Megammon · legal

Privacy policy

Last updated: October 22, 2026

This page explains what personal data Megammon processes when you play, analyze your games or create an account, why, for how long, and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

This English version is provided for convenience. In case of any discrepancy, the French version prevails.

1. Data controller

The data controller is Tellter SAS, a French simplified joint-stock company with a single shareholder (société par actions simplifiée à associé unique), RCS Paris 899 727 606, 9 rue des Colonnes, 75002 Paris, France. For any question about your data: contact@megammon.com.

2. The data we process, why, and for how long

We collect only what the service needs. No advertising, no resale of data; audience measurement (PostHog, see below) is used only to improve the site.

Your account

Data
email address, username, password (stored in hashed, irreversible form), sign-up date, last sign-in, failed sign-in attempts
Purpose
to create your account, sign you in, and protect the account against password-guessing attempts
Legal basis
performance of the terms of use (the service you request); the security of the service (legitimate interest)
Retention
as long as the account exists; erased when you delete it

Sign-in with Google (if you choose it)

Data
your Google account identifier, your email address and the fact that Google has verified it, your first name (to suggest a username). Neither your Google password, nor your picture, nor your contacts.
Purpose
to sign you in or create your account without a password
Legal basis
performance of the terms of use (the service you request)
Retention
as long as the account exists

Sessions

Data
a sign-in token in a cookie (stored hashed on our side), the browser used, the date of last use
Purpose
to keep you signed in and protect your account
Legal basis
performance of the terms of use (the service you request)
Retention
30 days after last use, then deleted

Player profile

Data
username, Elo rating and record; country and profile picture if you add them (the picture is cropped and its metadata, such as where it was taken, is removed)
Purpose
to show them to other players during games, in online match search and in the friends list
Legal basis
performance of the terms of use (the service you request); for the picture and country, your choice, which you can withdraw at any time
Retention
as long as you keep them on your profile

Games

Data
moves, scores, clocks, results, Elo, practice-mode statistics; friends, requests and challenges; online presence (visible to your friends); online match searches
Purpose
to run the game, the rankings and games between friends
Legal basis
performance of the terms of use (the service you request)
Retention
as long as the account exists; a match search, one day. If you delete your account, your games against other players remain in their history, without your name.

Playing as a guest

Data
a random identifier in a cookie (stored hashed on our side) and your games against the bot
Purpose
to find your games again without an account, and link them to your account if you create one
Legal basis
performance of the terms of use (the service you request)
Retention
the cookie, 12 months; the games, up to 12 months after their last activity

Megammon Engine and training

Data
the match files you import (with the usernames of the players they contain), their analyses, your classified mistakes, your exercises and reviews, your usernames on other platforms
Purpose
to analyze your games, measure your level, and offer you exercises
Legal basis
performance of the terms of use (the service you request)
Retention
as long as the account exists

Explanations by artificial intelligence

Data
the game data of the decision to be explained (position, moves, engine figures), without username or email address
Purpose
to write the explanation you request (Anthropic, see below)
Legal basis
performance of the terms of use (the service you request)
Retention
explanations are kept in a cache; they contain no personal data

Origin of visits and sign-ups

Data
the campaign parameters of the address visited (utm_source, utm_medium, utm_campaign, utm_term, utm_content), advertising click identifiers (Google, including gbraid and wbraid on iPhone and iPad, Meta, Microsoft, TikTok, X, LinkedIn), the site you came from, the landing page and the date of your first visit and of your latest visit coming from another site; at sign-up, the browser, operating system, device type and language are added
Purpose
to know where our players come from and which campaigns work; if you arrived through one of our Google ads, to report your sign-up and your first game to Google Ads (see below)
Legal basis
our legitimate interest in measuring the effectiveness of our communication; you can object to it
Retention
13 months in your browser; once linked to your account, 25 months after sign-up, then erased; Google click identifiers (gclid, gbraid, wbraid) are erased from your account 90 days after the click

Audience measurement and product analytics

Data
pages viewed, clicks and path through the site, length of visits, the site you came from and campaign parameters, device, browser, language, country and city inferred from the IP address, errors and loading times; recordings of your visits (what is displayed and your actions, with input fields masked); if you have an account, your actions on Megammon (sign-up, sign-ins, games and results, analyses, features used), linked to your identifier, username, email address, country and Elo rating
Purpose
to understand how Megammon is used and where our players come from, in order to improve it (PostHog, see below)
Legal basis
our legitimate interest in measuring and improving the service; you can object to it at any time on this device (“Cookies” section) or by writing to us
Retention
visit recordings, 30 days; other data, the period set by our PostHog plan (1 year for the free plan, up to 7 years for paid plans)

Feedback

Data
rating, category, message and the page you are writing from, linked to your account
Purpose
to fix and improve Megammon
Legal basis
our legitimate interest in improving the service
Retention
3 years

Emails

Data
email address and username
Purpose
to verify your address and reset a forgotten password
Legal basis
performance of the terms of use (the service you request)
Retention
links sent expire after 48 hours (verification) or 2 hours (password) and are deleted no later than one day after use

Technical logs

Data
IP address, date and time, page or request, browser, recorded by our hosting providers
Purpose
to operate the service, protect it against abuse, and fix outages
Legal basis
our legitimate interest in ensuring the security and proper functioning of the service
Retention
a limited period, set by the hosting providers

3. Who receives your data

  • Other players see your player profile (username, picture, country, Elo rating) and your moves during the games you play with them.
  • Our service providers, who process the data on our behalf and according to our instructions:
    • Vercel Inc.: hosting (website front end, megammon.com), in the United States;
    • Railway Corporation: hosting (game and analysis server and database, api.megammon.com), in the United States;
    • Resend, Inc.: sending emails (United States);
    • Anthropic, PBC: writing the explanations by artificial intelligence (United States), based on game data only;
    • PostHog, Inc.: audience measurement and product analytics, data hosted in the European Union (Frankfurt, Germany);
    • Google Ireland Limited (Google Ads): measuring our advertising campaigns. If you arrived through one of our Google ads, our server sends Google the ad's click identifier (gclid, gbraid or wbraid), the action (sign-up or first game) and its date. No email address, not even encrypted or hashed, no username, no other data about you;
    • Discord Inc.: internal team notifications on our private server (United States). For each sign-up: username, email address, sign-up method, origin of the visit and device; for each game started: usernames, countries, Elo ratings and settings. These messages are kept for as long as necessary to monitor the service's activity.
  • Google, if you sign in with your Google account: Google then knows that you use Megammon, in accordance with its own privacy policy.
  • The authorities, only if required by law.

We neither sell nor rent your data.

4. Transfers outside the European Union

Our service providers are established in the United States and our servers are located there, except those used for audience measurement, which are in the European Union. These transfers rely on the safeguards provided for by the GDPR: the European Commission's adequacy decision for companies certified under the EU–U.S. Data Privacy Framework, or the standard contractual clauses adopted by the European Commission. You can ask us for a copy.

5. Cookies and browser storage

Megammon does not display advertising. It keeps in your browser:

  • mg_session: keeps you signed in (30 days, renewed with use);
  • mg_guest: lets you find your guest games again (12 months);
  • mg_oauth: secures sign-in with Google (10 minutes);
  • megammon_lang: the language chosen with the EN/FR switch, to display it on your next visits (1 year, set only when you use the switch);
  • in your browser's local storage, your display preferences (board direction, sounds, units…) and your latest game settings, which never leave your device;
  • megammon.attribution, in local storage: the origin of your first visit and of your latest visit coming from another site (see “Origin of visits and sign-ups”), 13 months. It is sent to us only if you create an account;
  • ph_…_posthog, as a cookie and in local storage: the audience measurement identifier of your browser and of its current visit (see “Audience measurement and product analytics”), 1 year.

You can erase this data at any time by deleting the site's data in your browser, refuse audience measurement with the button above, and object to the measurement of the origin of your visits by writing to us.

6. Security

Communications are encrypted (HTTPS). Passwords and sign-in tokens are stored only in hashed form, sign-in cookies are inaccessible to page scripts, pictures are re-encoded by us, and access to data is limited to the people who need it.

7. Your rights

You can at any time:

  • access your data and obtain a copy of it, including in a reusable format (portability);
  • have it corrected: your country and picture can be changed in My profile;
  • have it erased: My profile lets you delete your account yourself;
  • object to processing based on our legitimate interest, or request its restriction;
  • remove your picture or your country, at any time;
  • give instructions on what happens to your data after your death.

Write to us at contact@megammon.com, preferably from your account's address. We respond within one month. If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France).

8. Minors

Megammon is open to people aged 15 or over. Below that age, the consent of a holder of parental responsibility is required; if it has not been given to us, write to us and we will delete the account.

9. Changes

This policy evolves with the service. The date of the last update appears at the top of the page; in the event of a significant change, we will notify you on the site or by email.

Any questions: contact@megammon.com. See also: terms of use and legal notice.