Ostraka

Ostraka, the daily cultural investigation

Privacy policy

Last updated: October 2026

1. Data controller

Ostraka is the controller of your personal data for the game available at playostraka.com. Contact: hello@playostraka.com.

2. Playing without an account

You can play without giving any personal information. From your first game, your progress is recorded under a random identifier, linked to your browser by a session cookie. There are no passwords on Ostraka.

3. Data we collect

  • If you save your progress: your email address, to which a sign-in link is sent; then, if you choose, a nickname and an avatar.
  • Game data: your games (completed workshops, guesses, results), your achievements and your statistics.
  • Technical data: the session cookie; your IP address, used only to limit repeated sign-in link requests (abuse protection).
  • If you turn on notifications: the subscription address your browser provides to receive them (from Google, Apple or Mozilla, depending on the browser) and your language. It is only used to announce the daily case.
  • Audience measurement: page views (address without parameters, except the name of the campaign you came from, referring page, device and browser type, time spent on the site), counted without cookies by Matomo, a tool hosted on our own server; your IP address is truncated (anonymised) as soon as it is received. It tells us how many people visit the site.
  • Usage measurements: game events (game started, workshop completed, guess, reveal), associated with a random identifier, never with your email. They help us understand how the game is used and improve it.

Ostraka collects no sensitive data and uses no advertising or third-party analytics tools: no browsing data is passed on to another company.

4. Purposes and legal bases

  • Running the game and keeping your progress (performance of the service).
  • Sending you the sign-in link you request (performance of the service).
  • Announcing the daily case by notification, if you asked for it (consent, which you can withdraw at any time).
  • Emailing you after a few days without playing, if you asked for it in your profile: a single email per absence (consent, which you can withdraw at any time from your profile or the link in the email).
  • Securing the service and preventing abuse (legitimate interest).
  • Improving the game through usage and audience measurements (legitimate interest; you can object, see below).

5. Recipients

Your data is never sold or transferred. It is only shared with our technical providers, solely to run the service: the site's hosting provider (OVH, in France), the service that sends our emails (sign-in links and reminders, Brevo, in France) and, if you turn on notifications, your browser's push service (Google, Apple or Mozilla), which only receives the encrypted notification. It may be disclosed to the authorities where required by law.

6. Retention periods

  • Account and progress: as long as you use the game; you can delete them at any time from your profile ("Delete my account"). Without an email address, your progress can only be reached through your browser's session: it is deleted when that session ends (after eleven to twelve months without a visit, or when you sign out).
  • Sign-in links: valid for 15 minutes, single use, deleted by the next day at the latest.
  • Sessions: eleven to twelve months after your last visit (extended while you play); deleted when they expire or when you sign out.
  • Notification subscription: until you turn it off (at the end of an investigation, from your profile or in your browser settings), or it expires.
  • Usage and audience measurements: 13 months at most.

7. Cookies and local storage

  • `ostraka_session` cookie: strictly necessary; it recognises you from one visit to the next. Only the server can read it (HttpOnly) and it is not used for tracking.
  • Browser local storage: a copy of your progress, for fast display, and your preferences (language, sound, help already seen). This data stays on your device; signing out clears the copy of your progress.

As these are essential to the service, they do not require consent. Audience measurement sets no cookies; if you opt out (at the bottom of this page), your choice is kept in your browser's local storage.

8. Your rights

Under the GDPR, you have the rights of access, rectification, erasure, portability, objection and restriction. From your profile, you can download all your data ("Download my data") and delete your account ("Delete my account"). For the other rights, or any question, write to hello@playostraka.com from the address linked to your progress.

You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

9. Security

Encrypted connections (HTTPS), no stored passwords, single-use sign-in links of which only a fingerprint is kept, and a session cookie that scripts cannot access.