Privacy policy
Updated: October 5, 2026
This is a translation. In case of discrepancy, the French version prevails.
Data controller
Ludovic Wipier, sole proprietorship (micro-entreprise), trading as ZKYSolutions, 14 rue Jean-Baptiste Quintin, 78200 Soindres, France. Contact: [email protected].
What we collect and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Username, email, password (hashed, never readable) | Create and secure your account, send you verification and reset codes | Performance of the service | Until the account is deleted |
| Google ID and Google email | Sign-in with Google, if you choose it. Neither your Google name nor your photo is requested. | Performance of the service | Until the account is deleted |
| Collection, coins, trades, auctions, friends, achievements, team, season points, cosmetics, bio, preferences, time zone | Run the game | Performance of the service | Until the account is deleted |
| Timestamps of your game actions | Detect bots and cheating | Legitimate interest (fair play) | 30 days |
| Random device ID and technical device fingerprint, hashed | Prevent multiple accounts, spot transfers between accounts owned by the same person | Legitimate interest (fraud prevention) | Until the account is deleted |
| Pages viewed, referrer, device type, language, first interaction with the page (to filter out bots) and key steps (trial section seen, trial pack opened, account created), linked to an anonymous visit identifier recomputed every day | Measure site traffic (internal statistics, no cookie or third-party service) | Legitimate interest (audience measurement) | 90 days |
| Bug reports: category, description, page, language, browser, screen, recent technical errors | Fix reported bugs | Legitimate interest (proper operation of the service) | 12 months |
| Purchases: offer, amount, date, acceptance of immediate delivery and waiver of withdrawal, billing country, Stripe identifiers (never card numbers) | Deliver purchases, prove the player's consent, keep the accounts | Performance of the contract and legal obligation (accounting) | 10 years (accounting obligation) |
| Push notification subscription | Send you the notifications you enabled, including the evening reward reminder at your local time | Consent (turned on in Settings) | Until turned off |
| In-game notifications | Let you know about a sale, a trade, an achievement | Performance of the service | 60 days |
| Reports | Moderation | Legitimate interest (player safety) | Until the account concerned is deleted |
IP addresses are used to limit abuse (number of attempts). To detect multiple accounts, an encrypted, non-reversible fingerprint of the login IP address is kept for 30 days with the account (legitimate interest: fair play); the address itself is never stored. No data is sold or used for advertising.
Cookies and local storage
PackTheWorld only uses cookies required for the service, with no advertising or audience tracking:
ptw_sid: your login session, 30 days.ptw_lang: your display language, 1 year.ptw_did: random device ID, for security and to fight multiple accounts, 400 days.ptw_oauthandptw_gpending: for the duration of a Google sign-in, 10 to 30 minutes.
Your browser's local storage keeps a few display preferences, which never leave your device.
Service providers
- Google, if you sign in with Google.
- Your browser's notification service (Google, Mozilla or Apple), if you turn on push notifications: it receives the text of the notifications.
- Stripe Payments Europe, Limited, for payments: it receives the information needed for payment (card, billing address), which PackTheWorld never sees.
- Cloudflare Turnstile, for the anti-bot check at sign-up and occasionally when opening packs: it receives technical information from your browser.
- The host, specified in the legal notice, and the email sending service.
Your rights
You can access, correct or delete your data, object to its processing or ask for a copy by writing to [email protected]. You can delete your account and all its data at any time from Settings. You can also file a complaint with the CNIL, the French data protection authority (cnil.fr).