Privacy Policy

This Privacy Policy describes how MyBabyGuessr collects, uses and protects your personal data, in accordance with the General Data Protection Regulation (GDPR — EU 2016/679).

1. Data Controller

Atif Mickaël Zourgani — individual, based in France
Email: contact@mybabyguessr.com

2. Data We Collect

For organizer accounts (registration required):

• Email address (login identifier)
• First name and last name
• Password (hashed with bcrypt — never stored in plain text)
• Game cover photo (optional upload)
• Game data (title, categories, due date)

For players (no account required):

• First name (required to participate)
• Email address (optional — only provided if the player wishes to receive the reveal notification)
• Submitted guesses (gender, name, date, weight, height depending on enabled categories)

3. Purposes and Legal Bases

4. Data Retention

• Account data: retained until account deletion, then deleted immediately.
• Games and guesses: linked to the account, deleted at the same time.
• Player emails: retained until the game or account is deleted by the organizer.
• Password reset tokens: automatically deleted 1 hour after creation.
• Uploaded images: deleted when the game or account is deleted.
• Google Analytics data: retained for 14 months by Google (default GA4 retention setting).

5. Hosting and Recipients

Your application data is hosted exclusively by o2switch (222-224 Boulevard Gustave Flaubert, 63000 Clermont-Ferrand, France), a web hosting provider acting as a data processor.

The service also uses Google LLC (1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA) for the following:

• Google Analytics 4 — audience measurement and usage analysis (only with your consent)

Your personal data is never sold, rented or shared with third parties for commercial or advertising purposes.

6. International Transfers

Application data is stored in France. However, the use of Google Analytics 4 involves data transfers to Google LLC, based in the United States. These transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Article 46 of the GDPR. You can review Google's data protection commitments at policies.google.com/privacy.

7. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: obtain a copy of your data.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): request deletion of your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest.
• Right to restriction: request temporary suspension of a processing activity.
• Right to withdraw consent: withdraw any previously given consent at any time (including for Google Analytics).

The rights to rectification (updating your name or email address) and erasure (permanent deletion of your account and all associated data) can be exercised directly from your account settings.
For any other right or question, contact us at: contact@mybabyguessr.com
We will respond to your request within 30 days.

You may also lodge a complaint with your national supervisory authority. In France: CNIL — www.cnil.fr

8. Cookies

Strictly necessary cookies (no consent required):

• Session cookie (PHPSESSID): required for logged-in functionality. Set with HttpOnly and Secure flags. Deleted on browser close or logout.
• "Remember me" cookie (optional): keeps you logged in for 7 days if you check that option at login. You can remove it by logging out.

Analytics cookies (deposited only with your consent):

• _ga: anonymous identifier used by Google Analytics to distinguish visitors. Duration: 2 years.
• _ga_31T81S0PJN: Google Analytics 4 session state. Duration: 2 years.

Analytics cookies are only set after your explicit consent via the cookie banner shown on your first visit. You can change or withdraw your consent at any time via the "Manage cookies" link in the footer. IP addresses are anonymised before processing by Google (anonymize_ip enabled).

9. Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss or alteration:

• Passwords hashed with bcrypt (never stored in plain text)
• Encrypted connection via HTTPS/TLS
• Admin access restricted to authorized accounts
• Game links generated with 32-character random hexadecimal tokens
• Single-use, auto-expiring password reset tokens

10. Contact

For any questions about this privacy policy or to exercise your rights:
contact@mybabyguessr.com