Privacy Policy
Version 1.0.0 · Effective 2026-07-06
This Privacy Policy explains what personal data Filabs collects when you play Impostor, why we collect it, how long we keep it, and the rights you have. Impostor is a free browser party game: you can play as a guest without an account, or create an optional account.
We keep this document short and plain. If anything is unclear, email contact@filabs.fr.
1. Who we are
The data controller is Filabs, 60 rue François 1er, 75008 Paris, France. For any privacy question, contact us at contact@filabs.fr.
2. What data we collect
We collect only what we need to run the game.
- Guest play data. When you play without an account, you choose a display name and we assign a random guest identifier for the duration of the game room. This is temporary: it lets other players see you in the room and is not linked to any account.
- Account data (optional). If you create an account, we store your email address and your display name. Accounts are created with an email magic link or with "Sign in with Google".
- Sign-in data. For magic-link sign-in we store a short-lived, single-use token tied to your email. If you use "Sign in with Google", we receive from Google your email address and a Google account identifier.
- Usage and analytics events. We record product events (for example "page viewed" or "game started") to understand and improve the game. When you are signed in, an event may be linked to your account; otherwise it is linked to an anonymous identifier we derive from your IP address and browser, not to your identity.
- Technical data. Your IP address, browser user-agent, and request timestamps, used for security, abuse prevention, and debugging.
- Advertising data. Impostor is free and supported by advertising. Where advertising relies on cookies or similar identifiers, our advertising partners may process data about your device — but only after you consent through our consent banner. See section 6 and the Cookie Policy.
We do not collect payment data (Impostor has no paid product), and we do not ask you to upload files.
3. How we use your data
Every processing activity has a defined purpose, legal basis, and retention period.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Guest display name + random guest id | Let you join and play a game room | Legitimate interest (running the game you requested) | Deleted when the room ends or expires |
| Account email + display name | Create and secure your account | Performance of contract | Until you delete your account |
| Magic-link tokens | Passwordless sign-in | Performance of contract | Until used or expired (short-lived) |
| Google account identifier | Sign in with Google | Performance of contract | Until you delete your account |
| Usage / analytics events | Understand and improve the game | Legitimate interest | 24 months |
| Server logs (IP, requests) | Security, abuse prevention, debugging | Legitimate interest | 90 days |
| Advertising identifiers / cookies | Show and measure ads | Consent | Per your consent choice — see Cookie Policy |
You can have your account and everything linked to it deleted at any time — see section 8.
4. Analytics
We measure how the game is used without tracking you across the web.
- Plausible Analytics, self-hosted by us. It is cookie-less, collects no personal identifiers, and produces only aggregate statistics. No data is sent to a third-party analytics company.
- First-party usage events. We record product events in our own database, linked to your account when you are signed in, so we can understand and improve the game. These events never contain the content of your in-game messages.
5. Sub-processors
We share data with a small set of vendors strictly to operate the game. Each one is bound by a data-processing agreement.
| Sub-processor | Purpose | Location |
|---|---|---|
| Google (Sign in with Google) | Optional Google sign-in, only if you choose it | European Union + United States |
| [PLACEHOLDER: hosting provider] | Web hosting and database | [PLACEHOLDER: region] |
| [PLACEHOLDER: email delivery provider] | Sending magic-link sign-in emails | [PLACEHOLDER: region] |
| [PLACEHOLDER: advertising partner(s)] | Showing and measuring ads, subject to your consent | [PLACEHOLDER: region] |
We update this list when it changes. Material changes are notified to account holders by email.
6. Advertising and consent
Impostor is free and supported by advertising. Advertising that relies on cookies or similar identifiers is not active until you consent through our consent banner. You can accept, reject, or customise advertising cookies, and you can change your choice at any time from the "Cookie preferences" link. If you reject, you can still play the game. The legal basis for advertising cookies is your consent, which you may withdraw at any time. See the Cookie Policy for details.
7. Your rights
If you are in the EU, the UK, or another jurisdiction with comparable data-protection law, you have the right to:
- Access the personal data we hold about you.
- Correct data that is inaccurate.
- Delete your data (the right to erasure).
- Restrict or object to certain processing.
- Receive a copy of your data in a portable format.
- Withdraw consent at any time for processing based on consent (for example, advertising cookies).
- Lodge a complaint with your local data protection authority (in France, the CNIL — cnil.fr).
8. How to exercise your rights, including erasure
To exercise any right — including your right to erasure — email contact@filabs.fr from or with the address on your account. We handle deletion through our data-deletion process, which removes your account data, your sign-in identifiers, and the usage events linked to you. We respond within 30 days and may ask you to verify your identity first. Guest play data is not linked to an identity and is removed automatically when the game room ends.
9. Security
We protect your data with standard measures: TLS in transit, encryption at rest on the database, access restricted by role, and audit logging on administrative actions. No system is completely secure; if we discover a breach affecting your data, we notify you and the relevant authority as required by law.
10. Children
Impostor is intended for users 16 and over. We do not knowingly collect data from children under 16. If we discover an account belonging to a child under 16, we delete it and its data. If you are a parent or guardian and believe your child is using the game, email contact@filabs.fr.
11. Changes to this policy
We may update this policy when our practices, vendors, or legal obligations change. The version and effectiveDate at the top reflect the current version. Material changes are notified to account holders by email.
12. Contact
For any question about this policy or the data we hold about you, email contact@filabs.fr.