Privacy policy

Last updated: October 7, 2026. This is a translation for information only: the French version is the one that applies.

In short: you can play without giving anything. No advertising, no tracking tool from another company, no data sold or shared. The site keeps the bare minimum to make the game work and count its visitors.

Who is responsible

Ombre Mana, publisher of the site on a personal basis (see the legal notice). Contact for anything about your data: [email protected].

What the site keeps, why and for how long

1. The “visitor_id” cookie

• What: a random identifier (32 characters), without your name, your e-mail or your IP address.
• Why: to recognize your browser from one visit to the next, protect the game's buttons against fraudulent submissions, and count visitors (see point 2).
• Legal basis: the legitimate interest of running the site and measuring its audience. This cookie is one of those the CNIL (the French data protection authority) exempts from consent.
• Duration: 1 year, then it is renewed.

2. Audience measurement, done by the site itself

• What: per day and per visitor, an encrypted fingerprint of the cookie above, the site you come from, the first page seen, the number of pages, the type of device (phone, tablet, computer), the time spent on the site, the step reached in the case (cards found) and the last action before leaving. Page by page: the time, the page, the time spent on it, the actions made in the game, the browser and system, the browser language, the screen width and the country (deduced from the IP address by the Cloudflare network; the address itself is not kept; for robots, an encrypted IP + browser fingerprint that changes every day). Per case, totals without any identifier (games started, finished, mistakes).
• Why: to know whether people like the game, where players get stuck, and fix the cases that are too hard. These figures are only seen by the publisher and are never used for advertising.
• Legal basis: the legitimate interest of measuring the site's audience.
• Duration: 13 months at most (90 days for the page-by-page detail), then automatic deletion.

3. Your progress in your browser

• What: your game in progress, your level, your medals, your bonuses, your cards and the text size you chose. They are stored in your browser's local storage, on your device.
• Why: to resume your game where you left it. None of this is sent to the server, unless you create an account.
• Duration: until you clear the site's data in your browser.

4. The account (optional)

• What: your e-mail address, your encrypted password (the site never knows the password itself) and your progress.
• Why: to find your progress on another device. The address is only used as an identifier: no e-mail is ever sent to you.
• Legal basis: the performance of the service you ask for by creating the account (see the terms of use).
• Duration: until you delete your account (button on the Save my progress page, immediate deletion), or after 2 years without logging in.

5. Failed login attempts

• What: an encrypted fingerprint of your IP address (the address cannot be recovered from it) and the time of the attempt.
• Why: to block someone who would try to guess a password.
• Legal basis: the legitimate interest of protecting the accounts.
• Duration: 24 hours.

6. Reports (“🚩 Report a problem”)

• What: the case concerned, the kind of problem, your message if there is one, the state of your game (for example “12/40 cards, 1 mistake”) and the encrypted fingerprint of the cookie (5 reports per day at most).
• Why: to fix the cases. Don't write personal information in the message: it is not useful.
• Legal basis: the legitimate interest of improving the game.
• Duration: 13 months at most; often much less, as a handled report is deleted.

7. Cloudflare and the server

• The site goes through Cloudflare, Inc. (United States), which acts as a relay: it sees your IP address to deliver the pages and block attacks, and may set the “__cf_bm” security cookie (30 minutes). This data may go to the United States; Cloudflare is part of the EU–US Data Privacy Framework, recognized by the European Commission.
• Like any web server, the site's server may record the IP address, the requested page and the time in its technical logs, for security. These logs are used for nothing else and are kept 12 months at most.
• Legal basis: the legitimate interest of keeping the site secure.

Who has access

The publisher only. The person hosting the server and Cloudflare only have technical access to the data, to run the site. Nothing is sold, rented or shared with anyone.

Cookies and storage

• visitor_id (Enquetix): random identifier, 1 year. Points 1 and 2.
• __cf_bm (Cloudflare): security against bots, 30 minutes. Point 7.
• enquetix_language (Enquetix): the language chosen with the flag (French or English), only if you clicked it, 1 year.
• Local storage (Enquetix, on your device): your game, your progress, the text size. Point 3.

No advertising or social network cookie. That's why the site shows no cookie banner: all of these are either necessary for the site or exempt from consent. You can also block the site's cookies in your browser: the game stays playable.

Your rights

You can ask to see the data about you, to correct it, to delete it, to limit its use, to get it in a readable format, or to object to its use. Write to [email protected]; answer within one month at most. For the account, you can delete everything yourself, right away, on the Save my progress page.

As the site doesn't know your name, you may need to give the e-mail address of your account, or the day and the case of a report, so that we can find what concerns you.

If you are not happy with the answer, you can complain to the CNIL: cnil.fr/fr/plaintes, or by post to CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.