Ko'llection

Legal

Last updated

Definitions

Ko'llection: the web application at kollection.edokko.design, and the service it provides.

Collector: any person with a Ko'llection account.

Collection: the games a Collector records in Ko'llection, each as an Entry (its platform, format, status and the other details the Collector sets).

Feedback: a message a Collector sends from Ko'llection about the application, with the details shown before it is sent.

Personal Data: any information relating to an identified or identifiable natural person, as defined by Article 4 of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). The terms "processing," "controller," and "processor" have the meanings the GDPR gives them.

1. About Ko'llection

Pursuant to Article 6 of French Law No. 2004-575 of 21 June 2004 (the Loi pour la Confiance dans l'Économie Numérique, "LCEN"), users of Ko'llection are informed of the identity of the parties involved in its creation and maintenance:

Publisher: Jérémie Le Corre, as part of Edokko

Publication Manager: Jérémie Le Corre

Contact: j.lecorre@edokko.design

Host: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States, +1 559 288 7060

2. Terms of Use

Using Ko'llection implies full acceptance of these terms. They may be modified at any time; the date at the top of this page says when they last changed, and Collectors are invited to read them again from time to time.

Ko'llection is normally available at all times. Access may nonetheless be interrupted, for maintenance or for reasons beyond the Publisher's control, without notice and without any right to compensation.

3. Description of the Service

Ko'llection is a free application for keeping track of a video game collection: the games a Collector owns, on which platforms and in which formats, and how far they have played them.

Ko'llection is a personal project of the Publisher. Its features may change, and the Publisher strives to keep the information it shows accurate without guaranteeing it.

4. Your Account

Anyone can create a Ko'llection account, with an email address and a password. The account opens once the address is confirmed, by a link sent to it, valid for 24 hours. An account whose address is never confirmed is deleted after 7 days.

A Collector signs in with their address and their password. A forgotten password is replaced through a link sent to the address, valid for one hour and usable once. Whoever can read the mailbox can therefore take over the account, and the Collector is responsible for keeping their password and access to their mailbox to themselves.

A Collector can delete their account at any time, from Settings, under Account, by confirming their password. The account is then signed out everywhere and hidden for 30 days. Signing in during those 30 days offers to keep it, which cancels the deletion. After 30 days the account and its Collection are deleted for good, with no way of recovering them. Two emails say so: one at once, one 3 days before the deletion. Feedback already sent is kept, no longer tied to the account or to any person.

The Publisher may suspend or delete an account used against these terms or the law, or in a way that harms the service or other Collectors.

5. Intellectual Property

The Publisher holds the rights to Ko'llection: its code, design, text and logo. Reproducing or reusing all or part of them without the Publisher's prior written authorization is prohibited, and may be prosecuted as infringement under Articles L.335-2 et seq. of the French Intellectual Property Code.

5.1 Game Data

Game data and covers from IGDB. Game titles, covers and the other game data remain the property of their respective owners.

5.2 Your Content

A Collector's Collection and Feedback remain theirs. By sending Feedback, a Collector allows the Publisher to use it to fix and improve Ko'llection.

6. Limitation of Liability

Ko'llection is provided as is. The Publisher cannot be held liable for an interruption of the service, a bug, an inaccuracy in game data, or the loss of data, nor for direct or indirect damage to a user's equipment resulting from the use of Ko'llection.

Users agree to access Ko'llection with up-to-date equipment and browser.

7. Personal Data

7.1 Controller

The controller of the Personal Data processed by Ko'llection is Jérémie Le Corre, who can be reached at the contact address above for any question about this section.

7.2 What Ko'llection Keeps, and Why

  • Your email address, to identify your account, sign you in and send the emails the service needs (confirming your address, a new password, address changes, the deletion of your account). Legal basis: the performance of the service you asked for (GDPR Article 6(1)(b)). Without it, there is no account.
  • Your password, kept only as a hash: a one-way transformation from which the password cannot be read back. Nobody, the Publisher included, can see it. When you choose a password, the first five characters of another hash of it (SHA-1) are sent to Have I Been Pwned, to refuse a password known from a data leak. Neither your password nor your address is sent. Same legal basis.
  • Your Collection, which is the service itself. Same legal basis. All Collections are also counted together, as totals only (how many Entries, the most-owned Platforms and Games, the share of each Format and Status), for the Publisher to see how Ko'llection is used. No figure shows one person's Collection. Legal basis: the Publisher's legitimate interest in understanding how Ko'llection is used, to improve it (GDPR Article 6(1)(f)).
  • Your language: English or French, set to the language the page was in when you sign up (or at your next sign-in, for an account created before Ko'llection spoke French), and changed in Preferences, to show Ko'llection and write its emails in your language. Same legal basis.
  • Your sessions: each signed-in browser is recorded with its IP address and its browser and system (user agent), as the sign-in system stores them. A session lasts 30 days, renewed each time you come back. Same legal basis.
  • Your Feedback: the message you write, with the details shown to you before you send it (the page, the screen width, the device, the theme, the browser) and the version of Ko'llection. Legal basis: the Publisher's legitimate interest in fixing and improving Ko'llection (GDPR Article 6(1)(f)). Sending Feedback is optional.
  • Audience measurement: how Ko'llection is used, measured with Umami, an open-source tool run by the Publisher. It records the pages you view (their address without anything after it, so never what you search for or your filters), where you came from, your device, browser, screen size and language, your approximate location (country, region and city), and the actions you take in Ko'llection, never what you type. Your IP address is used only for a moment, to work out that location and an anonymous visit identifier through one-way hashing with a secret that changes regularly, and is never kept. Nothing ties this data to your account or your email address. Legal basis: the Publisher's legitimate interest in understanding how Ko'llection is used, to improve it (GDPR Article 6(1)(f)). You can opt out, as described in 9.2.

Ko'llection uses no advertising and no tracking beyond the audience measurement above, makes no automated decision about you, and does not profile you. Nothing is sold or shared beyond the processors below.

7.3 Recipients and Processors

Personal Data is only accessed by the Publisher and by the processors that run Ko'llection, each for its own part:

  • Vercel Inc. (United States), the host, which serves Ko'llection and therefore processes the technical data of each request, such as the IP address.
  • Neon, which stores the data in a database located in the European Union.
  • Resend (United States), through which the emails are sent; it processes your email address and the content of those emails.
  • Umami, the audience measurement software, is not a company: it is run by the Publisher, served by Vercel and storing its data with Neon in the European Union. Its data goes to no one else.

Game covers are loaded by your browser directly from IGDB's image servers (IGDB is owned by Twitch, in the United States), which therefore receive your IP address when a cover is shown. No other data about you is sent to IGDB.

7.4 Transfers Outside the European Union

Vercel and Resend are based in the United States. Both are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognizes as ensuring an adequate level of protection; Vercel also relies on the European Commission's Standard Contractual Clauses. Their data processing agreements are published on their websites.

7.5 How Long Data Is Kept

Your account, your password's hash, your language, your Collection and your sessions are kept as long as your account exists. When you delete your account, your sessions end at once; the rest is kept 30 more days, hidden, in case you change your mind, then deleted for good. Your Feedback is kept after that, detached from your account: the message and the details sent with it, with nothing that says who sent it. An account whose address was never confirmed is deleted after 7 days. The link confirming an address expires after 24 hours, and the link to choose a new password after one hour. Audience measurement data is kept for 24 months, then deleted.

7.6 Your Rights

In accordance with the GDPR and the French Loi Informatique et Libertés, you have the right to access your Personal Data (Article 15), to have it corrected (Article 16) or erased (Article 17), to restrict its processing (Article 18), to receive it in a portable format (Article 20), to object to processing based on legitimate interest (Article 21), and to give instructions about what happens to it after your death.

You can erase your data yourself by deleting your account (section 4). To exercise the other rights, write to the contact address above from the address of your account. If you believe your rights are not respected, you may lodge a complaint with the CNIL, the French data protection authority (https://www.cnil.fr/en/).

8. Security and Incidents

Ko'llection is served over an encrypted connection (HTTPS). Passwords are kept only as hashes, and a password known from a data leak is refused. The links sent by email expire, and the link to choose a new password works once. Access to the data is limited to the Publisher and the processors above.

No method of transmission or storage is completely secure. Should a breach affecting Personal Data occur, the Publisher would notify the affected Collectors, and the CNIL where the law requires it, as soon as possible, with the measures taken.

Ko'llection contains links to other websites, such as IGDB and Edokko. The Publisher has no control over their content and assumes no liability for it; once there, you are subject to their own terms and privacy policies.

9.2 Two Cookies

Ko'llection sets two cookies. The first keeps you signed in for 30 days, renewed each time you come back: without it, you would sign in on every page. The second keeps, for a year, the language of the pages you see before signing in: the one you pick there, or your account's once you have signed in. It holds nothing else. Both are needed for the service you ask for, so they need no consent. Audience measurement (7.2) sets no cookie, and there is no advertising, so there is no cookie banner either.

You can opt out of audience measurement by adding ?notrack to the address of any Ko'llection page: your browser remembers it, on your device only, until you visit ?track. If your browser asks sites not to track you (Do Not Track), no audience measurement happens at all.

10. Governing Law and Jurisdiction

These terms are governed by French law. Any dispute relating to the use of Ko'llection falls under the jurisdiction of the competent French courts.