Privacy policy
Last updated: 17 May 2026
This page explains what data we collect, why we collect it, which third-party services process it, and how long it is retained. It also explains your rights and how to exercise them.
Summary
The contact form is for project enquiries. Games may collect your name, email, and Instagram handle for prize administration. If you consent, Google Analytics tracks how pages are used — no advertising, no data selling. Strictly necessary cookies keep the site working and are always active. The form should not be used to send payment card details, government identifiers, health records, or other highly sensitive information.
What we collect
We only collect data you actively provide or that is generated as a technical side-effect of your visit.
| Data | When | Legal basis | Who sees it |
|---|---|---|---|
| Name, email, message | Contact form | Legitimate interest (responding to enquiry) | Kynoku only |
| Name, email, Instagram handle, IP | Game entry | Contractual (prize fulfilment) | Kynoku only |
| IP address | All API requests | Legitimate interest (abuse prevention) | Kynoku — not logged to persistent storage |
| Page views, click events | With analytics consent | Consent (Art. 6(1)(a)) | Google Analytics |
| Language preference | Automatic on first visit | Strictly necessary | Not sent to any server |
| reCAPTCHA score | Contact form only | Legitimate interest (spam prevention) |
Cookies & local storage
We use two categories of cookies. Strictly necessary ones are always active because the site cannot function without them. Analytics cookies are only set after you give consent.
To change your analytics preference, clear cookies for this site in your browser settings — the consent banner will reappear on your next visit.
| Name | Type | Purpose | Retention |
|---|---|---|---|
| kynoku_consent | Cookie (1st party) | Stores your cookie consent choice | 365 days |
| kynoku_lang | localStorage | Remembers your language preference | Persistent |
| kynoku-game-claimed | localStorage | Prevents duplicate prize claims | Persistent |
| kynoku-age-verified | localStorage | Stores age-gate confirmation | Persistent |
| _GRECAPTCHA, NID | Cookie (Google) | Bot protection — contact form only | Session / up to 6 months |
| _ga, _ga_* | Cookie (Google) | Analytics — page-view tracking (consent required) | 2 years |
| _gid | Cookie (Google) | Analytics — daily session tracking (consent required) | 24 hours |
localStorage keys contain no personal data — they store only boolean flags. They persist until you clear your browser's site data.
Third-party processors
We use the following services. Each acts as a data processor under its own privacy policy and, where required, a Data Processing Agreement (DPA).
- Google Analytics 4 — Tracks page views and interactions if you have given analytics consent. Your IP is anonymised before it reaches Google. Google Privacy Policy
- Google reCAPTCHA v2 — Loaded on the contact form only to distinguish humans from bots. Google may set its own cookies (
_GRECAPTCHA,NID) during this check. Google Privacy Policy - Resend — Transactional email service used to deliver contact-form replies and game winner notifications. Processes your name and email address. Resend DPA
- Cloudinary — CDN used to serve images. Your IP address is visible to Cloudinary on each image request as a standard part of HTTP. Cloudinary Privacy Policy
How it is handled
Form submissions are processed by this website and delivered through Resend email infrastructure. Game entries are stored in a secured database. Images are served via Cloudinary's CDN. Analytics data is sent to Google Analytics 4 only when you have given consent. Access to your personal data is limited to people who need it to review your message or administer game results.
Data retention
- Contact form submissions — Messages are forwarded via email and are not stored on our servers. Replied correspondence is kept for up to 12 months from the last meaningful contact, unless a legal or contractual reason requires longer.
- Game winners table — Name, email, and Instagram handle are kept only as long as needed to administer the prize. IP addresses are deleted 90 days after prize fulfilment.
- Google Analytics — Retention follows Google's standard settings (up to 14 months of event data). You can opt out at any time via the cookie preference banner.
- localStorage keys — Persist in your browser until you clear site data. They contain no personal data — only boolean flags.
- Consent cookie — Stored for 365 days, then you will be asked again.
Your rights
Under GDPR you have the following rights. To exercise any of them, email privacy@kynoku.com or use the contact form.
- Access (Art. 15) — Request a copy of the personal data we hold about you.
- Rectification (Art. 16) — Ask us to correct inaccurate or incomplete data.
- Erasure (Art. 17) — Ask us to delete your data (“right to be forgotten”), where no legal obligation requires us to keep it.
- Restriction (Art. 18) — Ask us to pause processing your data while a dispute is resolved.
- Portability (Art. 20) — Receive your data in a structured, machine-readable format.
- Object (Art. 21) — Object to processing based on legitimate interest, including analytics.
- Withdraw consent (Art. 7) — Withdraw analytics consent at any time — this does not affect any processing that already happened.
Consent & withdrawal
Analytics cookies are only set after you explicitly accept them in the cookie banner. You can change this at any time: clear the cookies for this site in your browser (Settings → Privacy → Clear site data) and the preference banner will reappear on your next visit.
Withdrawing consent stops future tracking immediately. It does not affect any data already collected before withdrawal.
Data Controller
Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation — GDPR), and the French Data Protection Act n° 78-17 of 6 January 1978 as amended, the data controller responsible for the processing of personal data carried out in connection with this website is KYNOKU (the Controller). Any request relating to this Privacy Policy or the exercise of data subject rights under Articles 15 to 22 of the GDPR may be addressed to privacy@kynoku.com. The Controller is established at: NICE, FRANCE.
Data Protection Officer (DPO)
Where required or voluntarily appointed, the Data Protection Officer may be contacted at privacy@kynoku.com.
Right to lodge a complaint
You have the right to lodge a complaint with the French Data Protection Authority (Commission Nationale de l'Informatique et des Libertés — CNIL).