Privacy Policy

This policy explains what data TirageAuSort.io collects about you when you use the site, what it is used for, who has access to it, how long it is kept and what rights you have to control it.

It is written to be read, not to discourage you. If anything remains unclear, write to us at contact@tirageausort.io and we will explain it.

This policy simultaneously complies with:

• the European General Data Protection Regulation (GDPR);
• Quebec Law 25 on the protection of personal information;
• the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA);
• the California Consumer Privacy Act (CCPA) for California residents.

Before getting into the detail, here is the logic that shapes everything else: the random-draw tools offered on the site do not process any personal data. When you flip a coin, spin the wheel or roll the dice, the calculation happens directly in your browser, with no round-trip to our servers. This is explained in detail in the article Under the hood of TirageAuSort.io.

The data described below therefore concerns only:

• anonymous audience measurement of the site;
• advertising displayed by our ad platform;
• optional user accounts (currently being rolled out).

Some preferences are stored in your browser's localStorage — a local storage area that never leaves your device:

• display theme (light / dark);
• sound preference (on / off);
• history of draws performed;
• cookie consent choice for non-essential cookies.

A few cookies are strictly necessary for the site to function (storing your consent choice, language preference, spam prevention on forms). They do not require your consent, in accordance with Article 5(3) of the ePrivacy directive.

Purpose. Understand which pages of the site are viewed, from which countries and on which devices, in order to guide editorial priorities.

Data collected. Truncated (anonymised) IP address, pages visited, visit duration, device type, browser, traffic source. No data is used to identify you individually.

Legal basis. Explicit consent via the cookie banner. If you refuse, GA4 is not loaded at all.

Duration. 14 months maximum on Google's side, in line with the settings recommended by the French CNIL.

Purpose. Cover the site's hosting and development costs through advertising orchestrated by Ezoic, a US-based ad-monetisation platform.

Main subprocessor. Ezoic Inc. (United States), which acts as the ad platform and orchestrates third-party partners (Google AdSense, Criteo, Index Exchange, OpenX, Magnite, and other programmatic auction networks) to display the most relevant ads.

Data collected. When advertising is enabled, Ezoic and its partners may set cookies to measure ad performance and, if you consent, personalise the ads shown to you. The full detail is documented in Ezoic's privacy policy and in the IAB partner list they use.

Legal basis. Explicit consent via the cookie banner. If you refuse personalised advertising, Ezoic will display non-personalised ads based solely on the page context.

Duration. Variable depending on the cookie, generally between 30 days and 13 months. See the Ezoic documentation for details.

An optional account system is being rolled out to allow bug reporting, game suggestions, saving favourites and consulting your draw history. As long as you do not create an account, none of the data below is collected.

If you create an account (via email magic link or Google OAuth), we store:

• your email address (login identifier);
• a nickname you choose (editable at any time);
• your language preference among the seven supported;
• the account creation and last modification dates;
• your favourites, reports and proposals if you submit any.

No password is stored — authentication works via single-use magic links or Google OAuth.

Legal basis. Performance of the service you requested by creating an account (Article 6.1.b GDPR).

Duration. As long as your account exists. Account deletion is immediate upon your request, from your profile page. Audit logs are kept for two years and anonymised once the account is deleted.

Your data is never sold, never rented, never shared with data brokers. The only third parties with access are the following technical subprocessors, each bound by a GDPR-compliant data processing agreement (DPA):

Links to each subprocessor's privacy policy are available in our Legal Notice.

Some data transits through servers located in the United States (Netlify, Google, Ezoic). These transfers are governed by:

• the Standard Contractual Clauses approved by the European Commission for Netlify;
• the EU–US Data Privacy Framework for Google and Ezoic.

User account data (Supabase) is stored in Europe (eu-west region).

• Access. Obtain a copy of the data we hold about you.
• Rectification. Correct inaccurate data.
• Erasure ("right to be forgotten"). Request the deletion of your data.
• Portability. Recover your data in a structured, machine-readable format (JSON export via the profile page, feature being deployed).
• Objection. Object to the processing of your data on grounds relating to your particular situation.
• Restriction. Request the temporary suspension of processing.
• Withdrawal of consent. At any time, without affecting the lawfulness of prior processing.

To exercise these rights, write to contact@tirageausort.io with "GDPR request" in the subject line. We respond within 30 days maximum, in accordance with the regulation.

You can also lodge a complaint with the supervisory authority of your country — for example the CNIL in France, the APD in Belgium, or the Federal Commissioner in Switzerland.

The site is not specifically aimed at children, but its tools (Coin Flip, Wheel, dice) are accessible to anyone. In accordance with the GDPR and Canadian practice, we do not knowingly collect personal data from children under 13 (16 in some EU member states, depending on local transposition).

If you are a parent or guardian and notice that a minor has submitted data via an account or form, contact us: we will delete it without delay.

You manage your cookie preferences from:

• the consent banner shown on your first visit;
• the "Manage my cookies" link present in the footer of every page;
• your browser settings (Chrome, Firefox, Safari, Edge — all let you block or delete cookies at any time).