Privacy policy
Wikollect is a collectible card game built from Wikipedia articles. This page explains which data the game uses, why, for how long, and how to exercise your rights. Wikollect has no ads, no advertising trackers, and never sells data.
Controller
Théo Germain — contact: germain.app.supp@gmail.com.
Data we use
| Data | Why | Retention |
|---|---|---|
| Player ID, nickname, card language | Running your account and your game | As long as the account exists; inactive guest accounts are deleted after 180 days |
| Linked Apple or Google account: technical identifier, email address if the provider shares it | Finding your account on another phone | As long as the account exists |
| Apple access token (encrypted) | Revoking Wikollect’s access to your Apple account when you delete your account | As long as the account exists |
| Device key (App Attest on iPhone, Keystore on Android, with the system verification state) and sign-in sessions | Checking that requests come from the genuine app, preventing cheating and account theft | Sessions: 180 days at most; unused keys: 30 days |
| Location when opening a pack at a landmark or trading face to face | Checking that you are actually there, or next to the other player | Only the latest location is kept, replaced at each new check; the one attached to a trade QR code is deleted a few minutes later |
| Collection, opened packs, trades, visited landmarks, ink, market listings and bids, duels, friends, showcase, achievements, leaderboards | The game itself | As long as the account exists; pack details, closed trades and notifications: 90 days |
| In-app purchases: Apple transaction ID or Google Play order number and purchase token, product, date | Crediting purchased ink exactly once, handling refunds | As long as the account exists |
| Device notification token | Notifying you (outbid, sale, challenge…), if you allowed it | Until you sign out or uninstall |
Wikollect never receives your payment details: purchases are processed by Apple or Google. Your nickname, showcase, stats and rank are visible to other players; your location never is.
Legal bases
- Performance of a contract (the game’s terms): account, game, purchases, trades, market.
- Legitimate interest: security, fighting cheating and abuse (device checks, limits).
- Consent: location (requested by the phone, only for landmarks and trades) and notifications. You can withdraw it at any time in the phone settings.
Recipients and processors
- Server and database hosting, in the European Union.
- Apple: Sign in with Apple, device checks (App Attest), notifications, purchases (App Store).
- Google: Sign in with Google, if you choose it; on Android, device checks (key attestation), notifications (Firebase Cloud Messaging) and purchases (Google Play).
- Wikimedia: the app loads articles and images directly from Wikipedia and Wikimedia Commons, which then see your IP address, as with any visit to Wikipedia.
No data is sold or shared for advertising.
Your rights and account deletion
You can access, correct or delete your data, object to processing or request portability by writing to germain.app.supp@gmail.com. You can also delete your account and all its data yourself in the app: My account › Delete my account. You may lodge a complaint with the French data protection authority (CNIL) or your local authority.
Age
Wikollect is not intended for children under 13.
Changes
If anything important changes, the date at the top of this page is updated and the app lets you know.