who is responsible
The data controller is LORET Pierre, 3 allée Maudy Piot, 44200 Nantes, France (SIRET 89058605000035). Contact for anything about your data: loretpierre@gmail.com.
without an account
If you play on the website without signing in, your progress (your dailies, your finished runs, your best scores) stays in your browser's local storage. To know how many people play, and where, your browser also sends the server a random number made on your device, whether you play in a regular window, a private window or one of the apps, your answers to today's daily and your finished runs. Nothing that says who you are: no name, no address, no account. If you later sign in, your dailies and runs move to your account, and the number is erased from the server and the browser.
with an account
Depending on how you sign in, Sounday keeps:
- Discord: your user id, display name and avatar.
- Google: your account id, first name, profile picture and email address.
- Apple, in the iPhone app: your Apple account id, and the name and email address you choose to share (Apple can hide your real address behind a relay address).
- Email link: your email address. If you change it in the settings, the new one replaces the old one once you confirm it from the link sent to it.
- Your results: each answer of each daily and each finished run, with its date and exercise, to show your history and stats.
- A session cookie (
sd), needed to keep you signed in. It lasts one year or until you sign out. It is not used for anything else. While you sign in, a few more cookies, which last 10 minutes, protect the sign in itself.
in discord
In the Discord Activity, Sounday receives from Discord your user id, display name and avatar, and the channel and Activity session you play from, to post your card and the daily recap in that channel. Your results are stored in the account linked to your Discord.
in the apps
The iPhone and Android apps show the website. For their widget, they also keep on your phone the number and machines of today's daily, your streak, your shield and whether you played. This stays on the phone.
The evening reminder: once you finish a first daily in the app and allow notifications, the app sends the server a device number (on iPhone, the notification token Apple gives the app; on Android, a random number made by the app), your time zone, and your account, or the random number of a player without an account. At 6 pm your time, the server looks at your dailies to choose the reminder, or none if you already played today. On iPhone, Apple's notification service delivers it; on Android, the app asks the server for it and shows it itself, with no Google service.
The Android app is not on the Play Store: when you open it, it asks this site whether a new version exists and downloads it from here. Nothing about you is sent with it.
server logs
Like any website, the web server records technical logs (IP address, page requested, date). They are used for security only and deleted after 14 days.
what sounday does not do
No advertising, no third-party analytics, no tracking cookies, no data sold or shared for marketing. Fonts are served by Sounday itself.
why
Your account data and results are used to provide the service you asked for (performance of the contract). Server logs are kept for the security of the service, and the random number of a player without an account to measure how the service is used (legitimate interest). The device number is used only for the reminder you allowed (consent): turning off Sounday's notifications in your phone's settings stops it.
who else sees it
- OVH SAS (2 rue Kellermann, 59100 Roubaix, France): hosting, in France.
- Resend: sends the sign in emails. Your email address passes through its servers, in the United States, under the European Commission's standard contractual clauses.
- Discord, Google and Apple, only if you choose to sign in with them or play in Discord, under their own privacy policies. Avatars are loaded from their servers.
- Apple's notification service, in the iPhone app: it receives the device token and the text of the reminder, to deliver it.
how long
Your account and results are kept as long as the account exists. The random number of a player without an account, and what it played, is erased after 13 months without a visit. A phone's device number is erased when you delete your account, when Apple says the app was removed from an iPhone, or after 13 months without news from the app. Sign in links expire after 15 minutes. A way to sign in that you unlink is erased at once. Deleting your account from the settings erases it at once; if you ask by email, everything is deleted within 30 days.
your rights
In the settings, you can yourself change your email address, unlink a way to sign in, and delete your account and all its data, at once. You can also access, correct, export or delete your data, object to its use, or limit it, by writing to loretpierre@gmail.com. Without an account, clearing this site's data in your browser stops the random number. You can also file a complaint with the CNIL (cnil.fr), the French data protection authority.
age
Sounday is open to everyone, but signing in requires being at least 15, or having a parent's consent, in line with French law. Discord, Google and Apple have their own minimum ages.