Legal
Privacy policy
Last updated 26 October 2026
In short: we keep only what a service needs to work, for as long as it needs it. No advertising, no tracking, no cookies, and nothing sold or shared.
Who is responsible
Woodpecker Labs (To be completed, SIREN To be completed, To be completed) is responsible for the personal data described here: what this website keeps, and what the apps it publishes under its own name keep. You can reach us about it from the contact page, choosing “My personal data”.
When we build or host a product for a client, that client is responsible for its users’ data, and we handle it only on their instructions, under a written agreement. Their own privacy policy applies.
This website
- What you write to us from the contact page: your name, your email address, your company if you give it, what your message is about, the message itself and the language of the page. We use it to answer you and follow up, and nothing else. It is kept as long as that takes, and deleted at the latest three years after our last exchange.
- Technical records: the server’s logs record the requests it answers, with the time, what was asked for and your IP address, to keep the service secure and fix it when something goes wrong. Your IP address is also kept in memory, for an hour at most, to stop any one address sending too many requests. Logs are kept for a limited time.
- Our administrators’ accounts: the people who read the messages sign in with an email address and a password, stored only as a one-way hash. Their sign-in is kept in their browser’s local storage for twelve hours. Nobody else has an account here.
There are no cookies, no analytics, no advertising and no social media buttons. The fonts are served from our own server, so visiting a page sends nothing to anyone else, and what you write to us stays on our server: it is not forwarded to any other service.
The website runs on a server we operate, located in To be completed. A copy of its database is taken every night and kept for thirty days to recover from a failure; these copies are stored with GitHub (Microsoft), which acts as our service provider. The legal basis for all of this is our legitimate interest in answering the people who write to us and in running a secure service, and, for a project request, the steps you ask us to take before a contract.
Maskaraldus
Maskaraldus, the card-game app and its website, is published by Woodpecker Labs. It keeps only what the games need: no advertising, no tracking, and nothing sold or shared. The same rules apply whichever game you play.
What it keeps, and why
- Your account, if you make one: your first and last name, your email address, your password (stored only as a one-way hash), when you signed up, agreed to the terms and last signed in. Your first name is what the other players at your tables see.
- Codes emailed to you to confirm your address or reset your password, stored so that they cannot be read back, for half an hour at most or until used.
- As a guest, the name you type to sit at a table, which that table sees.
- Your games: who sat at each table, the cards each player holds, the families or pairs laid down, and the latest thing that happened. The administrators can see who is at an open table and what happened there last, never anybody’s cards.
- Your card games: their names and the pictures you upload, shown to the people you play with, to the administrators who review them, and, once approved, to anybody who plays with them.
- What you send the administrators: support messages and reports made at a table (the reason, your words, the table and the players concerned), to answer you and keep the tables safe.
- Technical records: request logs with your IP address, an in-memory count of requests per address for an hour at most, and usage figures that are counts only, with no names.
- On your device: the app keeps your sign-in and your seat at a table in the phone’s secure storage, and the website keeps your sign-in in your browser. There are no cookies and no tracking.
Who else handles it
Nobody, for advertising or anything else of theirs. The emails carrying your codes are sent through Resend, which receives your address and the code to deliver them. The app reaches your phone through Apple’s TestFlight or App Store, Google Play, or as a file downloaded from the Maskaraldus website; if you open it in Expo Go, that app is Expo’s. Apple, Google and Expo each have their own privacy policy.
How long it is kept
- Your account, until you delete it, or until we do for a breach of the terms of use.
- A game: one an account opened, until that account is deleted; one a guest opened, until thirty days after it ends.
- Messages and reports, until an administrator deletes them once they are dealt with.
- Usage figures, ninety days. The server’s logs, a limited time.
- Copies of the database, for recovery: nightly ones for thirty days, and the copies the server takes before each upgrade, until newer ones replace them.
Deleting your account
From your account page on the website, or in the app, from its first screen. It deletes your account, the games you opened and the card games you made, with their pictures. Your seats at other people’s tables stay, under your first name, so their games can go on.
Children
Accounts are for adults, or for children with a parent’s permission. Anybody can play as a guest, under a nickname: nothing more is asked.
The legal basis is that you asked to play: we need this data to run the games for you. Reports, logs and request limits are in our legitimate interest, and yours, in a service that is safe and works.
Your rights
Wherever you live, you can ask to see the data we hold about you, to have it corrected or deleted, to receive a copy of it, to restrict its use or to object to it. Write to us from the contact page; we answer within a month. If you are not satisfied with our answer, you can complain to your data protection authority (in France, the CNIL: cnil.fr).
Security
Every connection is encrypted. Passwords are stored only as one-way hashes, the servers are hardened and audited, and access to the data is limited to the people who need it.
Changes
We may change this policy; the date at the top says when it last changed.