Ko'llection

Legal

Last updated

Definitions

Ko'llection: the web application at app.kollection.gg, and the service it provides.

Collector: any person with a Ko'llection account.

Collection: the games a Collector records in Ko'llection, each as an Entry (its platform, format, status and the other details the Collector sets).

Feedback: a message a Collector sends from Ko'llection about the application, with the details shown before it is sent.

Personal Data: any information relating to an identified or identifiable natural person, as defined by Article 4 of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). The terms "processing," "controller," and "processor" have the meanings the GDPR gives them.

1. About Ko'llection

Pursuant to Article 6 of French Law No. 2004-575 of 21 June 2004 (the Loi pour la Confiance dans l'Économie Numérique, "LCEN"), users of Ko'llection are informed of the identity of the parties involved in its creation and maintenance:

Publisher: Jérémie Le Corre, as part of Edokko

Publication Manager: Jérémie Le Corre

Contact: j.lecorre@edokko.design

Host: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States, +1 559 288 7060

2. Terms of Use

Using Ko'llection implies full acceptance of these terms. They may be modified at any time; the date at the top of this page says when they last changed, and Collectors are invited to read them again from time to time.

Ko'llection is normally available at all times. Access may nonetheless be interrupted, for maintenance or for reasons beyond the Publisher's control, without notice and without any right to compensation.

3. Description of the Service

Ko'llection is a free application for keeping track of a video game collection: the games a Collector owns, on which platforms and in which formats, and how far they have played them.

Ko'llection is a personal project of the Publisher. Its features may change, and the Publisher strives to keep the information it shows accurate without guaranteeing it.

4. Your Account

Anyone can create a Ko'llection account, with an email address and a password. The account opens once the address is confirmed, by a link sent to it, valid for 24 hours. An account whose address is never confirmed is deleted after 7 days.

A Collector signs in with their address and their password. A forgotten password is replaced through a link sent to the address, valid for one hour and usable once. Whoever can read the mailbox can therefore take over the account, and the Collector is responsible for keeping their password and access to their mailbox to themselves.

A Collector can delete their account at any time, from Settings, under Account, by confirming their password. The account is then signed out everywhere and hidden for 30 days. Signing in during those 30 days offers to keep it, which cancels the deletion. After 30 days the account and its Collection are deleted for good, with no way of recovering them. Two emails say so: one at once, one 3 days before the deletion. Feedback already sent is kept until its 24 months are over (7.5), detached from the account.

The Publisher may suspend or delete an account used against these terms or the law, or in a way that harms the service or other Collectors.

5. Intellectual Property

The Publisher holds the rights to Ko'llection: its code, design, text and logo. Reproducing or reusing all or part of them without the Publisher's prior written authorization is prohibited, and may be prosecuted as infringement under Articles L.335-2 et seq. of the French Intellectual Property Code.

5.1 Game Data

Game data and covers from IGDB. Game titles, covers and the other game data remain the property of their respective owners.

5.2 Your Content

A Collector's Collection and Feedback remain theirs. By sending Feedback, a Collector allows the Publisher to use it to fix and improve Ko'llection.

6. Limitation of Liability

Ko'llection is provided as is. The Publisher cannot be held liable for an interruption of the service, a bug, an inaccuracy in game data, or the loss of data, nor for direct or indirect damage to a user's equipment resulting from the use of Ko'llection.

Users agree to access Ko'llection with up-to-date equipment and browser.

7. Personal Data

7.1 Controller

The controller of the Personal Data processed by Ko'llection is Jérémie Le Corre, who can be reached at the contact address above for any question about this section.

7.2 What Ko'llection Keeps, and Why

  • Your email address, to identify your account, sign you in and send the emails the service needs (confirming your address, a new password, address changes, the deletion of your account). Legal basis: the performance of the service you asked for (GDPR Article 6(1)(b)). Without it, there is no account.
  • Your password, kept only as a hash: a one-way transformation from which the password cannot be read back. Nobody, the Publisher included, can see it. When you choose a password, the first five characters of another hash of it (SHA-1) are sent to Have I Been Pwned, to refuse a password known from a data leak. Neither your password nor your address is sent. Same legal basis.
  • Your Collection, which is the service itself. Same legal basis. All Collections are also counted together, as totals only (how many Entries, the most-owned Platforms and Games, the share of each Format and Status), for the Publisher to see how Ko'llection is used. No figure shows one person's Collection. Legal basis: the Publisher's legitimate interest in understanding how Ko'llection is used, to improve it (GDPR Article 6(1)(f)).
  • Your language: English or French, set to the language the page was in when you sign up (or at your next sign-in, for an account created before Ko'llection spoke French), and changed in Preferences, to show Ko'llection and write its emails in your language. Same legal basis.
  • What you set and reach in Ko'llection: the animations you turn on or off in Preferences, the Achievements you reach and the day you reach each, when you last opened the Achievements page, and the day your address was confirmed, which your anniversaries count from. Same legal basis.
  • Your sessions: each signed-in browser is recorded with the token its cookie holds, the account it opens and its dates. A session lasts 30 days, renewed each time you come back. Same legal basis.
  • Your Feedback: the message you write, with the details shown to you before you send it (the page, the screen width, the device, the theme, the browser), the version of Ko'llection, with the commit it was built from, and, while it exists, your account. Legal basis: the Publisher's legitimate interest in fixing and improving Ko'llection (GDPR Article 6(1)(f)). Sending Feedback is optional.
  • Protection against abuse: to limit how often the forms can be used (signing in, and those that send an email), Ko'llection counts the requests from each network (its IP address), for each email address and, for some actions such as sending Feedback, for each account, for a day at most. Each count is stored under a hash made with a secret key. Legal basis: the Publisher's legitimate interest in protecting Collectors and the service (GDPR Article 6(1)(f)).
  • Audience measurement: how Ko'llection is used, measured with Umami, an open-source tool run by the Publisher. It records the pages you view (their address without anything after it, so never what you search for or your filters, except the tags a link shared by the Publisher may carry to say where it was posted, such as "utm_source=discord"), where you came from, your device, browser, screen size and language, your approximate location (country, region and city), and the actions you take in Ko'llection, never what you type. Your IP address is used only for a moment, to work out that location and an anonymous visit identifier through one-way hashing with a secret that changes regularly, and is never kept. Nothing ties this data to your account or your email address. Legal basis: the Publisher's legitimate interest in understanding how Ko'llection is used, to improve it (GDPR Article 6(1)(f)). You can opt out, as described in 9.2.

Ko'llection uses no advertising and no tracking beyond the audience measurement above, makes no automated decision about you, and does not profile you. Nothing is sold or shared beyond the processors below.

7.3 Recipients and Processors

Personal Data is only accessed by the Publisher and by the processors that run Ko'llection, each for its own part:

  • Vercel Inc. (United States), the host, which serves Ko'llection and therefore processes the technical data of each request, such as the IP address and the browser. Its logs of those requests are kept for one hour.
  • Neon, which stores the data in a database located in the European Union.
  • Resend (United States), through which the emails are sent; it processes your email address and the content of those emails, and keeps a log of each email for 30 days (the email warning of an address change names the device it was asked from).
  • Umami, the audience measurement software, is not a company: it is run by the Publisher, served by Vercel and storing its data with Neon in the European Union. Its data goes to no one else.

Game covers are loaded by your browser directly from IGDB's image servers (IGDB is owned by Twitch, in the United States), which therefore receive your IP address when a cover is shown. No other data about you is sent to IGDB.

7.4 Transfers Outside the European Union

Vercel and Resend are based in the United States. Both are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognizes as ensuring an adequate level of protection; Vercel also relies on the European Commission's Standard Contractual Clauses. Their data processing agreements are published on their websites.

7.5 How Long Data Is Kept

Your account, your password's hash, your language, your Preferences, your Collection and your Achievements are kept as long as your account exists. When you delete your account, your sessions end at once; the rest is kept 30 more days, hidden, in case you change your mind, then deleted for good. An account whose address was never confirmed is deleted after 7 days.

A session ends 30 days after your last visit, and is then deleted. The link confirming an address expires after 24 hours, and the link to choose a new password after one hour; each is deleted once expired, and the record that a link was already used, after 30 days. The request counts that protect the forms are deleted within two days. An email Resend could not send because of its daily limit waits until the next morning, then is sent and deleted.

Your Feedback is kept for 24 months after you send it, then deleted. If you delete your account before then, it is detached from it, and only the message and the details sent with it remain.

Audience measurement data is kept for 24 months, then deleted. Vercel's request logs and Resend's email logs are kept for the periods given in 7.3.

7.6 Your Rights

In accordance with the GDPR and the French Loi Informatique et Libertés, you have the right to access your Personal Data (Article 15), to have it corrected (Article 16) or erased (Article 17), to restrict its processing (Article 18), to receive it in a portable format (Article 20), to object to processing based on legitimate interest (Article 21), and to give instructions about what happens to it after your death.

You can erase your data yourself by deleting your account (section 4). To exercise the other rights, write to the contact address above from the address of your account. If you believe your rights are not respected, you may lodge a complaint with the CNIL, the French data protection authority (https://www.cnil.fr/en/).

8. Security and Incidents

Ko'llection is served over an encrypted connection (HTTPS). Passwords are kept only as hashes, and a password known from a data leak is refused. The links sent by email expire, and the link to choose a new password works once. Access to the data is limited to the Publisher and the processors above.

No method of transmission or storage is completely secure. Should a breach affecting Personal Data occur, the Publisher would notify the affected Collectors, and the CNIL where the law requires it, as soon as possible, with the measures taken.

Ko'llection contains links to other websites, such as IGDB and Edokko. The Publisher has no control over their content and assumes no liability for it; once there, you are subject to their own terms and privacy policies.

9.2 Two Cookies

Ko'llection sets two cookies. The first keeps you signed in for 30 days, renewed each time you come back: without it, you would sign in on every page. The second keeps, for a year, the language of the pages you see before signing in: the one you pick there, or your account's once you have signed in. It holds nothing else. Both are needed for the service you ask for, so they need no consent. Audience measurement (7.2) sets no cookie, and there is no advertising, so there is no cookie banner either.

You can opt out of audience measurement by adding ?notrack to the address of any Ko'llection page: your browser remembers it, on your device only, until you visit ?track. If your browser asks sites not to track you (Do Not Track), no audience measurement happens at all.

10. Governing Law and Jurisdiction

These terms are governed by French law. Any dispute relating to the use of Ko'llection falls under the jurisdiction of the competent French courts.