Privacy Policy

1. Data Controller

FantasyRealm is a non-commercial educational project developed by an individual student as part of the Studi Développeur Web et Web Mobile (DWWM) examination.

The project developer is responsible for managing personal data used by this demonstration.

PixelVerse Studios is a fictional company used in the examination scenario.

For privacy-related enquiries, use the Contact page.

2. Data We Collect

Account information: username, email address, password hash, role and account status.

Character information: fictional character names, appearance, equipment and visibility.

Community content: ratings, reviews and moderation information.

Support requests: email address, message and optional username.

Staff activity logs: staff identifiers, administrative actions, affected record identifiers and timestamps.

Technical information: necessary session cookies and applicable server logs.

3. Purposes and Legal Bases

Account information is processed to provide registration, authentication and character management functionality.

Contact information is processed to respond to support enquiries and privacy requests.

Moderation information and staff activity logs are processed to protect users, maintain security and record administrative actions.

For a publicly available service, the intended legal bases are contractual necessity for providing requested account services, where applicable, and legitimate interests for support, security and moderation where justified.

4. Required and Optional Data

Username, email and password are required to create an account.

Email and message are required to submit a contact enquiry. The contact username is optional.

Character creation and review submission are optional features.

5. Public Information

If you share an approved character, its information and your username may appear in the public gallery.

Approved reviews may display your username, rating and comment.

Your password hash and email address are not published in the gallery.

6. Retention Periods

Account information and associated characters are retained while the user account exists.

Users may request deletion of their personal data through the Contact page.

Account deletion is currently handled by authorised staff. Certain information may be retained separately where legally justified.

Automatic deletion of inactive accounts is not currently implemented.

Contact messages are retained for six months after submission. A daily automated database cleanup removes messages that exceed this period.

Staff activity logs stored in MongoDB are retained for 365 days after the recorded action. A TTL index automatically removes these records after this period.

Backup retention periods have not yet been established for the local development environment.

Before public deployment, backup retention and deletion procedures will be defined and documented.

7. Who Has Access?

Personal data is accessible only to authorised persons who need it for account management, support, moderation or administration.

The local development environment uses MariaDB and MongoDB databases running in Docker containers.

The public hosting provider, server locations and any international data transfers will be documented before public deployment.

8. Cookies and Third Parties

FantasyRealm uses a necessary PHP session cookie to maintain user authentication.

Some pages load Google Fonts from Google's servers. This involves requests to an external provider.

Any additional analytics, advertising or third-party tracking technologies will be reviewed and disclosed before deployment.

9. Your Rights

Under applicable data protection law, you may request access, correction, erasure or restriction of your data. Rights to object and data portability may also apply.

To request access, correction or deletion of your personal data, please use our Contact page. Include "Privacy Request" in your message.

You can also lodge a complaint with the French data protection authority, the CNIL: www.cnil.fr .

Privacy requests are reviewed manually. Identity may be verified when necessary to prevent unauthorised disclosure or deletion of personal data.

Requests will be answered without undue delay, normally within one month. An extension may apply where permitted by applicable data protection law.