Privacy Policy

Who we are

Octopack is operated by Mickaël Alves, France (the "operator"). The operator is the data controller for the personal data described below. Contact: alves.mckl@gmail.com.

Data we collect

When you sign in with GitHub, we receive from GitHub and store:

• your GitHub user ID, username and avatar URL;
• the email address attached to your GitHub account (kept by our authentication provider, not displayed).

While you play, we store:

• your pack balance and the time of your last pack credit;
• the cards you own and when you first obtained them.

When you nominate a repository or a profile, we store the GitHub URL, the optional reason and suggested rarity you entered, and, if you are signed in, a link to your account.

Card content (repository and profile names, descriptions, public statistics) comes from public GitHub data and is not personal data about you unless you are the subject of a card. See "Cards about people" below.

Why we use it, and on what legal basis

• To create your account, run the game and keep your collection (performance of the contract: the Terms of Service).
• To secure the service and prevent abuse such as exploiting pack credits (legitimate interest).
• To review nominations you submit (legitimate interest).

We do not sell your data and we do not use it for advertising.

Cookies

We only use cookies that are strictly necessary to keep you signed in (session cookies set by our authentication provider). They do not track you across sites, so no consent banner is required. We currently use no analytics or advertising cookies. If that changes, this page will be updated before the change goes live.

Who processes your data

• Supabase: authentication and database hosting.
• Vercel: application hosting.
• GitHub: sign-in (OAuth). GitHub's own privacy statement applies to your GitHub account.

Some of these providers may process data outside the European Economic Area. Where they do, transfers rely on the safeguards they offer, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

How long we keep it

Account and gameplay data is kept as long as your account exists. When your account is deleted, your profile, pack balance and collection are deleted. Nominations may be kept without any link to your account.

Your rights

You can ask us to access, correct, export or delete your data, to restrict or object to its processing. Email alves.mckl@gmail.com and we will answer within one month. You can also revoke Octopack's access from your GitHub settings (Applications) at any time.

If you are in the EU and think we mishandled your data, you can complain to your data protection authority, for example the CNIL in France (cnil.fr).

Cards about people

Some cards represent GitHub profiles and show public information (username, public statistics). If you appear on a card and want it removed or changed, email us and we will remove it from future sets and from the game.

Changes

We may update this policy. The date at the top shows the latest version. Significant changes will be announced on the site.