Privacy Policy

1. Who we are

Play Magic Reef ("we", "us") is operated by Eugene Lee (Entrepreneur individuel, SIREN 789 994 928), 205 rue Saint-Honoré, 75001 Paris, France. We are the data controller for the personal data described in this policy.

The service is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States.

For any privacy question or to exercise your rights, contact us at contact@playmagicreef.com.

2. A note for parents, hosts & venues

Play Magic Reef is designed to be set up and supervised by an adult — a parent, teacher, or a host at a venue or event. It is not directed to, or intended to be used independently by, children. The supervising adult is responsible for the children in their care, for deciding what is shown on the shared screen, and for any consent required before a child takes part.

Children take part anonymously: we do not ask a child for their name, email, age, or any account. Please make sure children photograph or color a drawing only — the camera captures a real photo, so it should not be pointed at a child's face or other people (see "Camera and photos" below).

3. What we collect and why

Children & guests (anonymous)

When a guest joins a tank (by scanning its QR code) and sends a fish, we process:

• The fish image — either the artwork colored in the app, or a photo taken with the device camera — uploaded so it can appear in the tank.
• An optional name the guest gives the fish, and their chosen size and speed.
• The tank's room code, stored in the browser so a refresh keeps the same tank.

We do not collect a guest's name, email, age, location, or device identifiers, and we do not use advertising or tracking. Legal basis: our legitimate interest in running the shared experience the supervising adult has chosen to use (Art. 6(1)(f) GDPR), relying on that adult's supervision and consent.

Hosts & account holders

If you create an account to host and save tanks, we process:

• Your email address (and, if you sign in with Google, the basic profile Google shares — typically your name and email).
• Your tanks (room codes and any names you give them) and which ones you own.
• Billing data needed to manage your plan — a Stripe customer reference, subscription or purchase identifiers, plan type, status, and renewal date. Card details are entered with and handled by Stripe; we never see or store your full card number.

Legal basis: performance of our contract with you (Art. 6(1)(b)) to provide accounts and paid features; compliance with legal obligations such as accounting and tax (Art. 6(1)(c)); and our legitimate interests in securing and improving the service (Art. 6(1)(f)).

Technical data

Our hosting and infrastructure providers process limited technical information (such as IP address and request logs) to deliver and secure the service. We do not run analytics, advertising, or cross-site tracking.

4. Camera and photos

The "scan" feature opens the device camera and captures a photo, which becomes the fish. That photo is the actual image the camera sees, so it can include whatever is in frame. Please point it at the paper drawing only. Captured photos are uploaded and shown in the tank in the same way as colored fish.

If a photo accidentally shows a person or other personal information, ask the host to remove that fish, or contact us — we will delete it promptly.

5. How fish are shown and shared

Fish are meant to be seen — they appear on the tank's big screen, and anyone with that tank's link or room code can view the fish in it. Each fish image is stored with a web address that is accessible to anyone who has the link. Please don't submit anything private or identifying.

6. Cookies, local storage and analytics

We use only what's necessary to make the service work — a small amount of browser storage to remember a tank's room code, and, for signed-in hosts, a secure session cookie to keep you logged in. We do not use advertising cookies.

We also use Google Analytics to understand how Play Magic Reef is used — for example which pages are visited and which features are popular — so we can improve it. Google Analytics sets its own cookies and collects usage and device information (such as pages viewed and an approximate location) together with a random identifier. We never send it your name, your email address, or your child's artwork.

7. Who we share data with

We do not sell personal data. We share it only with service providers ("processors") who help us run Play Magic Reef, under contracts that require them to protect it:

• Supabase — database, authentication, and file storage that hosts tanks, accounts, and fish images.
• Stripe — payment processing and subscription management for paid plans.
• Google — if a host chooses to sign in with Google, and Google Analytics, which provides us with usage statistics.
• Vercel — website hosting and infrastructure that serves the app.

We may also disclose data where required by law, or to protect our rights, safety, or users.

8. International data transfers

Some providers (such as Supabase, Stripe, and Google) may process data outside the European Economic Area, including in the United States. Where they do, the transfer is protected by an appropriate safeguard — an EU adequacy decision, or the European Commission's Standard Contractual Clauses. You can ask us for more detail at contact@playmagicreef.com.

9. How long we keep data

• Fish images and tank data are kept until the host who owns the tank deletes the fish, deletes the tank, or deletes their account. A guest, parent, or anyone can ask a host (or us) to remove a specific fish at any time.
• Host account data is kept while your account is active and is deleted when you delete your account.
• Billing and transaction records are kept for as long as legally required (for example, French accounting and tax rules generally require invoices to be retained for several years).

10. Your rights

Under the GDPR you have the right to access your data; to have it corrected or erased; to restrict or object to processing; to data portability; and to withdraw consent at any time (without affecting earlier processing). To exercise any of these, email us at contact@playmagicreef.com. As guests are anonymous, we may need the tank's room code and details of the fish to find and remove the right content.

You also have the right to lodge a complaint with your local data protection authority. In France this is the CNIL — www.cnil.fr.

11. Children's data

We take children's privacy seriously. The service relies on adult supervision and does not knowingly collect personal data directly from children. In France, processing based on a child's own consent is only valid from age 15; below that age, a parent or guardian must consent. By setting up or supervising a session, the responsible adult confirms they have the authority to do so for the children taking part.

If you believe a child's personal data has been provided without the proper consent, or you want it removed, contact us at contact@playmagicreef.com and we will delete it promptly.

12. Security

We use reasonable technical and organizational measures to protect personal data, including encryption in transit and access controls on our systems. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

13. Changes to this policy

We may update this policy from time to time. We'll change the "Last updated" date above and, for significant changes, take reasonable steps to let account holders know.

14. Contact us

Questions about this policy or your data? Email contact@playmagicreef.com, or write to Eugene Lee, 205 rue Saint-Honoré, 75001 Paris, France.