Privacy policy

1. Person in charge

Mirage Informatique is a one-person independent game studio in Quebec. The person in charge of the protection of personal information is the studio's owner.

For any question, request or complaint: support@miragehosting.com, attention: person in charge of the protection of personal information.

2. Scope and consent

This policy covers the mobile games by Mirage Informatique published on Google Play, their online features, and this website.

• Online play is off by default. Before anything is sent, the game shows a consent card that presents this policy and the terms of service. If you say no, nothing is sent to our servers: you play against bots, with all of the game's content.
• Your consent is separate: it only covers the online features described here. We record which version of the policy and terms you accepted, and when.
• You can withdraw your consent at any time (see Your rights).

3. What we collect: Scrap Pandas

Only if you turn online play on. Online play is for asynchronous fights: your car defends while you are away, and you fight other players' cars.

IP address. Like any internet service, our server sees your connection's IP address. The game server uses it in memory for a few minutes to limit abuse (number of requests), without writing it or keeping a proxy access log. Host SSH and firewall security logs may contain IP addresses and are kept for 14 days.

Age. The consent card asks for your year of birth. It is used on your phone to check that you are 14 or older. Only the confirmation "14 or older" goes with your consent.

What stays on your phone. Your game progress (your car parts, your currency, your trophies, your progression) is saved on your phone, not on our servers. The backup code the game can show does not contain your install key.

4. Other games

Scrap Pandas is our only published game. Before we publish another game, or add online features to a game (for example a cloud save or a leaderboard), we will add its section here, and online features will ask for your consent as described above.

5. Ads, purchases and Google Play

Scrap Pandas is distributed through Google Play. It shows ads (Google AdMob) and offers in-app purchases (Google Play Billing). These services are provided by Google, under its own terms and privacy policy. They also work when online play is off.

• Ads (Google AdMob). To show an ad, Google may collect device information, including the advertising ID, the IP address and your interactions with ads. Scrap Pandas shows a full-screen ad between some fights, and rewarded videos that only play if you choose them; the "Remove Ads" purchase turns off the full-screen ads. You can reset or delete your advertising ID in Android settings. In Scrap Pandas, we ask Google to show non-personalized ads only, to every player.
• Purchases (Google Play Billing). Payment is handled by Google. We never see your card, name or address. The game only receives confirmation that a product was bought.
• Google Play. Google handles the download, updates and, if you allow it in Android, crash reports.

Our server sends none of your information to Google or to any other third party, and Google's data does not reach our server.

6. What we do not collect

• Your real name, your email (unless you write to us), your phone number or your mailing address.
• Your location, contacts, photos, microphone or camera.
• The advertising ID, the Android ID or the device model (our server never asks for them).
• Your date or year of birth.
• Payment information.
• Free text: there is no chat and no name to type.
• Game or proxy access logs of IP addresses.

We do not sell or rent your information, and we do no advertising profiling.

7. Why we use this information

• To run online play: create your account, keep your car, find you opponents of similar strength, show your defence results.
• To keep the game fair: check that uploaded cars follow the game's rules, handle reports, limit cheaters and abuse.
• To protect the service: limit the number of requests, diagnose outages, make backups.
• To follow the law and answer your requests (access, deletion, complaints).

We do not use your information for any other purpose without asking you first.

8. Who sees it, who it is shared with

What other players see

When your car is picked as an opponent: your nickname, your car (body, parts, paint), your trophies rounded to the nearest 50, and the tag "PLAYER". Other players never see your player code.

Our providers

• OVHcloud (hosting): our server and our encrypted backups are at OVHcloud, which acts on our behalf under a written data processing agreement and may not use your information for its own purposes. Backups are encrypted before they leave the server: OVHcloud cannot read them.
• Our email provider: if you write to us, your message and email address are kept in our mailbox.
• Our monitoring tools only receive "the server is up" signals, with no player information.

Other cases

We share your information with no one else, unless the law requires it (for example a court order). If the studio or a game were sold, we would tell you before any transfer.

9. Where the data is

• Server: Beauharnois, Quebec (OVHcloud data centre).
• Encrypted backups: Toronto, Ontario, Canada (OVHcloud), and an encrypted copy on the studio's computer in Quebec.
• Google (ads, purchases, Google Play): processed by Google under its terms, possibly outside Quebec and Canada.
• Emails you send us: at our email provider, possibly outside Quebec.

Before communicating information outside Quebec, we carried out a privacy impact assessment, as the law requires.

10. How long we keep it

Requests and emails you send us are kept 1 year after the request is closed, to keep a record of what we did, then deleted.

The deletion journal has one job: if we ever have to restore a backup, accounts deleted since then are deleted again, and never come back.

11. Your rights

• Access and portability: in the game, Settings > Download my online data gives you everything we hold about you, in a JSON file other software can read. You can also ask by email.
• Correction: you can change your nickname in the game (once per 24 hours). For any other correction, write to us.
• Deletion: Settings > Delete my online data, or by email with your player code. See the Delete your data page.
• Withdrawing consent: turn online play off in the settings: nothing more is sent. To also erase what is already on the server, use deletion.
• Explanations: you can ask us how your information is used, and why a decision was made about your account.
• Complaints: write to us first at support@miragehosting.com. You can also complain to the Commission d'accès à l'information du Québec or, outside Quebec, the Office of the Privacy Commissioner of Canada.

We answer in writing within 30 days, free of charge. Because we know neither your name nor your email, your player code (shown in the game's settings) is how we find your account; keep it to yourself.

12. Minors

If you are under 14, online play stays off: you play against bots and we collect nothing about you. We do not ask for a parent's consent instead, because we do not want information about children.

If we learn that an online account belongs to someone under 14, we delete it. A parent can write to us with the player code.

13. Automated decisions

Two automated processes are used online:

• Matchmaking: your opponents are picked automatically from your car's rating, computed by the server.
• Fairness: accounts that look like they cheat may be limited automatically (for example, matched only with similar accounts). You can ask us to review the decision.

When we use your personal information to make a decision based exclusively on automated processing, we tell you so no later than when we tell you about the decision. At your request, we also tell you:

• the personal information used to make the decision;
• the reasons and the main factors and parameters that led to the decision;
• your right to have the personal information used to make the decision corrected.

You may submit your observations to the person in charge (section 1), who can review the decision. Write to support@miragehosting.com with your player code.

Today, cheating restrictions are decided by a person, from reports and checks. Reports alone never restrict an account. If automatic rules go live, we will say so here first.

14. Security

• All traffic between the game and the server is encrypted (HTTPS).
• We do not keep your install key, only its fingerprint: a database leak would not let anyone log in to your account.
• Backups are encrypted before they leave the server.
• Each game has its own database, separate from the others.
• The server sits behind a firewall, installs security updates automatically, and only the person in charge can administer it, with a key protected by a passphrase.
• We keep only the minimum: no name or email, and no game request IP address in app or proxy access logs.
• We test restoring the backups every month.

No system is perfect. If you think you have found a flaw, write to us.

15. Privacy incidents

If an incident affects personal information (for example unauthorized access), we act quickly to contain it, and we record it in our incident register, kept for 5 years.

If the incident presents a risk of serious injury, we promptly notify the Commission d'accès à l'information and the people affected. Because we do not have your contact details, we will notify you with a message in the game and a notice on this website. For people outside Quebec, we also notify the Office of the Privacy Commissioner of Canada when federal law requires it.

16. Governance

• Roles: the studio's owner is the person in charge of the protection of personal information and is the only person with access to player data. No one else has access.
• Retention and destruction: per the table in section 10; an automatic job deletes whatever is past its time every night.
• Requests: a written answer within 30 days at most; every request is logged.
• Complaints: by email to the person in charge, who answers in writing within 30 days at most and points to the recourse before the Commission d'accès à l'information.
• New things: before any new collection, new provider or new online feature, we carry out a privacy impact assessment and update this policy.

17. This website

This site uses no cookies, no analytics, no ads, and no external fonts or scripts. The server keeps no access log with IP addresses.

18. Changes to this policy

We publish each new version here, with its date. If a change affects what we collect or how we use it, the game will ask you to accept the new version before sending anything; without your agreement, online play stays off and you can delete your data.

19. Contact us

Mirage Informatique, person in charge of the protection of personal information: support@miragehosting.com. Include your player code and the name of the game.

If the French and English versions differ, the French version prevails.