Privacy Policy

Our commitment

Your trust matters. We limit collection to what the service actually needs to work, and we never sell your data.

Data we collect

We collect the data needed to run and improve the service:

• Account and contact: name, email address, preferences, support messages and connection data needed for security.
• Stories: addresses supplied by the organizer for invitations, contributions, narrative settings, turns, reports and reveal videos.
• Notifications: recipient addresses, delivery channel and receipts needed for retries. When Slack is connected, workspace identifiers and an encrypted bot token.
• Analytics usage data, only with consent: device type, anonymized pages and game events. Temporary authentication analytics state contains neither email addresses nor contributions.
• Browser storage: session, language, consent choice and contribution draft. Drafts expire 24 hours after their last edit; expired drafts are deleted the next time the contribution form opens. Older drafts without a timestamp receive a 24-hour lifetime when first read after this update. Use “Clear draft” or clear this site’s data in your browser to delete a draft immediately.

How we use data

We use this data to:

• Provide, maintain and improve the service.
• Manage your account and answer your requests.
• Notify you about updates and events in your games.

Cookies and tracking technologies

Necessary cookies operate the service. If you accept the Analytics category, Exquistory loads Google Analytics 4 to measure explicit game events and anonymized page views. You can withdraw that agreement from the cookie management icon.

• Keep you signed in.
• Remember your preferences, such as language.
• Measure service usage after your agreement, without invitation or contributor tokens, chain identifiers, email addresses, or text written by players.

Sharing data

Anyone with a reveal link can read the story and watch its videos without an account. Unless the organizer chooses an anonymous reveal, attribution uses the part of the email address before @. Avoid sensitive data or information about other people in your contributions.

• The organizer supplies invitation addresses and can see the participant list. Contributions remain hidden according to the game rules until the reveal.
• Resend receives the addresses and email contents needed for sign-in and notifications.
• The account menu avatar loads from Gravatar. Your browser sends a SHA-256 identifier derived from your normalized email address and your IP address; this hash is not anonymization. No page referrer is sent. A local icon appears if the image is unavailable.
• When the organizer enables Slack, Slack receives addresses used to find workspace members and notification contents through direct messages. Email takes over if Slack delivery fails.
• Google Analytics receives anonymized events and pages only with consent. Hosting providers process data needed to operate the service. Provider details and contractual safeguards are available from support.
• Disclosure may also be necessary to comply with a legal obligation or protect users’ rights and security.

Security

We implement measures designed to protect your data against unauthorised access, alteration, disclosure or destruction. Because no transmission over the internet is entirely secure, we encourage you to protect your own credentials as well.

Retention and erasure

Accounts and stories are retained to provide the service while they remain in use. You can request erasure through support. Inactive accounts and stories undergo an annual review of whether continued retention is necessary.

The maintenance procedure provides for purging recipient addresses and message contents for notifications completed more than 30 days ago, including abandoned deliveries. Technical references without message content remain to prevent duplicate deliveries.

Erasure removes or anonymizes the person’s access and texts. Other participants’ contributions remain; affected older videos are removed and may be rebuilt. Support handles copies already sent to providers and backups separately: deleting an account alone does not remove them. Support confirms their removal timeframe based on the systems actually in use.

Your rights

Depending on where you live, you have rights over your personal data:

• Access and correct your data, and request an export of the data you provided.
• Request deletion of your account, contributions and artifacts containing them.
• Withdraw Analytics consent and object to processing where that right applies.

Exercising your rights

To exercise these rights, email boris.bodin@aegis-techno.fr from the address concerned. Support verifies your identity, identifies the affected stories and data, then arranges export or erasure. Your export does not include other participants’ personal data. Removing a contribution requires withdrawing older videos containing it.

Changes to this policy

We may update this policy. Any change is published on this page, together with the last revision date shown at the top of this document.

Contact us

If you have any question about this policy, write to us at boris.bodin@aegis-techno.fr.

You can change your Analytics choice at any time from the cookie management icon.