BROODZ
Back to home

Privacy Policy

Last updated: 29 July 2026

1. Preamble and scope

This Privacy Policy describes how Coredump Engineering collects, uses, retains and protects the personal data of users of the BROODZ service, a free multiplayer game accessible from a web browser at broodz.com (the "Service").

It applies to all processing carried out in connection with the Service, in compliance with Regulation (EU) 2016/679 ("GDPR") and French Act No. 78-17 of 6 January 1978, as amended (the "French Data Protection Act").

2. Data controller

The controller of personal data is:

  • Company name: COREDUMP ENGINEERING
  • Legal form: single-shareholder simplified joint-stock company (société par actions simplifiée à associé unique, SASU)
  • Share capital: EUR 10,000.00
  • Registered office: 61 rue de Lyon, 75012 Paris, France
  • SIREN: 943 070 755
  • Trade & Companies Register: 943 070 755 R.C.S. Paris (registered on 11/04/2025)
  • Represented by its legal representative
  • Data-protection contact: dpo@broodz.com

3. Data-protection contact

Any question or request concerning your personal data may be sent to dpo@broodz.com.

4. Data we collect

We collect only the data necessary to operate the Service:

  • No email address, no password: signing in happens solely with a third-party identity provider. We never ask you for an email address, we verify none, and we hold no password for a Broodz account.
  • Account data (Google): when you sign in with Google (the "openid profile" authorization scope), we receive from Google your account name and a stable Google identifier. We do not receive your email address.
  • Account data (Facebook): when you sign in with Facebook Login (the public_profile and email permissions), we receive from Meta Platforms, Inc. your name, a stable Facebook user identifier and, only if you grant it, your email address, which we neither store nor use. We never receive your Facebook password or your friends list.
  • Account data (Snapchat): when you sign in with Login with Snapchat (the Display Name permission), we receive from Snap Inc. your Snapchat Display Name and a stable Snapchat external identifier. We never receive your email address, Bitmoji, friends or Snaps.
  • Account data (TikTok): when you sign in with Login Kit for TikTok (the user.info.basic scope), we receive from TikTok Technology Limited your TikTok display name and a stable per-app TikTok identifier (open_id). We never receive your email address.
  • Session data: a strictly necessary session cookie named __Host-brood_session, which keeps you signed in and secures your session. This cookie does not contain a cleartext access token: it references a server-side session.
  • Game data: your username (nickname), your scores and your leaderboard rank, along with related match data. Your username, score and rank may be displayed publicly on leaderboards visible to other players; we recommend choosing a nickname that does not reveal your identity.

We do not collect payment data: the Service is free of charge.

5. Purposes and legal bases

Data / processing Purpose Legal basis (GDPR)
Name, Google identifier (Google sign-in) Create and authenticate your account, identify you persistently Performance of a contract (Art. 6(1)(b))
Name, Facebook identifier (Facebook sign-in) Create and authenticate your account, identify you persistently Performance of a contract (Art. 6(1)(b))
Display name, Snapchat external identifier (Snapchat sign-in) Create and authenticate your account, identify you persistently Performance of a contract (Art. 6(1)(b))
Display name, TikTok identifier (TikTok sign-in) Create and authenticate your account, identify you persistently Performance of a contract (Art. 6(1)(b))
__Host-brood_session cookie Maintain the session, secure access Strictly necessary cookie, exempt from consent (Art. 6(1)(f) GDPR; Art. 82 French Data Protection Act)
Username, scores, rank Operate the game, build and display leaderboards Performance of a contract (Art. 6(1)(b)) and legitimate interest for the public leaderboard display (Art. 6(1)(f))
Audience measurement (self-hosted Matomo, cookieless) Measure and improve usage of the Service Legitimate interest (Art. 6(1)(f)); audience measurement exempt from consent under Art. 82 of the French Data Protection Act
Technical connection logs Security, abuse prevention, legal obligations Legitimate interest (Art. 6(1)(f)) and, where applicable, legal obligation (Art. 6(1)(c))

6. Cookies and trackers

  • __Host-brood_session cookie: strictly necessary to operate the Service (session authentication and security). It is exempt from consent. Its lifetime is 7 sliding days (604,800 s), renewed on each activity.
  • __Host-brood_oauth cookie: a temporary security cookie set only during the sign-in procedure to prevent cross-site request forgery (CSRF) attacks. Strictly necessary, it is exempt from consent and deleted at the end of the sign-in procedure.
  • Audience measurement (self-hosted Matomo). Usage of the Service is measured through a Matomo instance that we host ourselves, configured without cookies and without cross-site tracking. This setup falls within the consent exemption recognised by the CNIL for audience measurement: it sets no cookie and does not require your consent. You may object to this audience measurement by writing to dpo@broodz.com.
  • A cookie preferences panel is available on the Service. Strictly necessary cookies remain always active there, and the exempt audience measurement is not subject to it; this panel is intended to collect your consent for any future non-exempt trackers, which are not used to date.
  • We do not use advertising cookies or trackers for targeting purposes.

7. Recipients and processors

Your data is neither sold nor rented. It may be shared with the following categories of recipients, strictly within the limits of their duties:

  • OVH (OVH SAS / OVHcloud): host of the Service, acting as a processor. Data is hosted within the European Union.
  • Google (Google Ireland Limited / Google LLC): authentication provider ("Sign in with Google").
  • Meta Platforms, Inc. (Facebook Login): authentication provider ("Sign in with Facebook").
  • Snap Inc. (Login with Snapchat): authentication provider ("Sign in with Snapchat").
  • TikTok Technology Limited (Login Kit for TikTok): authentication provider ("Sign in with TikTok").
  • Matomo audience measurement is self-hosted: the statistics are not shared with any third party.

Other social sign-in methods may be offered later; this policy will be updated upon their activation. Your data may also be disclosed to administrative or judicial authorities where required by law.

Facebook is a trademark of Meta Platforms, Inc.; Broodz is not affiliated with or endorsed by Meta.

Snapchat is a trademark of Snap Inc.; Broodz is not affiliated with or endorsed by Snap Inc.

TikTok is a trademark of ByteDance Ltd.; Broodz is not affiliated with or endorsed by TikTok.

8. Hosting and data location

The Service and its data are hosted by OVH within the European Union. Matomo audience measurement is hosted under the same conditions.

9. Transfers of data outside the European Union

The use of Google, Facebook, Snapchat or TikTok for authentication may result in the transfer of certain data to a country located outside the European Union, in particular the United States. Such transfers are governed by appropriate safeguards within the meaning of the GDPR (the "EU-U.S. Data Privacy Framework" adequacy decision and/or the European Commission's standard contractual clauses).

Hosting of the Service (OVH) and audience measurement (self-hosted Matomo) both take place within the European Union and involve no transfer outside the Union.

10. Retention periods

  • Account and game data (name, chosen in-game avatar, Google, Facebook, Snapchat or TikTok identifier, nickname, scores, rank): retained for as long as your account is active, then deleted when you delete your account (see § 12). They are subsequently erased from backups within approximately 30 days.
  • Session cookie __Host-brood_session: 7 sliding days (604,800 s).
  • Technical connection logs: retained for approximately 12 months.
  • Matomo audience measurement: usage data retained for a maximum of 25 months, in line with CNIL recommendations.

11. Your rights

In accordance with the GDPR and the French Data Protection Act, you have the rights of access, rectification, erasure ("right to be forgotten"), restriction, portability and objection over your data, as well as the right to give instructions regarding what happens to your data after your death.

You may exercise these rights by writing to dpo@broodz.com. We may ask you to verify your identity. We will respond within the time limit set by the regulation (in principle, one month).

Complaint: if, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr).

12. Deleting your account

You may delete your account at any time directly from the Service, via your profile page. Deletion erases your account and game data, subject to legal retention periods and backup purge (see § 10).

13. Minors

The Service is reserved for persons aged at least 13. It is not intended for children under 13, whose data we do not knowingly collect.

In accordance with the French Data Protection Act, in France a minor's consent to the processing of their data in connection with an online service is validly given alone only from the age of 15. For a user aged 13 to 15, the authorisation of the holder(s) of parental authority is required. If you hold parental authority and believe a minor has provided us with data without authorisation, please write to dpo@broodz.com so that we can delete it.

14. Security

Coredump Engineering implements appropriate technical and organisational measures to protect your data, including encryption of communications (HTTPS/TLS), server-side handling of authentication tokens and the use of a signed __Host--prefixed session cookie, in order to prevent any unauthorised access, alteration or disclosure.

We will never ask you for the password of your Google, Facebook, Snapchat or TikTok account: signing in takes place entirely at the provider you chose.

15. Changes to this policy

This policy may be amended to reflect changes to the Service. The applicable version is the one published on broodz.com, identified by its update date.

16. Contact

For any question regarding this policy or your personal data: dpo@broodz.com.