Privacy policy

What we collect

• Your 42 profile, when you sign in with 42: your 42 id, login, name, student email, profile picture link, student status and campus. It's refreshed each time you sign in.
• Your game: the cards you own, the packs you open, and the trades and joint openings you make (who with, which cards, when, and the campus you were at).
• Your location, sometimes. Only when you trade or open packs with a player from another campus, the app takes one reading while you're using it (never in the background) so we can check you're at the same campus. We keep your latest reading (coordinates, accuracy, and whether the phone reported it as simulated) to catch cheating. Each new reading replaces the one before.
• Sign-in sessions: the IP address and device type of each session, kept while it lasts.
• App verification, to keep bots out: your phone proves it runs the real app, through Apple's App Attest on iPhone and the phone's own secure hardware on Android. No Google or Play service is involved. We keep a key the phone made for this install, a random install id, and recent verification results (pass or fail, and why). We learn nothing else about your phone.
• Crash reports, when the app crashes: the error and where in the app's code it happened, the screen you were on, your last 50 app events (screens opened, server errors, update checks, with ids and codes masked; never what you type), your phone's model, its OS version and the app version. They're linked to your account when you're signed in. You can turn them off in the app: on your profile, Settings → Send crash reports.
• Reports you send from the app, a bug or an idea: your text, a screenshot of the screen if you keep it (never one showing a trade code), and the same details as a crash report. A report sent from the crash screen includes that crash.

The camera is used only to scan the other player's trade code. Images are read on your phone and never uploaded. There are no ads, no analytics and no tracking.

Why

• To run the game: your collection, packs, trades and their history.
• To keep it fair: checking trades between campuses happen in person, and spotting abuse.
• To fix bugs: crash reports show what broke, where, and on which phones. The reports you send tell us what to fix or build, and let us get back to you about them.

The legal basis is providing the service you asked for, and our legitimate interest in keeping the game fair and working. We never sell your data or use it for advertising.

Who can see it

• Other players see your 42 login when they trade or open packs with you, and on a card's history ("passport"): every player who owned that copy, with their campus at the time. Signed-in players who know your login (from your profile code, or from having traded with you) also see your profile: login, campus, 42 avatar, the cards you showcase, and how many cards and trades you have.
• Anyone, on the app and on the website, sees your campus museum: a card you give it shows your login only if you chose to sign it. Signed-in players can read the history of a card on display, like any other passport.
• ft_booster's admins, and only them, see crash reports and the reports you send, in the back office.
• Service providers that run ft_booster for us: Vercel (the server, and report screenshots), Turso (the database), Expo (app updates), 42 (sign-in) and Discord (a private admin channel told of each new report or crash, with your login and the start of your text, or the error). They only process data to provide their service.

How long we keep it

• Crash reports: 30 days, then they're deleted.
• Reports you send: until we've dealt with them (fixed, or decided not to), then they're deleted with their screenshot. The admin channel's notice of a report isn't deleted on its own: ask and we'll remove yours.
• Everything else: until you delete your account.

Deleting your account removes your 42 profile, email, sessions, cards, location reading, app verification data, crash reports and the reports you sent with their screenshots, and calls off any trade still in progress. What stays is an anonymous record with no name, login or email: the log of what that player did, and the trades it was part of. Other players' cards and the museum pieces you gave keep their history, but your login disappears from them; you show up as "former cadet". See how to delete your account.

Your rights

You can ask to see, correct, export or delete your data, or object to how it's used, by writing to support@ftb.cards. We answer within a month. You can also complain to your data protection authority (in France, the CNIL).

Children

ft_booster is for 42 students, who are adults. It isn't aimed at children, and we don't knowingly collect data from anyone under 16.

Changes

If this policy changes, the new version will be posted here with a new date. For a significant change, the app will tell you.