Privacy policy

Last updated: October 11, 2026

At Kamelio, we want you to have fun with peace of mind. This page explains, item by item, what is processed, why, by whom and for how long. We collect the bare minimum, and every retention period stated here is enforced by the server itself.

If you play without an account

• Your game nickname: visible to the players in your room. It lives in the server's memory for the length of the game, then for 3 minutes after you leave (so you can be recognised if your connection drops). It is never written to disk or to the server logs.
• Your drawings: sent to the players in your room for the search, then forgotten. Two exceptions:
  • set aside for review: a drawing the anti-cheat finds odd is kept, with your nickname, so that a person can look at it. No sanction is ever automatic. Deleted after 30 days at most;
  • submitted to the daily challenge: only if you click “Submit this board for the daily challenge”, and your nickname is shown before you click. A submission that isn't picked is deleted after 90 days. A published submission becomes a day's challenge and stays online, with your nickname.
• Our own audience measurement: the server counts page views and game steps (game created, round played…), without cookies, without identifiers and without IP addresses. It only keeps counters: the page (without game code or nickname), the language, the screen type, the site you came from. Raw events are deleted after 30 days, daily totals after 3 years. This data cannot identify anyone.
• Anonymous game statistics: number of rooms and rounds, backgrounds, durations, with no nickname or IP address, to follow how the game is doing.
• Google Analytics: only if you accept it (see the Cookies page). Google only receives the page path, never a game code or a nickname, and sets the _ga cookies for 13 months.
• Technical logs: the server records its errors and how games unfold so we can fix bugs, using a temporary session identifier, with no nickname or IP address. Deleted after 30 days.
• Abuse protection: to block bots, the server counts connections and requests per IP address in memory, for a few minutes. That address is never written down.
• Preferences in your browser: your language, your cookie choice, the tips you've already seen, whether you've played today's challenge. They stay on your device (see the Cookies page).

If you create an account (optional)

An account is optional, and always will be. It keeps your nickname, avatar and stats from one game to the next.

• Email address: used only to send you your sign-in link. Never shown to other players, never sold, never used for advertising.
• What is public, on your profile (kamelio.io/en/player/your-nickname): your reserved nickname, your painted avatar, your game stats, your achievements and your sign-up date (“member since”). It is reached through your nickname; the list of members is not published anywhere. The address of your avatar image contains your account's technical identifier: a string of characters drawn at random when the account was created, unrelated to your email.
• Your daily challenge attempt: its result is kept for 7 days, so that only one attempt counts per day, on all your devices.

No password is ever created or stored: you sign in only with a single-use link sent by email.

Who processes your data

Kamelio never sells any data, to anyone, ever. Without an account and without consent to Google Analytics, your browser only talks to kamelio.io (fonts, images and the game are all served by us), and to Supabase to show a profile or a signed-in player's avatar. The following act as processors under the GDPR:

• OVH (France): hosts the game server and its files (drawings set aside, daily challenge, our own measurement, logs).
• Supabase (Ireland): hosts accounts, profiles and avatars. When you open a player's profile, or see a signed-in player's avatar, your browser queries Supabase directly: your IP address reaches it, as with any site you visit.
• Resend (Ireland): sends the sign-in link. It only receives the email address, for as long as it takes to deliver the message.
• jsDelivr: serves Supabase's sign-in library, loaded only when you sign in or are already signed in.
• Google Analytics (Google Ireland): only if you accept it. Data may be transferred to the United States, under the EU–US Data Privacy Framework.
• YouTube (Google): only if you click the demo video on the home page.

Legal bases

• Running the game, protecting it from abuse, fixing bugs and our own audience measurement: legitimate interest (letting you play, and knowing whether the game works).
• Google Analytics: your consent, which you can withdraw at any time.
• Account, public profile and daily challenge: performance of the service you asked for by creating your account or submitting your drawing.

Retention periods

• Game nickname: the game, plus 3 minutes after you leave.
• Drawings: not kept; set aside for review 30 days at most; submitted to the challenge 90 days, or online for as long as they are published.
• Daily challenge attempts (account): 7 days.
• Our own measurement: raw events 30 days, daily totals 3 years.
• Technical logs: 30 days.
• Backup of the game server's files (drawings set aside, daily challenge, our own measurement): one copy a day, kept 30 days, on a computer belonging to the publisher, with an encrypted disk.
• Google Analytics: 13 months for the cookies.
• Account (email, nickname, avatar, stats, achievements): for as long as the account exists.

Your rights

Under the GDPR, you have the right of access, rectification, erasure, objection and portability.

With an account, you can erase everything yourself, in two clicks, without writing to us: go to My account and use “Delete my account”. Deletion removes your email address, nickname, avatar, stats, achievements, drawings set aside, and your daily challenge submissions and attempts; your nickname becomes available to someone else. A drawing already published as a daily challenge stays online, without your nickname. Supabase's technical backups expire on their own after a few days, the game server's after 30 days. Should one of them ever be restored, whatever it still held about your account would be erased again, automatically.

Without an account, your nickname is tied to nothing that could lead back to you. If you want a drawing you submitted, or one that was published, to be removed, write to us.

You can write to us at contact@webxplore.fr, and you have the right to lodge a complaint with the CNIL.

Contact

Data controller: Xavier Louis, WebXplore (sole trader), 9 rue des Roseaux, 68600 Obersaasheim, France · contact@webxplore.fr.