Privacy policy

Version of 2 September 2026.

1. Who is responsible

Joue-La Comme (SAS), Bobigny Trade and Companies Register 977 496 488, 33 Quai de Seine, 93450 L'Île-Saint-Denis, France. Contact: contact@rpz.fans.

2. What we collect

• Account: email, username, language. You confirm you are 15 or older; your date of birth is never sent or stored.
• Your museum: jerseys, memories, photos, seasons — what you declare.
• Your profile (optional): photo, bio, location, followed teams. Bio and location stay private by default.
• Your comments in other members' museums: the text, your handle and the date. They are published in that member's museum; the member is notified by email with your handle, never your address, and can remove them.
• Operations: technical and security logs, email logs, errors.
• Product usage: anonymised events (“jersey added”), linked to a technical identifier — never to your email or username.

We never infer your emotions (you alone declare them) and we collect no sensitive data (health, religion, biometrics...).

3. Why

• Running your museum (performance of the contract).
• Sending you back a memory/a prompt by email from time to time — one-click unsubscribe (legitimate interest).
• Securing the service and measuring product usage (legitimate interest, no ads, no cookie).
• Aggregated statistics for athletes/clubs (never your individual data — except what you deposit yourself, opt-in, in the upcoming guestbook).

4. What we never do

Sell your data. Pass your email or any data that identifies you to a third party (athletes and clubs included). Targeted advertising or tracking. Personal data on a blockchain.

5. Audience measurement and cookies

Vercel Analytics and PostHog (EU-hosted), configured with no cookie and no tracker — so no cookie banner. PostHog only receives named events linked to your technical identifier, never your email, username, texts or photos. The only cookies used are those needed for your sign-in and your language.

6. Who touches your data

Our technical processors, and nobody else: Supabase (database and photos, EU), Vercel (hosting), Resend (emails), Sentry (error monitoring), PostHog (usage measurement, EU), Cloudflare (the anti-robot check on sign-up and password reset), Linear (only if you write to us via “Help & feedback”).

7. How long

Account and museum: as long as your account is active. Technical logs: 12 months max. Account deletion: immediate erasure everywhere, backups purged within 7 days. After deletion, only anonymous statistics remain (sport, club, season) that cannot be traced back to you.

8. Your rights

Access, rectification, erasure, portability, objection. The two main ones are in the app, without writing to us: Profile → “Privacy & data” → Download my data / Delete my account. Otherwise: contact@rpz.fans (answer within 30 days). You can also contact the CNIL (cnil.fr).

9. Minors

RPZ is for ages 15 and up. Your date of birth is never sent. A child's museum is managed by the account holder and cannot be made public.

10. Updates

If this policy changes substantially, we will tell you in the app or by email at least 30 days in advance.