Legal
Privacy Policy
This policy explains how ZeroLuck.GG collects, uses, stores, and protects your personal data in compliance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
Last updated: April 7, 2026
1. Data Controller
The data controller for ZeroLuck.GG is:
- Michael Fontaine
- 92160 Antony, France
- Contact: support@holst.network
2. Data We Collect
- Account data: email address, username, avatar, and login identifiers (Google OAuth).
- Profile data: display preferences, community contributions (tier lists, builds, comments).
- Usage data: anonymous page views (when analytics consent is given).
- Security logs: IP addresses, timestamps, and request metadata for abuse prevention.
3. Legal Bases for Processing
- Consent (Art. 6(1)(a)): analytics cookies (Google Analytics) and advertising cookies (NitroPay). You can grant or withdraw consent at any time via the cookie banner or the "Manage Cookies" link in the footer.
- Contract performance (Art. 6(1)(b)): account creation, authentication, profile display, and community features you choose to use.
- Legitimate interest (Art. 6(1)(f)): security logs and abuse prevention to protect the platform and its users.
4. Cookie Policy
We use the following categories of cookies. "Necessary" cookies are always active. "Analytics" and "Advertising" cookies require your explicit consent before being set.
| Cookie | Category | Purpose | Duration |
|---|---|---|---|
| zl_local_session | Necessary | Encrypted session token for authentication | 90 days |
| zl_session_hint | Necessary | Indicates an active session exists | 90 days |
| zl_public_user | Necessary | Public profile data for UI rendering (username, avatar) | 90 days |
| zl_consent | Necessary | Stores your cookie consent preferences | 13 months |
| _ga, _ga_* | Analytics | Google Analytics — anonymous page view tracking | 2 years |
| _gid | Analytics | Google Analytics — session identification | 24 hours |
| Various | Advertising | NitroPay and ad exchange partners — ad targeting and measurement | Varies |
We also use localStorage for session caching and feature preferences (e.g., map favorites). This data stays on your device and is not transmitted to any server.
5. Third-Party Recipients
When you consent to optional cookies, data may be shared with:
- Google LLC — Google Analytics for anonymous usage statistics. Google's privacy policy: policies.google.com/privacy
- NitroPay / ad exchange partners — programmatic advertising. NitroPay manages downstream ad partner consent via the IAB Transparency and Consent Framework (TCF).
We do not sell your personal data. We do not share account data (email, username) with any third party for marketing purposes.
6. International Data Transfers
When analytics consent is given, anonymous usage data is processed by Google Analytics, which may transfer data to servers in the United States. These transfers are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs). No personally identifiable information is sent to Google Analytics.
7. Data Retention
- Account data: retained until you request deletion.
- Authentication cookies: 90 days (refreshed on activity).
- Consent cookie: 13 months.
- Analytics cookies: per Google's retention policy (up to 2 years).
- Security logs: 12 months.
8. Your Rights Under GDPR
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15): request a copy of your personal data.
- Right to rectification (Art. 16): correct inaccurate data.
- Right to erasure (Art. 17): request deletion of your account and data. You can initiate this from your profile settings or by contacting us.
- Right to data portability (Art. 20): export your data in a machine-readable format from your profile settings.
- Right to object (Art. 21): object to processing based on legitimate interest.
- Right to withdraw consent (Art. 7): withdraw cookie consent at any time via the "Manage Cookies" link in the footer. This does not affect the lawfulness of prior processing.
- Right to restriction (Art. 18): request that we limit processing of your data in certain circumstances.
9. Supervisory Authority
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the French data protection authority:
- Commission Nationale de l'Informatique et des Libertés (CNIL)
- Website: www.cnil.fr
10. Automated Decision-Making
ZeroLuck.GG does not use automated decision-making or profiling that produces legal effects or similarly significant effects on users.
11. Children
ZeroLuck.GG is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at support@holst.network and we will delete it promptly.
12. How to Exercise Your Rights
To exercise any of the rights listed above, contact us at support@holst.network with your account email and a description of your request. We will respond within 30 days.
You can also manage your cookie preferences at any time by clicking "Manage Cookies" in the site footer, or delete your account directly from your profile settings.