Privacy Policy — Smiley Arena

Publisher: QuickTurtle Contact: https://turtle-blog.fr/contact Last updated: September 26, 2026

Version française : politique-confidentialite.md (authoritative version).

This policy applies to the Smiley Arena game (client application, available on Windows, Linux and Android), to the central server it uses for account creation and online game discovery ("gamehub-server", operated by the publisher), and to this website (smileyarena.turtle-blog.fr, in particular its contact page). It describes precisely what data is processed, why, for how long, and how to exercise your rights.

1. Summary

Smiley Arena is a multiplayer maze game, playable solo, over a local network, or online. It contains no advertising, no analytics/audience-tracking tool, and no third-party tracker. No data is sold or shared with a third party for commercial purposes. The only data processed is what is strictly necessary for the multiplayer service to work: a player account (username + password), and, for the duration of a match, the network information that lets players connect to one another.

2. Data processed

2.1 Player account (central server)

To play online (local-network and solo play require no account at all), the game requires creating an account:

• Username (1 to 16 characters, freely chosen — not necessarily a real identity);
• Password, stored only in hashed form (BCrypt) — never in clear text, never readable by the publisher itself;
• Account creation date and an internal technical identifier (UUID).

No email address, real name, date of birth, or any other personal information is requested when creating an account.

Upon login, the server issues a signed session token (JWT), kept locally on the player's device so the password does not need to be re-entered every time the game is launched.

2.2 Avatar

Players may choose an image (PNG/JPEG, 400 KB max) as their avatar, stored only on their own device. This image is never sent to the central server: it is transmitted directly (player-to-player, peer-to-peer) only to the other participants of the current match, to be displayed in the lobby and in-game.

2.3 Online game directory (temporary)

To let players find an online match, the central server keeps in memory, for as long as a match is active:

• the host's public IP address and port (needed for other players to connect to it directly);
• the game name, number of slots, and the usernames of players currently present.

This information is automatically purged as soon as the game stops reporting activity (a few seconds after the match ends or the game is closed) and is never kept in any permanent log beyond that lifetime.

2.4 Technical connection data

To establish network connections (online match, local-network discovery, dialogue with the central server), IP addresses and timestamps are necessarily processed transiently by the underlying network mechanisms, for no purpose other than making the game work and, where applicable, detecting abusive use of the service (e.g. abnormally repeated login attempts).

2.5 What is not collected

The game never requests or collects: precise location, microphone or camera access, contacts, payment data, advertising identifiers, or any data for profiling or targeted advertising purposes. No analytics tool or third-party tracker is embedded in the game.

2.6 Contact form (website)

The site's contact page (/contact) asks for a name, an email address, and a message. This information is transmitted by email only to the address configured by the publisher: the site does not store it in any database. The actual retention of this message is therefore governed by the recipient's mailbox (Gmail), under Google's own privacy policy. A captcha (an image with text to retype, generated by the site itself — no third-party service, a deliberate choice to avoid sending anything to a third party) protects this form against automated submissions.

2.7 Site cookies

The site uses two cookies, both strictly functional (no tracking, no advertising, exempt from consent requirements):

• a session cookie, which holds the current captcha challenge pending verification (expires after a few minutes or when the browser is closed);
• a language preference cookie (French/English), which remembers the visitor's choice across visits.

3. Purposes and legal basis

The data described above is processed for the sole purpose of providing the multiplayer game service requested by the player (account creation, connecting to a match, displaying avatars and usernames in-game): the legal basis is therefore performance of the contract formed by using the service, complemented where relevant by the publisher's legitimate interest in keeping the service secure and functioning properly (limiting abuse, preventing fraud).

4. Data retention

• Player account: kept for as long as the account exists. Deletion may be requested at any time (see section 6); the service does not yet offer self-service deletion directly from within the application.
• Online game directory: kept for a few seconds to a few minutes, automatically purged (see 2.3).
• Avatar: stays on the player's own device, under their own control; it is never kept by the publisher.

5. Data sharing

No data is sold, rented, or shared with a third party for commercial or advertising purposes. The central server is hosted on infrastructure directly controlled by the publisher (no third-party processor has access to account data). In peer-to-peer play, only the other players in the same match receive the chosen username and avatar, as is inherent to how a multiplayer game works. The contact form message (2.6) passes through Google's (Gmail) mail servers to reach the publisher: this is the only technical processor involved, solely for that delivery, never for account data.

6. Your rights

Under the GDPR, you have the right to access, rectify, erase, and object to the processing of your data. To exercise any of these rights (including account deletion), contact the publisher via: https://turtle-blog.fr/contact.

7. Children

Smiley Arena is not specifically directed at young children and does not knowingly collect data about children under 15 without the consent of a holder of parental responsibility. A parent who discovers that a child created an account without their consent may request its deletion via the contact above.

8. Security

Passwords are never stored in clear text (BCrypt hashing), and authentication to the central server relies on signed tokens (JWT). The publisher applies reasonable technical measures to protect account data, without being able to guarantee absolute security, as with any online service.

9. Changes to this policy

This policy may be updated to reflect changes to the game or the service (new feature, new platform...). The "last updated" date at the top of this document reflects the latest revision; any substantial change will be signaled visibly on the page where this policy is published.

10. Contact

QuickTurtle — https://turtle-blog.fr/contact