Information
Privacy policy
Version in force as of 3 October 2026
This English version is provided for convenience. In case of discrepancy, the French version prevails.
In short: Cinedex asks for neither an email address nor your real name, shows no ads, uses no analytics and sells no data. It keeps what is needed to run the game, and you can export or delete your data yourself from My account.
1. Data controller
The data controller is the publisher of the game: a private individual (identity held by the hosting provider). Contact for any question or request about your data: contact@cinedextcg.com.
2. Data processed
| Category | Data | Source |
|---|---|---|
| Account | Username, password (stored only as an unreadable salted hash), registration date, last visit date | You |
| Acceptance of the rules | Version of the Terms and policy accepted, date, statement that you are 15 or over | You |
| Session | Random login token (cookie), stored in the database as a hash, login and expiry dates, browser used (for your list of signed-in devices) | Generated by the service |
| Game | Cards and the history of each copy, boosters opened (dates), tickets and film stock, workshop operations, market sales and bids, wishlist, folders, followed collections, showcase, badges, notifications | Your activity |
| Push notifications (only if you turn them on) | For each subscribed device: subscription address assigned by your browser's push service and the associated encryption keys, language, browser used, subscription and last delivery dates; wishlist cards for which an auction alert was sent to you (to avoid duplicates) | Your browser, at your request |
| Social | Friends, private messages, trades and attached note, profile bio, invitation codes created and the username of whoever used them | You and other players |
| Moderation | Reports you file or that concern you, suspensions, decision log | You, other players, administrators |
| Removal requests (no account) | Name, email address, organisation, capacity, content concerned, description | The requester |
| Deleted account | Former username, creation and deletion dates | Generated on deletion |
What the application does not collect: players' email address, real name, date of birth, phone number, payment data, location. The application does not store your IP address in clear: only a hash, used to limit login and sign-up attempts, is kept for 2 hours at most. The hosting provider does keep technical connection logs (IP address, date, page requested) to secure its infrastructure.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR, art. 6) |
|---|---|
| Creating and managing your account, running the game, trades, market and messaging | Performance of the contract (the Terms you accept) |
| Security, prevention of cheating and abuse, moderation of reported content | Legitimate interest of the publisher and players in a safe and fair game |
| Handling removal requests and reports, giving reasons for decisions | Legal obligations (French LCEN, EU Digital Services Act) and legitimate interest |
| Keeping a record of deleted accounts to answer judicial requests | Legal obligation (French decree no. 2021-1362) |
| Proving acceptance of the Terms and the age statement | Legitimate interest |
| Sending push notifications to your devices | Consent: explicit opt-in, device by device, which you can withdraw at any time from My account or your browser settings |
No automated decision producing legal effects is taken about you. No advertising profiling takes place.
4. Retention periods
| Data | Period |
|---|---|
| Account and game data | As long as the account exists. An account with no login for 3 years may be deleted, after a warning shown in the game. |
| Login session | 30 days at most (or until logout) |
| IP address hash (attempt limiting) | 2 hours at most |
| Push notification subscription | Until you turn it off, log out of the device or the session expires (30 days at most), or as soon as the push service reports it expired |
| “Wishlist card up for auction” alerts sent | 2 days |
| Read notifications | 6 months |
| Private messages | As long as the author's account exists; on deletion, their content is replaced by a neutral notice |
| Player reports | 1 year after closure |
| Removal requests and moderation log | 3 years after the decision (evidence in case of dispute) |
| Record of a deleted account | 1 year after deletion, then erased |
| Hosting provider technical logs | According to the hosting provider's policy |
5. Recipients
- Other players see your username, bio, showcase, badges and market listings; your friends also see your collection; your messages are only visible to their recipient.
- The publisher and administrators of the game, for operation and moderation.
- Technical processors: the website host (Vercel Inc.) and the database host (Supabase Inc. (base de données hébergée dans l'Union européenne, à Paris, région eu-west-3)), bound by confidentiality commitments.
- TMDB: posters and photos are loaded directly from The Movie Database's servers by your browser, which therefore sends them, as with any third-party image, your IP address and technical information about your browser. See TMDB's privacy policy.
- Browser push services, if you turn on push notifications: Google (Chrome, Android), Mozilla (Firefox), Apple (Safari, iPhone, iPad) or Microsoft (Edge), depending on your browser. They deliver the notification to your device; its content is end-to-end encrypted (Web Push standard) and cannot be read by them.
- Administrative or judicial authorities, only upon a lawful request.
6. Transfers outside the European Union
Some providers (notably the website host and TMDB) are based in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
8. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to give instructions on what happens to your data after your death.
- Self-service, from My account: download all your data (JSON file) and delete your account. Your bio can be edited from your profile.
- In writing, for any other request: contact@cinedextcg.com. You will receive an answer within one month. As no email address is linked to accounts, you may be asked to prove that you own the account (for example by sending a message from within the game).
- You may lodge a complaint with the French data protection authority, the CNIL, or with the authority of your country of residence.
9. What happens when you delete your account
- Your account is anonymised: your username is replaced by "Joueur supprimé" (deleted player) followed by a code, your password and bio are erased, your sessions are closed.
- Your cards leave circulation (like recycling); the history of cards traded or sold to other players stays consistent but no longer identifies you.
- Your pending trades are cancelled and your listings without bids are withdrawn. If you are leading an auction or one of your sales has a bid, deletion is possible once they close.
- The content of messages you sent is replaced by a neutral notice.
- Your friends, folders, wishlist, followed collections, notifications, push notification subscriptions, workshop log and acceptances are erased.
- Only a minimal record (former username, dates) is kept for one year, to answer any judicial request, then erased.
10. Security
Passwords are stored as salted hashes (scrypt); session tokens are only stored as hashes; the site is served over HTTPS; access to administration is restricted to a few designated accounts.
11. Minors
The game is restricted to people aged 15 or over (the age from which a minor can consent alone to the processing of their data in France). If you learn that a younger child has registered, write to contact@cinedextcg.com: the account will be deleted.
12. Changes
This policy may change as the game evolves. Any significant change is announced in the game.