Privacy Policy
This is a translation provided for convenience; the French version prevails in case of discrepancy. Read the French version.
MIBS collects as little data as possible: you can play without an account, without an email address and without advertising. This page explains what we keep, why, for how long, and how to exercise your rights (General Data Protection Regulation, GDPR).
1. Data controller
The publisher named in the legal notice. Contact for any question about your data: [email protected].
2. Data used and why
| Data | Why | Legal basis |
|---|---|---|
| Random marble identifier, nickname, progress (level, statistics, bag, chalk, season, missions, stars) | Running the game and keeping your progress | Performance of the service (Terms of Use) |
| Nickname, marble, title, level, round results | Games, leaderboards and public profile visible to other players | Performance of the service |
| Account: username, password hash (never the password itself), backup email address if you provide one | Retrieving your progress on several devices, securing the account, resetting the password | Performance of the service |
| Google sign-in: Google identifier and first name | Signing you in without a password; your first name is shown only to you | Performance of the service |
| Purchases: item, amount, date, status, payment reference; text and date of your waiver of the right of withdrawal | Supplying the purchase, proof of sale, accounting | Performance of the contract, legal obligation |
| Friends (players who came via your link or with whom you have finished a recess), referrals | Friends leaderboard, referral rewards | Performance of the service |
| Nickname reports (who reported, which nickname) | Moderation | Legitimate interest (player safety) |
| Salted cryptographic hash of the IP address (never the address itself) | Preventing abuse: mass referrals and mass reports | Legitimate interest (abuse prevention) |
| IP address, held in memory only, for a few minutes to an hour | Limiting login attempts and automated submissions | Legitimate interest (security) |
| Session log: game events (arrival, falls, loading times…), screen size and type, and a code derived from the marble identifier to recognise the same marble from one session to the next; no IP address, nickname or account identifier | Measuring and improving the game (difficulty, loading, usability) | Legitimate interest (service improvement) |
We do not sell any data, display no advertising and carry out no advertising profiling.
3. Storage on your device
The game uses a single cookie, “mibs-lang”, which remembers the language you chose (French or English) so pages are served in that language; it holds nothing else and lasts one year. The game keeps in your browser’s local storage what the game needs: guest marble or session identifier, nickname, bag selection, settings (sound, vibration, assists), progress in the tutorial and in School Square, and the current session log. These items are strictly necessary for the service, so no consent is requested. You can delete them from your browser settings (a guest marble’s progress will then be lost).
4. Recipients
Your data is accessible only to the publisher and its service providers, and only to the extent strictly necessary:
- OVH (France): hosting of the game and the database;
- Cloudflare (United States): page delivery and protection against attacks; sees IP addresses in transit;
- Stripe (Ireland, United States): payment; receives the bank details and email address you enter on its pages;
- Google (United States): only if you choose “Sign in with Google”;
- Resend (United States): sending confirmation and forgotten-password emails, if you have provided an email address.
Transfers to the United States are covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.
Other players see only what is public in the game: nickname, marble, title, level, game statistics, badges, rank, and whether you are in the schoolyard.
5. Retention periods
- Guest marble: deleted after 2 years without a game.
- Account: until you delete it, or after 3 years without logging in.
- Login sessions: closed after 90 days without use.
- Links sent by email: 30 minutes (password) or 24 hours (confirmation).
- Reports: 1 year.
- Session logs: 6 months.
- Purchases and waivers: 10 years (accounting obligation), even after the account has been deleted.
6. Security
Passwords protected by a slow, salted hashing function; sessions of which only a hash is stored; encrypted connections (HTTPS); IP addresses never stored in plain text; database access restricted to the publisher.
7. Your rights
You can request access to your data, its rectification, erasure or portability, or the restriction of its use, and you can object to any processing based on legitimate interest. You can also give instructions as to what should happen to your data after your death.
- Deleting your account: directly in the game, Account screen, “Delete my account”. For a guest marble, write to us stating your nickname.
- Any other request: [email protected]. We reply within one month.
If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
8. Minors
MIBS is intended for all audiences. The game does not ask for any age, name or photo, and does not rely on any processing that requires consent. A minor may exercise their rights themselves; their parents may also write to us.
9. Changes
This policy may change as the game evolves; any significant change is announced in the game.