Orbivagus
FrançaisPlay

Privacy policy

Draft document, to be reviewed before public launch.

Orbivagus collects only what is needed for you to play. No advertising, no data resale, no audience tracking.

Data controller

SERAYA SAS, Bordeaux Trade and Companies Register 831 526 900 (see the legal notice). Contact for any question about your data: [To be completed: email address].

Data we process

  • Email address: identifies your account and receives your sign-in codes.
  • Nickname: shown publicly on the daily challenge leaderboard.
  • Daily challenge results: booked itinerary, score, duration, emissions; nickname, score and duration appear on the public leaderboard.
  • Session and sign-in codes: stored only as encrypted fingerprints. During the private beta, the sign-in code also appears in the server’s technical logs.
  • IP address: used temporarily to prevent abuse (number of code requests); it may also appear in the host’s technical logs.

Your current game, preferences and session token are stored in your browser (local storage) and are not sent to our servers. No advertising cookies or trackers are used.

Purposes and legal bases

  • Creating and securing your account, signing you in: performance of the terms of use.
  • Running the daily challenge leaderboard: performance of the terms of use.
  • Preventing abuse and keeping the service secure: legitimate interest.

Retention

  • Account, nickname and results: until the account is deleted.
  • Sessions: 180 days at most. Sign-in codes: 10 minutes.
  • Host technical logs: [To be completed: duration per Railway configuration].

Recipients and processors

Your data is only accessible to Seraya and its host, Railway Corporation (United States), which runs the service in its Amsterdam region (the Netherlands). As Railway is a US company, any access from the United States is covered by [To be completed: mechanism set out in Railway’s data processing agreement]. When email delivery of codes is enabled, an email delivery provider will be added to this list.

Third-party content

Destination photos are loaded from Wikimedia servers; your browser then shares your IP address with them, as with any website.

Your rights

You can delete your account at any time from the game (“Delete my account”): your email, nickname, sessions and scores are then erased. You also have the rights of access, rectification, restriction, objection and portability, by writing to the address above. If you believe your rights are not respected, you can contact the French data protection authority, the CNIL (cnil.fr).

Age

The game is intended for people aged 15 and over; below that age, parental consent is required. [To be completed: to be confirmed]