Privacy Policy
Last updated: July 2, 2026. This is a courtesy translation; in case of discrepancy, the French version prevails.
This page explains, in plain language, what data RugbyPop collects, why, how long it is kept, and what your rights are (GDPR).
1. Who is responsible?
The data controller is POSITION ZERO (SASU),
3 Rue du Col de l'Ouillat, 66680 Canohès, France, SIRET 942 384 777 00010,
represented by Charles Albisson.
Data protection contact: charles@position-zero.fr.
2. What data, and why?
| Data | When | Legal basis |
|---|---|---|
| Email, username, password (hashed with bcrypt, never stored in plain text) | Sign-up (with your consent, given via the Terms checkbox) | Performance of the contract (Terms) |
| Predictions, points, badges, rankings, leagues | Playing the game | Performance of the contract |
| IP address and browser (user-agent) | Login, session security, anti-fraud, server logs | Legitimate interest |
| Email consent (opt-in) | Optional checkbox at sign-up | Consent (withdrawable at any time) |
| Push notification subscription | Only if you enable them (strict opt-in) | Consent |
No banking data is collected: the service is entirely free. No data is ever sold to third parties.
3. What is it used for?
- Running the game: account, predictions, rankings, leagues, rewards.
- Security and cheat prevention (sessions, rate limiting, logs).
- Notifying you (results, match reminders), only if you enabled notifications.
- Aggregated, anonymous usage statistics.
4. Who can access it?
- o2switch (Clermont-Ferrand, France): hosting of the site and database - your data stays in France.
- Google (Google Ireland Ltd): only if you choose to sign in with your Google account. We then receive your email address, name and profile picture; never your password or the content of your Google account, and we never post on your behalf.
- Brevo (Sendinblue SAS, Paris, France): sending emails (sign-up, password reset, round reminders and summaries if you accepted them). Brevo receives your email address and username, nothing else.
- Ollama (Ollama Inc., United States): artificial intelligence provider. The mascot "Riton" analyses matches, never players. Messages sent through the "Send feedback" button are passed to it to be sorted automatically, without your username, email address or IP: please do not include personal data in them.
5. How long?
- Account: while active, then deleted 3 years after your last login.
- Sessions (IP, user-agent): 30 days maximum, purged automatically every day.
- Technical server logs: 12 months maximum.
- Opt-in emails: until you withdraw consent (unsubscribe link in every email).
6. Your rights
You may at any time request access to your data, its rectification, erasure or portability, ask for restriction, object to a processing operation, or withdraw consent: write to charles@position-zero.fr (answer within 30 days). You may also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).
7. Cookies
RugbyPop uses one single cookie, strictly technical (session authentication, 30 days), exempt from consent requirements. No advertising cookies, no third-party trackers, no third-party analytics.
8. Security
Hashed passwords (bcrypt), encrypted connections (HTTPS/TLS), httpOnly/secure cookies, hashed session tokens, automatic login rate limiting, automatic purge of session data.
9. Minors
Sign-up is restricted to people aged 18 or over (see the Terms of Use and the game rules).