Privacy policy

Data controller

MINDLET SAS, Hameau de Cateraggio, Lot Rumana, Entrée Lot 1, 20270 Aléria, France.

Contact: contact@masters-masters.com

Data we collect

• your email address, your username (the same in every game), your display name and your password (hashed, never stored in plain text);
• if you sign in with Google, Apple or Discord: the identity that service shares (email address, name, profile picture, account identifier) and the technical sign-in tokens; with Apple, the address may be a “Hide My Email” relay;
• if you create a passkey: its public key, its identifier, the model identifier of the password manager that stores it, whether it is synced, a usage counter and its creation date; the private key never leaves your device;
• the date on which you declared you are 15 or older, but never your date of birth or your age;
• for each session: the IP address and browser used, and its expiration date; to curb abuse, request counters tied to the IP address and the page requested, which are not linked to any account;
• at sign-up, the domain of your email address is checked against a list of disposable email providers; nothing more is stored;
• to verify your address or reset your password: a single-use token, erased once used or when it expires (24 hours for verification, 1 hour for a reset);
• for the Masters Pass: the games you opened a pack in each week (Masters Tour) and the Adaptation cards you got, with the game each one came from; deleted with your account;
• technical logs (requested URL, response, errors, request details), kept for a few days by Cloudflare to diagnose outages.

Purpose: giving you one account for every game, signing you in to them and protecting the service against abuse. Legal basis: performance of a contract (GDPR Article 6(1)(b)) and, for the counters and logs, our legitimate interest in securing the service (Article 6(1)(f)). Retention: account and session data are kept as long as your account exists (a session expires about 7 days after your last visit); counters, as long as they are used to limit requests, with no link to any account.

No data is sold or shared for advertising purposes, and the site uses no audience measurement (analytics) tools.

Sharing with the games

When you open a game (HitMasters, CineMasters…), the account sends it, via OpenID Connect, your account identifier, your email address and whether it is verified, your username, your display name, your picture, your language and the date of your age declaration. For each game you join, the account keeps the sign-in tokens it issued to that game. The games are published by the same company; each one keeps its own game data, described in its own policy.

Service providers and recipients

• Cloudflare, Inc. (United States) hosts the site and its database on its global network. Cloudflare may process data outside the European Union; these transfers rely on the EU–U.S. Data Privacy Framework and the European Commission’s standard contractual clauses.
• Cloudflare Turnstile protects logging in, signing up and password resets against bots: its script, loaded from challenges.cloudflare.com, receives your IP address and technical details about your browser, with no advertising cookies.
• Cloudflare Email Service sends account emails (address verification, password resets) from noreply@masters-masters.com: it receives your email address and the content of the message.
• Google, Apple and Discord, only if you choose to sign in with them: they then process your data on their own behalf, under their own privacy policies.
• On the home page, card images come from the games' sites and their sources (Google and YouTube for HitMasters covers, TheTVDB, TVmaze, Wikimedia and AniList for CineMasters posters): your browser loads them directly, so these services receive your IP address, but no account data.

Cookies

The site only sets strictly necessary cookies, which need no consent: the session cookie and its signed cached copy (5 minutes), temporary cookies (a few minutes) while you sign in with Google, Apple, Discord or a passkey, or sign out of a game, and a cookie that remembers your language (400 days).

Minimum age

The account is for people aged 15 and over: that is the age from which you can consent by yourself to the processing of your data in France (GDPR Article 8 and Article 45 of the French Data Protection Act). A parent who believes their child under 15 has created an account can write to us at the contact address.

Your rights

You can access, correct or erase your data, receive a copy of it, or object to or restrict its processing by writing to the contact address. A deletion request covers the account and every MastersMasters game. You can also file a complaint with the CNIL, the French data protection authority (cnil.fr).

Contact: contact@masters-masters.com

The rules for using the account are set out in our Terms of use.