Who controls your data
Martin Chapuis, individual entrepreneur (EI) operating under Okulvitra, is the controller for Tierclash personal data. You can contact support@tierclash.com about privacy.
Data we collect
Depending on how you use Tierclash, we process account and authentication details; profile and preference data; templates, images, links, tier labels, drawings, votes, reactions, game participation, and results; subscription and Stripe identifiers; support, report, appeal, and moderation records; consent choices; product events; device, log, security, and IP data; and image-search queries sent when you choose an external provider.
Why we use it
We process data to provide accounts, games, sharing, and subscriptions under our contract with you; secure the service, prevent abuse, moderate content, understand essential product use, and defend legal claims based on our legitimate interests; meet tax, accounting, consumer, and legal obligations; and run Matomo analytics and advertising technologies only where the required consent has been given.
Analytics, cookies, and advertising
Tierclash records essential server-side product events such as games created or completed and templates used even when optional analytics consent is declined. Those events are kept for up to 24 months. Matomo audience measurement and Google AdSense are controlled through the consent settings and are not activated before the required consent. Your consent choice is stored in your browser. You can reopen the consent settings and withdraw consent at any time; withdrawal does not affect earlier lawful processing.
Who receives data
We use providers only where needed for the service: Convex for application data and backend hosting; Vercel for website hosting and delivery; Google for sign-in; Stripe for payments and billing; Microsoft Azure Content Safety for image moderation; Matomo for consented audience measurement; Google AdSense for consented advertising; Axiom for operational logs; Unsplash and Pexels for image searches and direct delivery of selected images; and YouTube for links, direct thumbnails, or privacy-enhanced embeds you choose to use. Direct provider delivery sends the browser request and associated network data, such as your IP address and browser information, to that provider. Providers may also act as independent controllers for their own legally defined purposes. We do not sell personal data.
International transfers
Some providers process data outside the European Economic Area, including in the United States. Where the GDPR requires it, transfers rely on an adequacy decision, approved standard contractual clauses, or another lawful safeguard. You may ask us for information about the safeguard relevant to your data.
How long we keep data
We keep account and game data while the account or relevant content remains active and then for the time reasonably needed for deletion, backup rotation, disputes, or legal duties. Product analytics events expire after 24 months. Consent choices may remain in the browser for up to 12 months. IP tracking records expire 30 days after they were last seen. Billing and accounting records are kept for the statutory period. Other security, moderation, support, and report records are kept only as long as reasonably needed for abuse prevention, review, or legal claims.
Your rights
Subject to the conditions in applicable law, you may request access, correction, deletion, restriction, portability, or objection; withdraw consent; and give instructions about data after death where French law applies. Email support@tierclash.com. We may need to verify your identity. You may complain to the CNIL at cnil.fr or to the competent authority where you live or work.
Minors
Tierclash is not directed at children. In France, a user under 15 must have authorization from a parent or legal guardian where consent is the legal basis for processing. Parents and guardians may contact us about a minor's data.
Automated moderation
Uploaded or linked images may be assessed by automated content-safety tools. Three rejected images in a rolling 24-hour window trigger a 72-hour image-upload restriction. A second incident within 12 months triggers another temporary upload restriction and human review; automated moderation does not permanently restrict an account. Contact support if you want to contest a decision.
Security
We use proportionate technical and organisational measures intended to protect personal data, including access controls, provider security features, transport encryption, rate limits, and restricted administrative tools. No online service can guarantee absolute security.
Advertising
Free-tier pages may display ads through Google AdSense. Google and its advertising partners may use cookies or similar technologies and process device, network, and interaction data to provide and measure ads according to the privacy choices available in your region. Google Privacy & Messaging provides the applicable European and US-state controls.