Privacy Policy

1. Introduction

This privacy policy describes how Red or Green (redorgreen.fr) collects, uses and protects users’ information, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

2. Data controller

Red or Green (publisher of the website redorgreen.fr)
Email: chadizarkal25@gmail.com

For any request relating to the processing of personal data, you can contact us at this address.

3. Data collected

3.1 Data you provide voluntarily

• Gender and age range — selected before playing the duels. This data is used only to display segmented statistics (rankings by gender/age).
• Red Flag Test — sex, age range and answers to the questionnaire, recorded with the score, the length of the game and a random sharing code. No name, email address or identifier is requested. A result can only be viewed by whoever has its link; the answers appear nowhere else except mixed with everyone else’s, in the test’s public statistics.
• Free text — situations submitted to the Oracle. These texts are sent to an AI service (Google Gemini) for analysis.
• Voice — if you use the Oracle’s dictation button. The recording is processed by your browser’s speech recognition, not by us: we only receive the resulting text. On Chrome and Edge, this speech recognition sends the audio to Google’s servers; on Safari, it may be processed on the device. We do not keep any recording. Dictation is optional: the keyboard remains available.

3.2 Data collected automatically

• Session data — length of visit, pages viewed, interaction events (internal analytics).
• IP address — used only for rate limiting, to protect the service against abuse. Not stored in the database.
• Technical data — browser type, operating system, screen size (via Vercel Analytics and Speed Insights).

3.3 Local storage (localStorage)

• Profile preferences (gender, age)
• Game session history
• Self-assessment test results
• The Red Flag Test game in progress, so that you can resume it — deleted once it is more than seven days old

This data stays on your device and is never sent to our servers. The Oracle’s voice dictation is the exception and is described in section 3.1: it goes through your browser’s speech recognition.

4. Purposes of processing

5. Retention period

• Votes — kept as long as the service is active.
• Red Flag Test games — kept as long as the service is active.
• Analytics sessions — 12 months maximum.
• Situations submitted to the Oracle — 6 months maximum.
• IP addresses — not stored (used in memory only).

6. Transfers of data outside the EU

Some data may be transferred to countries outside the European Union:

• Vercel Inc. (United States) — hosting. Vercel has signed the Data Processing Addendum (DPA) and uses the Standard Contractual Clauses.
• Google Cloud / Gemini AI (United States) — analysis of Oracle situations. Covered by Google’s Standard Contractual Clauses.
• Browser speech recognition — on Chrome and Edge, the dictation audio is sent to Google’s servers by the browser itself. This transfer is governed by your browser’s terms, not ours: we have no access to either the audio or the metadata.
• Supabase Inc. — database. The project may be hosted in an EU region.
• Ad network — the advertising scripts are served from the domains bauval.org and abscloud.org, outside the European Union. Loading these scripts sends the ad network your IP address, your browser and the page viewed. This happens when pages that carry an ad are loaded, listed below.

7. Your rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access — obtain a copy of your personal data.
• Right to rectification — correct inaccurate data.
• Right to erasure — request the deletion of your data.
• Right to data portability — receive your data in a structured format.
• Right to object — object to the processing of your data.
• Right to withdraw consent — at any time, without affecting the lawfulness of processing carried out before.

To exercise these rights, contact us at chadizarkal25@gmail.com.

You may also lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés, the French data protection authority).

8. Cookies and local storage

The site uses cookies and similar technologies:

• Essential cookies — needed for the site to work (session, preferences).
• Analytics — Vercel Analytics and Speed Insights to measure the site’s performance.

The site displays ads operated by a third-party ad network, whose scripts are served from the domains bauval.org and abscloud.org. These ads are labeled “Publicité” (advertisement).

These scripts load when the pages concerned are opened. The ad network and its partners may set cookies and use technical identifiers to measure how ads are displayed and to tailor them to your previous visits to this site or to other sites.

Ads appear on the home page and in the games, between two steps: verdicts, breaks, start and end-of-game screens. They are never loaded while you are answering or voting, nor on the administration screens. At the end of the Red Flag Test, clicking “See my result” may also open an advertising page in the background (a “pop-under”).

To opt out, several options are available to you: set your browser to block third-party cookies, install an ad blocker, or use the opt-out links below. You can also write to us at chadizarkal25@gmail.com to exercise your right to object.

You can opt out of advertising cookies via aboutads.info/choices, or configure your browser to limit cookies.

9. Sharing with partners and processors

We share certain data only with technical service providers needed to run the service (hosting, analytics, database), to the extent of their operational needs.

• Vercel — hosting, technical logs and performance measurements.
• Supabase — storage of application data.
• Google (Gemini) — analysis of texts submitted to the Oracle.
• Ad network (bauval.org, abscloud.org) — display of ads.

10. Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encrypted communications (HTTPS/TLS)
• Secure authentication for administration (HMAC-SHA256)
• Rate limiting on the APIs
• Validation and sanitization of all user input

11. Minors

This site is intended for people aged 16 and over. The self-assessment tools deal with sensitive subjects (violence, consent) that are not suitable for minors without support.