Last updated: September 9, 2026

Notice version: 2026-08-18

This policy explains how Egako Games Inc. (“Egako,” “we,” “us”) collects, uses, discloses, retains, and protects personal information in connection with the Babelouette game, its mobile application, and its online services.

It does not apply to Egako’s general website, which has its own privacy policy.

1. Who is responsible for your information?

Egako Games Inc., a corporation incorporated in Québec, is responsible for the personal information processed for Babelouette.

Privacy Officer

Egako Games Inc.

Québec, Canada

privacy@egakogames.com

2. Intended audience

Babelouette is a cultural game intended primarily for older teenagers and adults. It is not designed or marketed specifically to children under 14.

A person under 14 should not create a profile without permission from a parent or guardian. A parent or guardian who believes that a child submitted information without authorization may contact us to request its deletion.

We do not ask players for their date of birth and do not perform automated age verification.

3. Player profile creation and recovery

A player profile is created only when the player initiates the onboarding process. Babelouette does not automatically create a profile before that action.

The profile is an online guest profile. It does not use an email address or password. It is recognized through a random identifier and a session stored on the device.

Players can normally retrieve their progress during a later use on the same installation while that session remains available and valid. Babelouette cannot currently recover a profile automatically after the session is lost, the application’s data is erased, the application is reinstalled, or the player changes devices.

4. Information we collect

Player profile

When you create a profile, we collect or generate:

• the username you choose;
• a random player identifier;
• the profile’s creation, modification, and last-activity dates;
• your choice about appearing on the public leaderboard;
• the version of the privacy notice shown to you and the date on which you acknowledged it.

The username must contain between 3 and 16 letters, numbers, or underscores. Do not use your full name, email address, or other personal information as your username.

Game progress and activity

To operate the game and save your progress, we process information such as:

• the number of games played;
• scores, best scores, and points associated with game categories;
• progress against each boss, applicable objectives, and defeated bosses;
• expressions encountered, discovered, or marked as favourites in the grimoire;
• questions presented, answers selected, answer accuracy, points awarded, remaining lives, and game state;
• information required for boss-specific mechanics, such as correct-answer streaks, mood, or wave progress;
• dates and times associated with these events.

Authentication and security

To maintain and protect your session, we process:

• a temporary access token;
• a refresh token stored on the device;
• a hash of the refresh token stored on our servers;
• session expiration, rotation, and revocation dates;
• technical session identifiers.

The raw refresh token is not stored in our database.

Technical connection information

When the application communicates with our API, our infrastructure may process:

• the IP address required to route the connection, protect the service, and limit abusive requests;
• a random identifier assigned to each request;
• the request method and path;
• the response status, duration, and time;
• other technical information generated by the hosting provider to secure and operate its service.

Babelouette’s ordinary application logs do not intentionally record the content of player answers, authentication tokens, IP addresses, or a permanent device identifier. The hosting provider may nevertheless process technical information in its own infrastructure logs.

Information stored locally

The application stores the player identifier, username, and information required to restore the session on your device. On Android, the refresh token is encrypted using a key protected by Android Keystore.

This local information is erased when you delete your profile from within the game. It may also disappear if you erase the application’s data or uninstall it.

5. Information we do not currently collect

Babelouette does not currently request or collect:

• your legal name;
• your email address, phone number, or postal address;
• your date of birth;
• your contacts, photos, or personal files;
• your GPS position or precise location;
• an advertising identifier;
• payment information;
• information used for targeted advertising;
• behavioural analytics or marketing events;
• data from an advertising or third-party analytics SDK.

Google Play and the App Store may process their own information when you download or use an application. Their practices are governed by their respective policies. Egako may receive aggregated statistics from these stores that do not directly identify an individual player.

6. Purposes and legal bases

We use the information described in this policy to:

• create and recognize your player profile;
• synchronize and restore progress on the same installation;
• provide questions, calculate results, and operate game mechanics;
• maintain score integrity and prevent the same attempt from being credited more than once;
• manage the grimoire and favourites;
• display the leaderboard when a player chooses to participate;
• maintain and secure the session;
• prevent abuse, limit excessive requests, and diagnose errors;
• respond to privacy-related requests;
• comply with legal obligations.

Depending on the law that applies, these activities rely on providing the service you requested, your consent where required, our legitimate interests in operating and securing Babelouette, or compliance with a legal obligation.

We do not use this information for targeted advertising and do not create advertising profiles.

7. Public leaderboard

Participation in the leaderboard is optional and disabled by default.

If you enable it, your username, points, and best score may be visible to other players. You can remove your profile from the leaderboard without losing your progress. Deleting the profile completely also removes it from the leaderboard.

8. Service providers and disclosure

We do not sell or rent players’ personal information.

We use service providers that process certain information on our behalf:

• Hostinger, which hosts the API, transports requests, and produces technical infrastructure logs;
• MongoDB Atlas, which hosts the database containing profiles, progress, scores, attempts, and token hashes;
• cloud infrastructure providers used by MongoDB Atlas to deliver its service.

These providers are authorized to process information to provide, maintain, and secure their services in accordance with their contractual commitments and applicable laws.

We may also disclose information when required by law, in response to a valid order, or to protect the rights, safety, and integrity of Babelouette, Egako, or its users.

9. Processing outside Québec and Canada

The API and database currently used by Babelouette are hosted in the United States. Some providers or subprocessors may also process information in other jurisdictions.

The laws of those jurisdictions may differ from those of Québec and Canada. Egako assesses the privacy factors applicable to this processing and uses contractual, administrative, and technical measures intended to protect the information.

10. Retention

We retain information only for as long as it is needed for the purposes described in this policy:

• quiz attempts and detailed answers: approximately 24 hours, followed by automatic deletion;
• refresh-token hashes: no more than 30 days per token, with earlier deletion or revocation upon rotation, logout, or profile deletion;
• profile, username, progress, grimoire, favourites, and point totals: until the player requests profile deletion;
• score history: until profile deletion in the current version;
• technical infrastructure logs: for the period established by the hosting provider and required for diagnostics, security, and service operations.

The MongoDB Atlas environment currently in use does not include Atlas-managed automatic backups. If backups are added, they will be subject to a limited retention period and an appropriate deletion procedure, and this policy will be updated where necessary.

When information is no longer required and no legal obligation requires its retention, it is destroyed or anonymized in accordance with applicable requirements.

11. Profile and data deletion

You can delete your profile directly in Babelouette:

1. open the Profile panel;
2. select Delete my profile;
3. confirm the deletion.

Deletion is permanent. It includes:

• the profile, player identifier, and username;
• progress, points, grimoire entries, and favourites;
• any quiz attempts still present;
• score history;
• boss progress;
• associated sessions and refresh tokens.

It also removes the player from the public leaderboard and erases the identity and session information stored locally by the application.

If you no longer have access to the game, visit the following page for the manual request procedure:

https://egakogames.com/en/games/babelouette/data-deletion/

Write to privacy@egakogames.com and provide the exact username of the profile you want deleted. Egako will process the request manually and may ask for additional information reasonably necessary to locate the correct profile and assess whether the request is legitimate.

Because Babelouette does not collect your email address when the profile is created, the address used to contact us is not automatically associated with the profile. The username allows us to locate a profile, but it is not conclusive proof of ownership by itself. We will therefore assess each request based on the information available and will not delete a profile when a request appears ambiguous, abusive, or insufficiently supported.

We will process requests within a reasonable period and within the deadlines required by applicable law. If certain information must be retained for a legal obligation, security, or fraud prevention, we will explain what must be retained and why.

12. Your rights

Depending on where you live and the laws that apply, you may have the right to request:

• access to the personal information we hold about you;
• correction of inaccurate information;
• withdrawal of an applicable consent, including participation in the public leaderboard;
• deletion of your profile and associated information;
• a computerized copy of information you provided where a right to data portability applies;
• restriction of, or objection to, certain processing where provided by law;
• additional information about our retention and disclosure practices.

To exercise a right or make a complaint, contact the Privacy Officer at privacy@egakogames.com.

We will respond within the time required by applicable law. If you are dissatisfied with our response, you may contact the competent supervisory authority, including Québec’s Commission d’accès à l’information or, in the European Economic Area, the data protection authority in your country.

13. Security measures

We use administrative, technical, and contractual safeguards appropriate to the nature of the information, including:

• HTTPS encryption for communications;
• short-lived access tokens;
• refresh-token rotation and revocation;
• hashing of tokens stored on the server;
• protected refresh-token storage on Android;
• validation of information sent to the API;
• request rate limiting;
• access restrictions for the database and hosting environments;
• deletion of associated information when a profile is deleted.

No security measure eliminates all risk. If an incident creates a risk of serious harm, we will take the measures required by law and notify affected individuals and authorities where required.

14. Changes to this policy

We may update this policy to reflect changes to Babelouette, our providers, our practices, or applicable laws.

The date and version shown at the beginning identify the policy in effect. If a material change affects the collection, use, or disclosure of information, we will provide an appropriate notice in the application or through another reasonable means.

15. Contact us

For questions, requests, or complaints about Babelouette and privacy:

Privacy Officer

Egako Games Inc.

Québec, Canada

privacy@egakogames.com