. Changes

We may update this policy; the date above shows the latest version.