Privacy Policy

The data controller is Mael Guimoyas (individual / auto-entrepreneur), 11 chemin du Bray, 74940 Annecy-le-Vieux, France — SIREN 991 801 028. For any privacy question or to exercise your rights, contact contact@riggedroyale.com.

We only collect what a given feature needs:

• Account — email, password hash (managed by Supabase), or Google OAuth identity, plus an optional display name and avatar. Legal basis: performance of a contract (Art. 6(1)(b)).
• Subscription (Pro) — Stripe customer and subscription IDs, status, and billing period. We never store card numbers; payment happens on Stripe-hosted checkout. Legal basis: contract.
• API keys and usage — hashed key, prefix, and per-endpoint request counts for metering and abuse prevention. Legal basis: contract and legitimate interest.
• Your saved content — tracked players, saved decks, Deck Lab results, verified player link, jury notes, votes, and rivalries you create. Legal basis: contract / your own action.
• Clash Royale player data — in-game names, player tags, and battle logs (including opponents and teammates) fetched from the official public game API. Legal basis: legitimate interest (Art. 6(1)(f)) in providing public match analysis. If you are a Clash Royale player and want your tag and history removed, contact contact@riggedroyale.com (see §7).
• IP address — used only as a rate-limiting and anti-abuse signal. It is pseudonymized: we store a salted, one-way hash, never the raw address. Legal basis: legitimate interest.

We use trusted providers strictly to run the service. Each is bound by a data-processing agreement:

• Supabase — authentication and database.
• Google — OAuth sign-in (only if you use it).
• Stripe — subscription payments.
• Supercell / RoyaleAPI proxy — public game data.
• Vercel — hosting and edge delivery.
• Upstash / Vercel KV — ephemeral cache.
• Self-hosted model endpoint — win-chance predictions.

Our database (Supabase) and hosting (Vercel) are located in the United States, and other subprocessors (Stripe, Google) may also process data outside the EU. These transfers are covered by the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

• Account and content: until you delete your account.
• Subscription records: for the legal accounting period, then deleted.
• Rate-limit quota rows: pruned after 30 days.
• Unfinished tag-verification challenges: until they expire.
• Battle and player archives: capped and pruned automatically by volume.

Under the GDPR you can access, rectify, erase, restrict, or object to processing of your personal data, and receive it in a portable format. You can do most of this yourself:

• Download my data — a full JSON export (portability).
• Delete account — erases your account and all associated records.

For anything else, contact contact@riggedroyale.com. You also have the right to lodge a complaint with the French data-protection authority, the CNIL. CNIL.

Public player and battle data comes from the official game API. If you are a player (or a parent/guardian) and want a tag and its history removed from the site, email contact@riggedroyale.com with the player tag. We will remove the matching player record and related battles.

Win-chance and skill estimates are statistical, informational outputs. They have no legal or similarly significant effect on you.

We use only strictly-necessary authentication cookies — no analytics, advertising, or tracking. See the Cookie information page for details. Cookie information.

We may update this policy; the "Last updated" date above reflects the latest version. Material changes will be surfaced in the app.