Privacy Policy
Last updated: September 27, 2026 (version 2026-09-27)
Summary
- You can use the market tools without an account. We then store nothing about you beyond short-lived technical logs.
- We never sell or share your data for advertising, and we show no ads.
- No tracking cookies. One session cookie, set only when you sign in.
- You can download or delete your data yourself from your Profile page.
- Accounts are for ages 13 and up.
1. Data controller
The controller is Téo LEMESLE EI (SIRET 106 972 276 00013), the publisher named on the Legal Notices page. Contact: teo.lemesle.pro@gmail.com.
2. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Email, display name, avatar URL, password hash (argon2id) or Discord user ID | Create and secure your account; sign-in | Contract (6(1)(b)) |
| Month and year of birth | Refuse under-13s; require a guardian for purchases by 13–17s | Legal obligation (6(1)(c)) and legitimate interest in protecting children (6(1)(f)) |
| Terms version and acceptance time; checkout consents | Prove what you agreed to | Legal obligation / legitimate interest |
| Stripe customer ID, subscription status and period | Billing and Premium access (card details stay with Stripe) | Contract |
| Planner preferences you save | Remember your settings | Contract |
| Watchlist, alert rules and alert history (kept 30 days) | Send the alerts you asked for, on the site and as Discord DMs | Contract |
| Trades you log in the journal | Show your results | Contract |
| Passes, gift codes you bought or redeemed, your referral code and who referred you | Premium access, gifts, referral rewards, fraud prevention | Contract; legitimate interest (fraud prevention) |
| Discord user ID when you use the bot's slash commands | Answer the command, recognise your linked account, rate-limit abuse (not stored) | Legitimate interest |
| Last visit time | Account security and support | Legitimate interest |
| IP address, browser, requested URL (server and error logs) | Security, abuse and rate limiting, debugging | Legitimate interest |
| Aggregated page views (self-hosted Umami, no cookies, no cross-site tracking) | Know which pages are useful | Legitimate interest |
| Discord user ID and username when you join our Discord server | Welcome message and automatic roles | Legitimate interest |
We do not store Discord access tokens: we use them once at sign-in to read your Discord ID, username, avatar and email, then discard them.
3. Children and teenagers
SkyblockTracker is a general-audience site, but we know many SkyBlock players are young, so we designed for them:
- Under 13: we do not knowingly collect personal information from children under 13 (U.S. COPPA). Sign-up starts with a neutral age question; if the answer is under 13 no account is created and nothing is stored. If we learn that we hold data about a child under 13, we delete it.
- 13 to 17: accounts get the same high-privacy defaults as everyone: no public profile, no advertising, no profiling for marketing, no location data, and no marketing emails. Buying Premium requires a parent's or guardian's agreement, confirmed at checkout. Our processing does not rely on consent (so the GDPR art. 8 age thresholds do not apply to it), and we follow the spirit of the UK Age Appropriate Design Code.
- Parents: if you believe your child under 13 has an account, or you want to review or delete your teenager's data, email teo.lemesle.pro@gmail.com and we will act within 30 days.
4. How long we keep data
- Account data: while your account exists; deleted immediately when you delete the account.
- Alert history: 30 days. Watchlist, rules and journal: until you delete them or your account.
- Sessions: expire after 14 days of inactivity.
- Server logs and traces: 7 days. Metrics (no personal data): 15 days.
- Checkout consent records: kept for 5 years after purchase, unlinked from your deleted account, as evidence in case of a payment dispute.
- Invoices: kept by Stripe for 10 years as French accounting law requires.
5. Who we share data with
We do not sell your personal information or share it for targeted advertising. We use these processors:
- Stripe, Inc. / Stripe Payments Europe — payments (Stripe's privacy policy applies to card data).
- Discord, Inc. — if you sign in with Discord or join our server.
- VALARS (Paris, France) — hosting; our servers are in the EU.
6. International transfers
Stripe and Discord may process data in the United States under the EU–US Data Privacy Framework or Standard Contractual Clauses.
7. Your rights
You can access, correct, export, restrict, object to or delete your data. Export and deletion are self-service on your Profile page; for anything else email teo.lemesle.pro@gmail.com. We answer within one month. You can also complain to the CNIL (www.cnil.fr) or your local data-protection authority.
California and other U.S. state residents: we do not sell or share personal information, and we do not use it for targeted advertising. You may request access or deletion as described above, and we will not treat you differently for doing so.
8. Cookies
We set a single, strictly necessary session cookie when you sign in (and during a Discord sign-in, to protect it). It needs no consent under the ePrivacy rules. We use no advertising or analytics cookies.
9. Security
Passwords are hashed with argon2id, traffic is encrypted with HTTPS, sign-in attempts are rate-limited, and database access is restricted to our servers. If a breach puts your data at risk, we will notify you and the CNIL as the law requires.
10. Changes
We will announce material changes in the Service at least 30 days before they apply. The date at the top shows the latest version.