Personal data (GDPR)

This page describes how PC Bang Simulator processes your personal data, in accordance with the General Data Protection Regulation (GDPR) and the French loi Informatique et Libertés. Last updated: August 2026.

1. Data controller

The game is published by Nicolas Wallet (director of publication), as a personal entertainment project, with no commercial purpose — see the legal notice (article 9 of the Terms of Use) for his full status and the host’s details. For any request concerning your data, write to contact@pcbang.app, or use the Feedback button in the menu (category “other”) if you are logged in.

2. Data collected

Only the data needed for the game to work:

— Account: e-mail address (login identifier), password stored exclusively in hashed form — never in clear text — and the proof that the Terms were accepted (date and version number accepted), kept in order to establish which text you agreed to.
— Guest account: the “Play as guest” mode opens an account without you entering anything. It then carries a filler address generated by the server, on a domain that cannot receive any mail and that is never shown to you; the other data (game, public profile, preferences) is the same as for a regular account. If you later add an address and a password (Account panel), it becomes an account like any other.
— Newsletter: if — and only if — you tick the corresponding box, the date of your consent and where you gave it (sign-up or Account panel), in order to establish when and how you agreed. A refusal leaves no trace, and unsubscribing erases this one.
— Public profile: the name of your PC Bang (unique, visible to everyone in leaderboards, visits and guestbooks) and the avatar you chose.
— Game: the state of your establishment (items, finances, employees, objectives, transaction history), interface preferences (language, graphics, audio…).
— Contributions: reviews left in guestbooks and messages sent through Feedback (with optional technical context: page and browser).
— Technical logs: operating and security logs of the service (timestamp, action), including, for requests that are blocked or deemed suspicious (rate limit exceeded, inconsistent attempt), the IP address the request came from. Used only to keep the service running and to protect it against abuse.

3. Cookies and local storage

A single session cookie, strictly necessary for authentication, keeps you logged in; it remains valid for 30 days after you log in, or until you log out. This type of tracker is exempt from consent under the CNIL (guidelines on “cookies and other trackers”, deliberation no. 2020-091 of 17 September 2020, article 5): it only authenticates you, nothing more. The browser’s local storage likewise holds your preferences (consent, acceptance of the Terms, display settings) — also exempt, the CNIL placing interface personalisation in the same list. No advertising trackers, no third-party cookies, no external audience measurement.

4. Purposes and legal basis

This data is used exclusively to: create and secure your account, save and display your game, run the social features (leaderboards, visits, guestbook), handle your feedback and keep the game fair. The legal basis is performance of the contract (the Terms you accept) and the legitimate interest in protecting the service — it is this second basis that covers the logging of blocked or suspicious requests (§2), IP address included, necessary to spot abuse (cheating, spam, abnormal login attempts). No data is sold, passed on to third parties for commercial purposes, or used for advertising or profiling.

5. E-mails

Two categories of messages, which never mix:

— Service messages (login link, password reset): they answer a request you have just made. They fall under performance of the contract and cannot be declined — without them, the corresponding features would not exist. No service message is sent unless you triggered it.
— Newsletter (news, in-game events): sent only if you ticked the dedicated box, at sign-up or in the Account panel. The legal basis is your consent, which you can withdraw at any time in a single click — in the Account panel, or through the unsubscribe link present in every newsletter, which works without being logged in and never expires. No justification to give, no consequence for your game. A withdrawal applies to the future only: it does not call into question the messages already sent.

Delivery is handled by Scaleway SAS (8 rue de la Ville l’Évêque, 75008 Paris), a processor within the meaning of article 28 of the GDPR, on servers located in the European Union. It receives your address and the content of the message in order to hand them to your mail provider, and for nothing else.

6. Retention periods

Your data is kept for as long as your account is active. Deleting your account is requested from the Account panel and happens in three steps: your request erases nothing and sends a confirmation link to your address; opening that link schedules the erasure fourteen days later, without carrying it out; at the deadline, your personal data, your game and your reviews are permanently erased. The confirmation link is valid for fifteen minutes and can only be used once.

During those fourteen days your account stays fully usable and you may change your mind at any time: a permanent banner shows the erasure date and carries the “Cancel deletion” button. Logging back in does not cancel anything by itself — only that button does, so that nobody re-arms their account without knowing while coming back one last time to export their data. After the date, the erasure is irreversible.

A guest account is the one exception, and it works in your favour: its address is a filler address that cannot receive any mail, so no confirmation link could ever reach it. Its deletion is therefore immediate, with no confirmation and no delay. A guest account — without an address or a password — is also deleted automatically, along with its venue, thirty days after the last session played. It is the date of the last session that counts, never the date it was opened: as long as you play, nothing is erased. Creating your account (Options → Account) ends this deadline and keeps everything you have built.

Expired sessions and your establishment’s activity log are purged automatically every day (30 days of history for the latter). Tokens sent by e-mail (login link, password reset, deletion confirmation) expire after fifteen minutes and are deleted within the following 24 hours; messages sent successfully are purged thirty days after being sent. The log that records blocked or suspicious requests (§2), IP address included, is purged after one year — including entries that are not attached to any account, such as an abuse attempt that occurred before any sign-up. It also disappears, sooner, along with the account it is attached to.

One deliberate exception: a message that could never be delivered (invalid address, prolonged outage at the provider) escapes the thirty-day purge, which applies only to messages that actually went out. That record is the only thing that explains why a player received nothing; it is kept on that basis.

7. Your rights

You have the rights of access, rectification, erasure, portability, restriction and objection. The Account panel lets you directly: export in one click the data of your account and your establishment (profile, game, items, transactions, employees, objectives — JSON format; for the rest, for example your guestbook reviews or your Feedback messages, a request through the Feedback button or a message to contact@pcbang.app is enough), change your e-mail address, your password, your name and your avatar, subscribe to or unsubscribe from the newsletter in a single click, and request the deletion of your account — effective fourteen days after you confirm it through the link you receive, and cancellable until then (§6). You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr/fr/plaintes), if you consider that your rights are not being respected.

8. Hosting and security

The data is hosted by OVH SAS (2 rue Kellermann, 59100 Roubaix, France), on a server located in France, and backed up regularly. No data is transferred outside the European Union — neither at the host, nor at the e-mail processor (§5). Appropriate technical and organisational measures protect your data (encrypted exchanges, hashed passwords, restricted access to the game’s administration).