Privacy policy
Last updated: 1 October 2026
Data controller: Vincent Tariel-Adam, publisher of CommeUnJeu
(see the legal notice).
Contact: contact@commeunjeu.org
1. What we collect, and why
| Data | Why | How long |
|---|---|---|
| Username, e-mail address | Create the account, sign in, reset the password | As long as the account exists |
| Password | Signing in — stored hashed, never in clear text | As long as the account exists |
| Year of birth | To know whether the pupil is under 15 (section 6) and show them the right notice | As long as the account exists |
| Class and curriculum, language | Show the right lessons in the right language | As long as the account exists |
| Answers to exercises, marks, dates | Show the pupil where they stand and what to revise | As long as the account exists |
| Photo or on-screen pages of handwritten work (optional) | To have it graded by our AI tool (section 3) | Deleted as soon as the grading is returned; at the latest one hour after it was sent |
| Subscription: Stripe identifiers, renewal date | Give the paid access and cancel it | As long as the account exists |
| Newsletter (optional): e-mail address, first name | Send you CommeUnJeu's news, if you subscribed to it | Until you unsubscribe |
| Server logs (IP address, page requested) | Security, diagnosing failures, and aggregate visit statistics: numbers of visitors a day, computed on our own server, without cookies or profiles | 12 months at most |
We ask for no postal address, no telephone number and no profile picture. We never see your card number: it is typed at Stripe. Deleting an account removes all of this data; the server logs expire on their own.
2. On what legal basis
The account, the progress, the grading of exercises and the AI grading are the performance of the service you ask for (GDPR art. 6-1-b): without them there is no service. The security of the site and the server logs rest on our legitimate interest (art. 6-1-f). We set no advertising tracker, so we ask for no advertising consent. The newsletter rests on your consent (art. 6-1-a), given when you confirm your address; you withdraw it at any time with the unsubscribe link in every letter.
3. AI grading, in detail
When a pupil photographs their work or writes their answer on screen to have it graded:
- the image is checked, turned upright, scaled down and re-encoded, which removes its metadata — including the GPS position a phone adds to it;
- it is stored under a randomly generated name, in a folder no web server publishes;
- it is sent to OpenAI (OpenAI, L.L.C., United States) together with the text of the exercise and the school level, without the pupil's name or e-mail address;
- it is deleted from our server as soon as the grading is returned, and also when the grading fails.
This transfer outside the European Union relies on the European Commission's standard contractual clauses, which we accept in OpenAI's terms. OpenAI states that data sent through its API is not used to train its models. This feature is optional: every other exercise is graded on our own server, with no third party. The advice we repeat under the button: frame the work only, without the name.
4. Who else sees anything
| Who | What | Where |
|---|---|---|
| OVH (hosting) | The server and the database, so all of the data above | An OVH data centre; a French company |
| Stripe (payments) | Your e-mail address and your payment | Ireland and the United States |
| OpenAI (AI grading) | The photo and the exercise, if you use that feature | United States |
| Sign in with Google if you choose it; reCAPTCHA at registration; the web fonts, and the mail the site sends you leaves from a Gmail mailbox | United States | |
| Cloudflare | The Turnstile anti-robot check, and the JavaScript libraries the pages load: your IP address is visible to it | United States |
| YouTube (Google) | Lesson videos are played from YouTube: your IP address is visible to it as soon as the page is shown | United States |
| Google Play, Apple | If you subscribe from the mobile app, the store handles the payment | United States |
| Brevo (Sendinblue SAS, newsletter) | Your e-mail address and first name, if you subscribe to the newsletter | European Union; a French company |
We do not sell, rent or exchange any data. Nobody receives this data for advertising.
5. Cookies and audience measurement
The site sets a session cookie (to keep you signed in) and a form anti-forgery cookie. They are necessary for it to work and are not used to follow you. The slate (“Write on screen”) keeps the draft of an answer on your device, in the browser's local storage; it reaches us only when the pupil checks the answer, and it is erased once the answer is graded, or as soon as another account opens an exercise on this device. No advertising tracker, no profiling. The Google Analytics tag that used to be on every page was removed on 22 September 2026. If audience measurement is added later it will be within the French data protection authority's consent exemption, and this page will say so.
6. Pupils under 15
In France a child can consent alone to the processing of their data from the age of 15 (GDPR art. 8 and the French Data Protection Act art. 45). Here nothing rests on consent: the account and the grading are the service being asked for. We ask for the year of birth at registration, and a pupil under 15 reads a notice inviting them to talk about it with their parents.
- The service is the same at every age.
- A parent or legal guardian can ask for access, correction or deletion of their child's account at any time by writing to contact@commeunjeu.org; deletion is also available directly from the Delete my account page.
- A paid subscription is confirmed by an adult: a tick box states it at the moment of payment.
- No advertising, no profiling, no data sold.
7. Your rights
You may ask for access to your data, its correction, its deletion, the restriction of processing, and you may object to processing based on our legitimate interest. Write to contact@commeunjeu.org: we answer within a month. You can delete your account yourself from Delete my account; that also cancels any running subscription. If our answer does not satisfy you, you may complain to the French data protection authority, the CNIL.
8. Security
Everything goes over HTTPS. Passwords are hashed. Photos and on-screen pages sit outside any public URL and are deleted after grading. Access to the server is restricted. No system is completely safe: if an incident affected your data, we would tell you.
9. Changes
This page changes when the service changes. The date at the top gives the latest version. An important change will be announced by e-mail or on the site.