Privacy notice — DeRochesGaming
Last updated: 22 October 2026
This notice covers the DeRochesGaming site, its premium games (whether you play them on the site or in the DeRochesGaming Activity on Discord) and our daily games (Bust or Bank, Rarest, Three Views). It says what we collect, why, who handles it for us, how long we keep it, and how to get a copy or have it deleted. We only describe what our games actually do.
1. Who we are
DeRochesGaming is run by Richard Dépierre, 205 rue de Fontcarrade, 34070 Montpellier, France ("we"). We decide what happens to the data described here (we are the "controller").
Contact for any privacy question or request: deroches.gaming@gmail.com.
2. The short version
- You can play without an account. As a guest, your progress is saved on your device only.
- If you choose to sign in with Discord, we keep your Discord user id, your display name, your saves and the items you own, so your progress follows you between the site and Discord.
- We never get or keep your email address, your Discord password, your avatar, your server list or your Discord tokens.
- To improve the games we count anonymous game events, and we receive crash reports. Neither contains your name, your Discord id or your IP address.
- We don't sell your data and we don't show ads.
- You can download everything we hold about your account, or delete it, at any time.
3. Playing as a guest (no account)
Guest play is the default. Nothing that identifies you by name is stored on our servers.
On your device, in your browser's storage:
- in the premium games, your save (in the browser's IndexedDB);
- in the daily games, your language choice and, in Bust or Bank, your streak and your rounds;
- a random analytics id (see §6): one for each premium game, and one for each daily game's site.
They stay until you clear your browser's data for the site.
On our servers, for the daily games:
- Bust or Bank counts how many players reached each score each day, to tell you how you ranked. It doesn't store who you are.
- Rarest counts how many players gave each answer each day. To let each player answer only once a day, it also keeps a fingerprint (hash) of the day and your random id. The fingerprint can't be read back into the id, and the fingerprints of two different days can't be linked to each other. The game matches what you type on your device and sends only the matching answer from its list, never what you typed.
What reaches us anyway: every request your browser makes to our site and games passes through Cloudflare, which keeps short-lived technical logs (§5), and the games send anonymous events (§6) and crash reports (§7).
4. Signing in with Discord (optional)
Sign-in is not available yet. This section applies once it is switched on.
What Discord gives us. When you sign in, Discord asks you to share your basic account information with us (the
identify permission, which does not include your email). We then keep only:
| What we keep | Why |
|---|---|
| An internal player id and your Discord user id | To recognise you the next time you sign in, on the site or in Discord. |
| Your display name (your Discord display name, or your username if you have none), refreshed each time you sign in | To show you who is signed in. Today nobody else sees it. |
| Sessions: a fingerprint (hash) of your sign-in token, when it expires (30 days) and whether you signed in on the site or in Discord | To keep you signed in. We never keep the token itself. |
| Your saves: one save per game | So your progress follows you. When you first sign in, your guest save moves to your account. |
| The items you own (cosmetics: what, where they came from — a Discord purchase, a site purchase or a gift — and when) | So you keep what you bought or were given. |
| Later, purchase records (see §8) | Accounting and refunds. |
What we never keep: your email address, avatar, Discord servers, Discord access or refresh tokens, or your password (you type it only on Discord).
Cookies. On the site, signing in sets two cookies, both needed for the sign-in you asked for:
__Host-dg_oauth (protects the sign-in against forgery, deleted after 10 minutes or at the end of the sign-in) and
__Host-dg_session (keeps you signed in, 30 days, removed when you sign out). Inside Discord we use no cookies: the
session is held in memory. We use no advertising or tracking cookies.
Inside Discord. The Activity runs inside Discord, and Discord handles your use of Discord, including the Activity, under its own privacy policy (discord.com/privacy). Discord is responsible for your Discord account; we are responsible for what we keep, listed above.
5. Hosting and technical logs (Cloudflare)
Our site, games and account service run on Cloudflare (Cloudflare Workers, and Cloudflare D1 databases). Cloudflare processes this data on our behalf.
For each request to our site and games, Cloudflare keeps a technical log: the address requested, your IP address, your browser and language, and an approximate location derived from your IP (down to city level). Sign-in cookies are masked. These logs are kept for 3 days. For a small sample of requests (about 1 in 100), Cloudflare also keeps a performance trace, without your IP address but with the same approximate location, for 7 days. Our account service keeps no such log or trace: it only logs its own error messages, never player data.
Account data is stored in the European Union.
6. Anonymous game statistics (PostHog)
To learn which games people enjoy and where they get stuck, our games send events such as "a session started", "a round finished" or "a result was shared", with the game, its version, the platform (web or Discord), the language and the day (for a daily game, the puzzle's day). Events are tied to a random id created on your device (stored in your browser), never to your name, your Discord id or your account, even when you are signed in. They never contain anything you typed.
Events go first to our own server, which forwards them to PostHog, hosted in the EU (Frankfurt). PostHog therefore never sees your IP address, and we turn its location lookup off. PostHog keeps events for 1 year.
Because the id is random and not linked to your account, we can't find your events from your account. Clearing your browser's storage gives you a new id.
7. Crash reports (Sentry)
When a game crashes, it sends us the error's type, message and technical trace (cut short), plus your browser's user-agent (browser and system version). Our server adds the game and version and forwards the report to Sentry, which stores it in the EU (Frankfurt) for 30 days. Reports contain no player id and nothing you typed, and because they come from our server, Sentry doesn't receive your IP address.
8. Purchases
Nothing is on sale yet. Paying will require signing in. In Discord, you will buy through Discord, which handles the payment. On the site, purchases are not open yet; before they open, we will update this notice to name the company that sells to you and handles the payment. We never see your card or bank details. We will receive a confirmation from Discord or that company and record: the order reference, the item, the game, the price and currency, the status (completed or refunded) and the dates.
We keep purchase records for 2 years after the purchase. If you delete your account before then, we keep them without the link to you.
9. Why we use your data (legal basis)
| Use | Legal basis (GDPR art. 6(1)) |
|---|---|
| Your account, sessions, saves and owned items | (b) providing the service you asked for |
| Purchase records | (c) legal obligation (accounting) |
| Technical logs | (f) legitimate interest: running and securing the service |
| Rarest's once-a-day fingerprint | (f) legitimate interest: keeping the daily counts fair |
| Anonymous game statistics | (f) legitimate interest: improving the games |
| Crash reports | (f) legitimate interest: fixing bugs |
Where we rely on legitimate interest, you can object (§12).
10. Who else handles your data
| Who | What for | Role |
|---|---|---|
| Cloudflare | Hosting, databases, technical logs | Processor, acting on our instructions |
| PostHog (EU Cloud, Frankfurt) | Game statistics | Processor, acting on our instructions |
| Sentry (EU, Frankfurt) | Crash reports | Processor, acting on our instructions |
| Discord | Sign-in; the Activity; purchases in Discord | Responsible for your Discord account, under its own privacy policy |
We don't sell or share your data with anyone else, and we use no advertising services.
Outside the EU. Cloudflare is a US company and may process data in the US; it relies on the EU-US Data Privacy Framework and, as a fallback, the European Commission's standard contractual clauses.
11. How long we keep it
| Data | How long |
|---|---|
| Saves, language, streak and analytics id on your device | Until you clear your browser's data |
| Daily score and answer counts (Bust or Bank, Rarest) | No time limit: they say nothing about who you are |
| Rarest's once-a-day fingerprints | Deleted after 2 days: the first answer any player sends once a fingerprint is 2 days old (Paris time) deletes it automatically |
| Account (player id, Discord id, display name) | Until you delete your account |
| Sessions | 30 days; expired ones are removed the next time you sign in, and all of them when you delete your account |
| Saves and owned items | Until you delete your account (an item also goes if its purchase is refunded) |
| Purchase records | 2 years after the purchase, without the link to you once your account is deleted |
| Cloudflare technical logs | 3 days (performance traces: 7 days) |
| Game statistics (PostHog) | 1 year |
| Crash reports (Sentry) | 30 days |
12. Your rights, and how to use them
You can ask for a copy of your data, correct it, have it deleted, restrict its use, take it with you, and object to uses based on our legitimate interest (GDPR articles 15 to 21).
- Copy of your data: signed in, use Download my data on your account page. You get a file with your account, sessions, saves and items.
- Delete your account: signed in, use Delete my account on your account page. This removes your account, sessions, saves and items at once. If you share a game world with other players, the world stays for them. In a premium game, the settings menu links to your account page.
- Your display name comes from Discord: change it there and it updates at your next sign-in.
- Anything else, or if you can't sign in: write to deroches.gaming@gmail.com. We answer within one month, which can be extended by two months for complex requests; we will tell you if so.
You can also complain to the French data protection authority, the CNIL (www.cnil.fr), or to the authority where you live or work.
13. Age
To sign in you need a Discord account, and Discord requires you to be at least 13, or older where your country's law requires.
14. Changes
If we change what we collect or why, we update this notice and its date before the change applies, and tell signed-in players in the games.