Privacy policy

This policy describes the data processed by SUTOM, both on the sutom.fr website and in the iOS and Android mobile apps. No registration is required to play. The website does not collect any identifying data (name, email) without your consent; the apps process additional data described below (advertising, usage measurement, purchases, community space).

To run the game, your browser stores locally (on your device only):

• An anonymous identifier (UUID v4) generated on your first visit (sutom_web_id)
• Your current game (today_game) and yesterday's (yesterday_game)
• Your cumulative statistics (statistiques)
• Your display preferences (configuration): theme, sound, language, keyboard layout

You can delete this data at any time via your browser settings.

The site only uses audience-measurement cookies (Google Analytics 4) to understand how SUTOM is used and improve it. This cookie is loaded only after your acceptance via the consent banner. If you decline, no analytics cookie is set. No advertising cookies are used on the website.

If you accept cookies, Google Analytics collects anonymised data: pages visited, visit duration, device type, country, traffic source. IP addresses are anonymised. No data is used for advertising purposes. Data retained for 14 months maximum.

When you finish a game, your score (word, attempts, duration, outcome, date) is sent to our server (api.sutom.fr) along with your local anonymous identifier (sutom_web_id) to aggregate global statistics (success rate per word, attempts distribution) shown at the end of the game. No personally identifying data is transmitted — the identifier is a random UUID generated in your browser, with no email or device ID. To erase your scores server-side, use the "Delete my data" button in the stats panel (coming soon) or contact us.

In the apps, we measure usage and stability via Firebase Analytics, Amplitude and Firebase Crashlytics: usage events, crash reports and technical device characteristics (model, OS version, app version). This data is used to improve the game and fix issues.

The apps display advertising through the AppLovin MAX ad network and its mediation partners. Your consent is collected on first launch via Google User Messaging Platform (UMP): depending on your choice, ads are personalised or non-personalised. An advertising identifier (IDFA on iOS, Google Advertising ID on Android) may be used, subject to your permission. The premium “ad-free” option disables advertising.

Purchases (credits, premium option) are processed and billed by the Apple App Store or Google Play. We receive a purchase confirmation to credit your account, but not your payment details, which are handled by Apple or Google.

If you enable them, a notification token (Firebase Cloud Messaging) is used to send you notifications. You can disable them at any time in your device settings.

If you take part in the community space, we process your nickname, your emoji, your year of birth (to verify the minimum age of 15), your email address (required to post) and your messages (content and timestamp), as well as any reports and sanctions. Your nickname, emoji and messages are visible to other members. Legal basis: performance of the terms of use, plus our legitimate interest and legal obligations (EU Digital Services Act, DSA) for safety and moderation. Messages are analysed automatically to detect prohibited content (see “Sub-processors and transfers”). A deleted message is anonymised; you can delete your messages, request deletion of your account, and appeal a moderation decision.

We use providers acting on our behalf: hosting (OVH, European Union), web audience measurement (Google), analytics and diagnostics (Google/Firebase, Amplitude), advertising (AppLovin and its partners), distribution and billing (Apple, Google), and AI moderation of messages (Mistral AI, European Union). Some of these providers (for example Google or Apple) are established in the United States; transfers outside the European Union are governed by standard contractual clauses.

Data is kept for as long as necessary for the purposes described: web audience data for a maximum of 14 months; community messages for as long as they are published; other data until you delete your account or exercise your right to erasure.

Under the GDPR, you have the following rights:

• Access: know what data we hold about you
• Rectification: correct inaccurate data
• Erasure: have your data deleted
• Objection: refuse certain processing (including Google Analytics, via the banner)
• Portability: receive your data in a structured format

To exercise these rights: [email protected]. Response time: 30 days.

This policy may be updated. The last-updated date is shown at the top of this page. Substantial changes will be announced via the consent banner.

For any data-related question: [email protected].