Privacy Policy

This policy explains what personal data TacticBoard collects, why we collect it, and what control you have over it. We have tried to describe what the product actually does rather than cover every theoretical case.

Who is responsible

The data controller is SAS Tacticboard, 12 rue des archives. For any question about your data, or to exercise the rights below, contact mathisdebail@gmail.com.

You can use TacticBoard without giving us any data

The editor works without an account. In that mode your tactics are saved only in your own browser (local storage) and are never transmitted to us. We hold nothing about you. The trade-off is that the data lives on that device only: clearing your browser data removes it.

What we collect when you sign in

• Account data. When you sign in with Google we receive your email address, your name and your profile picture from Google. We never receive your Google password.
• Your tactics. The content you choose to save to your account: the tactic name, its tags, the positions and sequences that make it up, and a generated preview image.
• Subscription data. If you take a paid plan, we keep the identifier of your Stripe customer and subscription, the plan you are on and its status. Your card details go straight to Stripe and never reach our servers.
• Technical data. Standard server and security logs produced when your browser talks to our servers, such as IP address, browser type and timestamps.

We do not ask for, and have no use for, special categories of data (health, political opinions, and so on). Please do not put personal data about third parties — for example named minors in a squad — into tactic names or descriptions.

Why we process it, and on what legal basis

• To provide the Service (create your account, store and sync your tactics) — performance of our contract with you.
• To keep the Service secure and working (logs, abuse prevention, debugging crashes) — our legitimate interest in running a safe, functioning product.
• To comply with legal obligations where they apply.

Cookies

We use a session cookie to keep you signed in. It is strictly necessary for the Service to work and is not used for advertising or tracking. We also use your browser’s local storage to remember your language choice and to keep an unsaved draft of the tactic you are editing.

We do not currently run advertising or third-party tracking cookies. If we add analytics, this policy will be updated and, where the law requires it, we will ask for your consent first.

Who else can see your data

We do not sell your personal data and we do not share it for advertising. We rely on a small number of service providers who process data strictly on our instructions:

• Vercel — application hosting.
• Supabase — database hosting where accounts and saved tactics are stored.
• Google — only to authenticate you when you choose Google sign-in.
• Stripe — payment and subscription handling, if you take a paid plan. Stripe receives your email address and your card details; we never see or store the card details ourselves.

Where a provider processes data outside the European Economic Area, that transfer is covered by an appropriate safeguard such as the European Commission’s standard contractual clauses.

How long we keep it

• Account data and tactics — for as long as your account exists. Delete a tactic and it is removed from our database; delete your account and your account data and tactics are removed.
• Technical and security logs — for a limited period appropriate to security and debugging, then deleted.
• Billing records — invoices and the accounting records behind them are kept for the period French commercial law requires (ten years), even after you delete your account. This is a legal obligation and is the one thing account deletion cannot erase.

Your rights

Under the GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict or object to its processing, and to receive it in a portable format. Your saved tactics can also be exported from the product itself at any time.

To exercise any of these rights, write to mathisdebail@gmail.com. If you believe we have handled your data improperly, you have the right to complain to your national supervisory authority — in France, the CNIL.

Security

Traffic is encrypted in transit. Access to saved tactics is restricted to the account that created them, enforced on the server for every read and write. No system is perfectly secure, so please keep your Google account protected.

Changes to this policy

We will update this page when our processing changes, and the “last updated” date above will change with it. Significant changes will be communicated to account holders.