Skip to content
Dunkpack Back

Legal

Privacy

What Dunkpack keeps about you, why, and how to erase it all.

Updated on 30 October 2026.

In short

Dunkpack is a basketball card game among friends, played online, with an account. We keep as little as possible: your e-mail and your game, to give it back to you on all your devices. No ads, no trackers, no reselling.

Who looks after it

The data controller is the publisher of Dunkpack, an independent game published in France. For any question about your data: contact@dunkpack.com.

On your device

Your browser keeps a copy of your game to show it without waiting: the real one lives on your account. The language, the sound and your settings stay on the device; they are sent nowhere.

The audience is measured anonymously and without cookies: a tool self-hosted by the publisher (Umami) counts visits (pages seen, referrer, browser, country). No identifier is placed on your device; nothing follows you from site to site.

What we keep

  • Your e-mail: to sign in and get your game back. It's never shown to anyone.
  • Your profile: your name, your friend code, your club, your crest and your title, your time zone.
  • Your start: the hand and the welcome packs drawn when your account was created, so they stay the same.
  • Your game: your collection, your teams, your progress, and the game as each day found it, over the last 7 days.
  • Your devices: a readable name ("iPhone · Safari") and the day of their last save.
  • Your sessions: the IP address and browser of each sign-in, for security.
  • Your passkeys, if you create any: the public key only. Your fingerprint or face never leave your device.
  • If you join the game's Discord through the Prime Pass button: your Discord account's ID, so that it gives the Prime Pass only once. Not your Discord name, not your e-mail, not your messages.
  • The six-digit codes, while they're valid (5 minutes).
  • A save's unlikely jumps (credits earned too fast, for example), to spot cheating.
  • What the team makes of it: the verdict on a flag (false positive, to watch, confirmed) and its short notes on your account. They block nothing, they are in your export and they go with your account.
  • If you delete your account: a fingerprint of your e-mail (a code computed from it, which can't be turned back into it), your start and the next packs already drawn. A new account with the same address gets them back instead of drawing new ones.

Why

The account, the save and the game rest on the contract between us when you create an account (GDPR, article 6.1 b). Sessions, rate limits and unlikely jumps rest on our legitimate interest: keeping the service secure (article 6.1 f).

The fingerprint kept after an account is deleted also rests on our legitimate interest: the fairness of the game, so that a start can't be redrawn over and over (article 6.1 f).

How long

  • Your account and your game: as long as the account exists. An account with no sign-in for two years is deleted, after a warning e-mail 30 days before.
  • The daily copies: 7 days. A game set aside when two devices played apart (the account's wins), or wiped by “Start over”: 30 days.
  • Sessions: 30 days after your last visit. Codes: 5 minutes.
  • The fingerprint of a deleted account, with its start: one year.
  • Database backups: 14 days at most. A deleted account disappears from them when they expire.

Who else handles it

No one else. Nothing is sold or shared for advertising.

  • OVHcloud hosts the game and its database, on a server in Canada, a country the European Commission recognises as offering adequate protection.
  • Brevo (France) sends the e-mails: the sign-in and deletion codes. It receives your e-mail address and the code, nothing else.
  • Discord, if you join the game's server through the Prime Pass button: you give your consent on its site, it tells us your Discord account's ID and we ask it to add you to the server.

Cookies and storage

A single cookie: your session's, when you are signed in. It authenticates you: it does not need your consent. Your game is kept on your account; your browser keeps a copy of it in its local storage.

Your rights

You can also complain to the CNIL (cnil.fr).

  • Download your data: in Your account, "Download my data" (a JSON file).
  • Erase everything: in Your account, "Delete my account", confirmed by a code. The erasure is immediate.
  • After the erasure, only the fingerprint of your e-mail and your start remain, for one year (see "What we keep").
  • To correct, object or ask a question: write to contact@dunkpack.com.

Your age

You can create an account on your own from age 15. Younger, with a parent's consent.