Privacy policy

Data we use

We process your Discord identifier and username from OAuth sign-in (identify and guilds scopes) and, if linked, your Sorare identifier, username, and OAuth access and refresh tokens. These tokens are stored in the database without application-level encryption; they are not exposed to the browser. We retain your alerts, sent notification history, language and channel preferences, your email address if you enable email notifications, and web push subscriptions. Stripe processes your payment details and card; we do not store card numbers. To prevent repeated trials, we store the card fingerprint supplied by Stripe, without the card number. We retain Stripe customer and subscription identifiers, plan and dates, the Discord role assigned to subscribers, plus technical server logs. For the Discord bot we count each command used (command name, server or direct message, language, date), tied to a pseudonymous key computed from your Discord identifier with a secret we keep (the identifier itself is not stored in this counter). For audience measurement we record the address of the visited page and of the previous page, the browser language, the screen size, the type of browser, device and system, and a country, region and city derived from your IP address; the IP address itself is not stored.

Purposes and legal bases

Performance of our contract covers account management, alerts, notifications and subscriptions. Legal obligations require us to keep accounting records for 10 years. Our legitimate interest supports technical logs, security measures and retaining the card fingerprint to prevent trial abuse. Our legitimate interest also supports audience measurement, which only tells us which pages are read so we can improve the site: it uses no cookie or persistent identifier, does not cross-reference its data with anything else and does not follow people from one site to another.

Recipients and transfers

Scaleway hosts the service in Amsterdam, in the European Union; audience measurement (Umami) is self-hosted there with the rest of the service: no third-party analytics service receives this data. Amazon Web Services holds encrypted backups in its Paris region (eu-west-3). Stripe processes payments; Discord provides sign-in, role assignment and direct messages. Stripe and Discord may transfer data outside the EU, including to the United States, under standard contractual clauses or the Data Privacy Framework according to the recipient. Sorare supplies public market data and, optionally, account sign-in. Push notifications pass through browser push services, including Google, Mozilla and Apple. Push notifications to the iOS app pass through Apple Push Notification service (see "iOS app"); To deliver them, Apple receives the device token and the alert content; see "iOS app". Email is delivered by Scaleway SAS (Transactional Email service, hosted in the European Union). Functional Software, Inc. (Sentry, data hosted in the European Union, in Frankfurt) diagnoses technical errors using minimized data: no cookies, email addresses, or tokens. Any access from the United States, Sentry being a US company, is covered by the Data Privacy Framework and standard contractual clauses.

iOS app

The Sorare Alert iOS app (com.sorarealert.app) uses the same account and the same data as the website. In the app you sign in with Sorare only; Discord sign-in is not offered there. The app contains no payment, no advertising and no analytics or tracking SDK, and it does not ask for permission to track you. Push notifications on iOS are available only once they are enabled, in the app and on our servers; this section describes how they work from that moment and promises no date. Once enabled, the app asks iOS for your permission, then registers your device with our server whenever the app is launched and whenever iOS issues a new token. For each device we store: the Apple Push Notification service (APNs) device token, an internal device identifier, the account and the app session it belongs to, the platform (iOS), the APNs environment (sandbox or production), the app version, the language of the app, and the dates of first registration, last registration and revocation. The legal basis is the performance of our contract: this data is what lets us deliver the alerts you configured to your phone. Registration is refused when the account already has 10 other devices that are not revoked, whose app session is still valid and that were seen in the last 180 days; devices that do not meet these conditions do not count towards the 10. Push notifications are delivered through Apple's Apple Push Notification service. To deliver them, Apple receives the push token of your device and the content of the notification (the text of the alert). For users in the European Economic Area, the United Kingdom and Switzerland, Apple states that the processing of personal data is the responsibility of Apple Distribution International Limited (Ireland) and that its transfers to Apple Inc. (United States) are governed by Standard Contractual Clauses. Apple's processing is governed by Apple's own privacy policy: https://www.apple.com/legal/privacy/en-ww/. Pushes stop for a device when its app session is revoked or expires, when you sign out of all sessions, or when your account is pending deletion. When you sign out, the app first asks our server to unregister the device, then revokes the app session; both requests are made on a best-effort basis and can fail, for example if you are offline. If the unregistration succeeds, the device is marked as revoked and receives no more pushes. If it fails, pushes stop when the session is revoked or expires, and you can also end that session from the mobile sessions in your settings. A push already accepted by Apple may still reach the phone for up to 5 minutes. A revoked device keeps its row, token included, until your account is erased, at the end of the 30-day grace period after your deletion request (a few steps of the erasure, such as cancelling a subscription, can delay it); the same token can be registered again by the app. We keep it because the row marks the device as no longer usable; you can ask us to delete it earlier using the contact below. If Apple reports that a token is no longer valid, the device is marked as revoked in the same way. Erasing your account deletes all your device records from our live database; copies already included in the encrypted backups of that database are not rewritten and disappear only when the backup that contains them expires and is deleted. Your rights described below apply to this data. Turning off notifications in iOS settings stops the display of alerts on your phone but does not delete anything on our servers.

Cookies and local storage

One strictly necessary httpOnly session cookie lasts 30 days; it does not require a consent banner. Your browser also stores theme and language in localStorage. Our audience measurement uses no cookie and writes nothing to your browser. It honours the Do Not Track signal: if you have turned it on, your visit is not counted. We use no advertising trackers.

Retention and deletion

Account data remains while the account is active. You may request deletion; a 30-day grace period precedes erasure, subject to legal retention duties, notably accounting records. Trial card fingerprints are retained without a link to the account for 12 months after its deletion. Technical logs are retained for at most 30 days. The Discord bot's command counter is kept for at most 90 days, then deleted; it is erased with your account and included in your data export. If you use the bot without a site account, you can ask for its erasure through the contact below. The data of the iOS app follows the rules described under "iOS app". Audience measurement data is retained for at most 13 months in the live database, then up to 120 days longer in encrypted backups; the visit identifier is an irreversible hash that changes every day, so the same person cannot be recognised from one day to the next. You can request deletion from the Settings page, or by writing to the address given in the legal notice.

Your rights

Under the GDPR you may request access, rectification, erasure and portability, object to processing, or request its restriction, where applicable. You may set instructions for the retention, deletion and disclosure of your data after death (Article 85 of the French Data Protection Act). Use the contact below to exercise these rights. You may also complain to the French data protection authority, CNIL (cnil.fr).

Medição de audiência

Medimos a audiência com uma ferramenta hospedada por nós (Umami), sem cookies e sem armazenar nada no seu navegador. Registramos a página visitada e a anterior, o idioma, o tamanho da tela, o tipo de navegador, dispositivo e sistema, e um país, uma região e uma cidade deduzidos do seu endereço IP, que não é armazenado. O sinal «Do Not Track» do navegador é respeitado. Os dados são mantidos no máximo 13 meses na base ativa e até 120 dias a mais em backups criptografados; nenhum serviço de análise de terceiros os recebe.

Contato