Personal data (GDPR)

This page describes how PC Bang Simulator processes your personal data, in accordance with the General Data Protection Regulation (GDPR) and the French loi Informatique et Libertés. Last updated: October 2026.

1. Data controller

The game is published by Nicolas Wallet (director of publication), as a personal entertainment project, with no commercial purpose — see the legal notice (article 9 of the Terms of Use) for his full status and the host’s details. For any request concerning your data, write to contact@pcbang.app, or use the Feedback button in the menu (category “other”) if you are logged in.

2. Data collected

Only the data needed for the game to work:

— Account: e-mail address (login identifier), password stored exclusively in hashed form — never in clear text — and the proof that the Terms were accepted (date and version number accepted), kept in order to establish which text you agreed to. A personal e-mail address is required for a regular account; it is not required for the “Play as guest” mode, described below.
— Guest account: the “Play as guest” mode opens an account without you entering anything. It then carries a filler address generated by the server, on a domain that cannot receive any mail and that is never shown to you; the other data (game, public profile, preferences) is the same as for a regular account. If you later add an address and a password (Account panel), it becomes an account like any other.
— Newsletter: if — and only if — you tick the corresponding box, the date of your consent and where you gave it (sign-up or Account panel), in order to establish when and how you agreed. A refusal leaves no trace, and unsubscribing erases this one.
— Public profile: the name of your PC Bang (unique, visible to everyone in leaderboards, visits and guestbooks) and the avatar you chose.
— Game: the state of your establishment (items, finances, employees, objectives, transaction history), interface preferences (language, graphics, audio…).
— Contributions: reviews left in guestbooks and messages sent through Feedback (with optional technical context: page and browser).
— Technical logs: operating and security logs of the service (timestamp, action), including, for requests that are blocked or deemed suspicious (rate limit exceeded, inconsistent attempt), the IP address the request came from. Used only to keep the service running and to protect it against abuse.

3. Cookies and local storage

A single session cookie, strictly necessary for authentication, keeps you logged in; it remains valid for 30 days after you log in, or until you log out. This type of tracker is exempt from consent under the CNIL (guidelines on “cookies and other trackers”, deliberation no. 2020-091 of 17 September 2020, article 5): it only authenticates you, nothing more. The browser’s local storage likewise holds your preferences (consent, acceptance of the Terms, display settings) — also exempt, the CNIL placing interface personalisation in the same list. No advertising trackers, no third-party cookies, no external audience measurement.

When offline mode is enabled on your account, your browser additionally keeps a local game state: your venue’s latest situation (funds, equipment, staff, objectives) as established by our servers, so that you can view it without a connection. If you prepare a new layout without a network connection, it also keeps the unapplied draft of your item placements, moves and removals. This draft is sent only after you reconnect and ask for it to be applied; every operation is then checked again against the server’s current state and rules. This storage is strictly necessary for the service you request, and therefore falls under the same exemption. It is partitioned per account — two accounts sharing the same browser never see each other’s data —, it contains no audience measurement and no profiling, and it is erased when you log out, when your account is deleted, and at the next contact thereafter if that deletion happened while the device was offline.

4. Purposes and legal basis

This data is used exclusively to: create and secure your account, save and display your game, run the social features (leaderboards, visits, guestbook), handle your feedback and keep the game fair. The legal basis is performance of the contract (the Terms you accept) and the legitimate interest in protecting the service — it is this second basis that covers the logging of blocked or suspicious requests (§2), IP address included, necessary to spot abuse (cheating, spam, abnormal login attempts). No data is sold, passed on to third parties for commercial purposes, or used for advertising or profiling.

5. E-mails

Two categories of messages, which never mix:

— Service messages (login link, password reset): they answer a request you have just made. They fall under performance of the contract and cannot be declined — without them, the corresponding features would not exist. No service message is sent unless you triggered it.
— Newsletter (news, in-game events): sent only if you ticked the dedicated box, at sign-up or in the Account panel. The legal basis is your consent, which you can withdraw at any time in a single click — in the Account panel, or through the unsubscribe link present in every newsletter, which works without being logged in and never expires. No justification to give, no consequence for your game. A withdrawal applies to the future only: it does not call into question the messages already sent.

Delivery is handled by Scaleway SAS (8 rue de la Ville l’Évêque, 75008 Paris), a processor within the meaning of article 4(8) of the GDPR, on servers located in the European Union. It receives your address and the content of the message in order to hand them to your mail provider, and for nothing else.

6. Retention periods

Your data is kept for as long as your account is active. Deleting your account is requested from the Account panel and happens in three steps: your request erases nothing and sends a confirmation link to your address; opening that link schedules the erasure fourteen days later, without carrying it out; at the deadline, your personal data, your game and the reviews you have received are permanently erased. The confirmation link is valid for fifteen minutes and can only be used once.

One clarification about guestbook reviews, because the two directions do not follow the same rule. The reviews your establishment has received go with it. Those you have left on other players’ venues remain, but anonymised: the text stays on their page, while your name and the link to your account are removed — it is then attached to nobody. Taking them away would lower the public rating of establishments that asked for nothing, without their owners being told. Messages you sent through the Feedback button follow the same rule: the text is kept, every link to your account is removed.

During those fourteen days your account stays fully usable and you may change your mind at any time: a permanent banner shows the erasure date and carries the “Cancel deletion” button. Logging back in does not cancel anything by itself — only that button does, so that nobody re-arms their account without knowing while coming back one last time to export their data. After the date, the erasure is irreversible.

An account left without a single login for two years is considered inactive, and we do not keep the data of inactive accounts. We then warn you by e-mail at your account address, and the erasure takes place thirty days later. There is nothing you need to do to keep it: logging back in and playing cancels the deadline on the spot — no form, no button to find. It is the date of your last visit that counts, never the date you signed up. If you no longer want the account, there is nothing to do either: it will go on its own at the announced date.

A guest account is the one exception, and it works in your favour: its address is a filler address that cannot receive any mail, so no confirmation link could ever reach it. Its deletion is therefore immediate, with no confirmation and no delay. A guest account — without an address or a password — is also deleted automatically, along with its venue, thirty days after the last session played. It is the date of the last session that counts, never the date it was opened: as long as you play, nothing is erased. Creating your account (Options → Account) ends this deadline and keeps everything you have built.

Expired sessions and your establishment’s activity log are purged automatically every day (30 days of history for the latter). Tokens sent by e-mail (login link, password reset, deletion confirmation) expire after fifteen minutes and are deleted within the following 24 hours; messages sent successfully are purged thirty days after being sent. The log that records blocked or suspicious requests (§2), IP address included, is purged after one year — including entries that are not attached to any account, such as an abuse attempt that occurred before any sign-up. It also disappears, sooner, along with the account it is attached to. The history of your PC Bang’s former names, kept for moderation, is purged after twelve months, and sooner along with your account.

A message that could not be delivered (invalid address, prolonged outage at the provider) is attempted five times at most. After the fifth failure it is never sent again; it stays in the sending queue, address and content included, for thirty days from that last failure — long enough to explain why a player received nothing — and is then erased in full by the daily purge.

7. Your rights

You have the rights of access, rectification, erasure, portability, restriction and objection. The Account panel lets you directly: export in one click all the data of your account and your establishment — profile, game, items, transactions, employees, objectives, esports and league, contracts, licences, venue blueprints, settings, guestbook reviews and Feedback messages, in JSON format. The only exclusions are your hashed password and your login tokens, which are means of authentication rather than data: an export file gets forwarded, and it must not hand over control of your account. The panel also lets you change your e-mail address, your password, your name and your avatar, subscribe to or unsubscribe from the newsletter in a single click, and request the deletion of your account — effective fourteen days after you confirm it through the link you receive, and cancellable until then (§6). You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr/fr/plaintes), if you consider that your rights are not being respected.

8. Hosting and security

The data is hosted by OVH SAS (2 rue Kellermann, 59100 Roubaix, France), on a server located in France, and backed up regularly. No data is transferred outside the European Union — neither at the host, nor at the e-mail processor (§5). Appropriate technical and organisational measures protect your data (encrypted exchanges, hashed passwords, restricted access to the game’s administration).