Privacy Policy

Last updated: 2 August 2026

Sph3re is a social gaming application published by Inv0lv3, the data controller for your personal data. We collect only what the service needs to work: no data is sold, no targeted advertising, no third-party trackers. This document describes every piece of data we process, why it exists, and how long it is kept.

Account data

  • Email address and username: required to create the account, sign in and recover it.
  • Password: never stored in clear text. It is hashed with argon2id, an algorithm designed to hold even if the database were copied.
  • Optional profile: nickname, picture, wallpaper, biography, language, links to your game accounts.
  • Date of birth: only requested if you set up the secret recovery question. It is then used to prove your identity if you lose your password.

Device and connection

  • Device fingerprint: a value derived from browser and screen characteristics, then turned into an irreversible fingerprint (SHA-256). The original characteristics are never stored.
  • IP address: kept to fight abuse (multiple accounts, ban evasion). The history is stored in masked form.
  • Sessions: a session token expires automatically after 24 hours and can be revoked from your settings.
  • Application version and operating system: used for updates and failure diagnosis.

Security logs

  • To keep the service secure, prevent fraudulent access and analyse incidents, we keep technical logs containing the IP address, date and time, the requested resource, the response code, the User-Agent declared by the browser, and any security events triggered (block, request burst, failed sign-in).
  • This processing rests on our legitimate interest in securing our systems: European regulation expressly cites the prevention of unauthorised access and denial-of-service attacks.
  • Ordinary logs are erased automatically after six months, the incident log after three months. When an incident leads to a complaint or proceedings, only the relevant evidence is kept for their duration.
  • These logs are accessible only to those responsible for Sph3re security. They may be disclosed to the competent authorities when an incident warrants it.
  • The country and network operator derived from the IP address are used solely to analyse and block an attack. IP geolocation is approximate: it proves neither an actual location nor the identity of a person.

Location

  • Sph3re does not use GPS and never requests precise location permission.
  • Only an approximate country and city are derived from the IP address, or entered by you on your profile.

Your content

  • Messages, posts, comments, clips, VODs and images are hosted on our own servers (inv0lv3.fr), in France.
  • Private messages are not scanned automatically. Moderation only reads them following a report, and strictly within the scope of that report.
  • Deleted content is also removed from storage. Copies made by other members are however beyond our control.

Microphone, camera and screen sharing

  • Microphone, camera and screen sharing only turn on when you start them, and a visible indicator shows the active state.
  • Voice and video travel live between participants (WebRTC), encrypted. They are neither recorded nor retained.
  • When a direct connection is impossible, the stream goes through our relay (TURN), which merely forwards it without storing it.

Games and statistics

  • Installed games are detected on your own device. Only the name of the game you are playing is shared, and only if you keep your activity visible.
  • If you link a game account (Steam, Blizzard…), we query the publisher's public interface to display your statistics. We never receive that account's password.

Payments

  • Payments are processed by Stripe. Your card number never passes through Sph3re and is never disclosed to us.
  • We only keep your subscription status and transaction history, to meet our accounting obligations.

Artificial intelligence features

  • On desktop, speech transcription runs entirely on your machine: no audio leaves the device.
  • On mobile the local model is too heavy: transcription then goes through an online service, and only when you explicitly ask for it.
  • The chat assistant and voice dubbing send your text or voice to the provider you selected, only at the moment you use those features.

What we do not do

  • We do not sell or rent your personal data, to anyone.
  • No external ad network, no advertising tracker, no marketing profiling. Ads shown come from directly contracted advertisers and are not targeted using your personal data.
  • Your data is shared with a third party in three cases only: the provider required by the feature you are using (payment, artificial intelligence), a legal obligation, or your own request.

Minors

  • Sph3re is intended for people aged 15 and over, and 16 and over in European Union countries that require it.
  • We do not knowingly collect data about a child below that age. Any account reported as such is deleted.
  • A parent or guardian may request deletion of their child's account and data by writing to us.

Retention periods

  • Account data is kept for as long as the account exists.
  • When the account is deleted, identifying data is erased and any content left in place is anonymised, so that other members' conversations remain readable.
  • Technical traces related to abuse prevention (IP addresses, sanctions) are kept for six months, except evidence attached to an incident being handled.
  • Accounting records related to payments are kept for the period required by law.

Security

  • All exchanges with our servers use an encrypted connection (HTTPS/WSS).
  • Passwords are hashed (argon2id) and server access is restricted by key.
  • Should a data breach be likely to expose you, you and the competent authority will be informed within the deadlines set by the GDPR.

Your rights

  • Access and portability: you can export all of your data from the application, under Settings then Privacy.
  • Rectification: your profile information can be changed at any time.
  • Erasure: account deletion is available directly in the application and requires no request to us.
  • Objection and restriction: write to us; failing a satisfactory answer, you may lodge a complaint with the CNIL.

Contact us

  • For any question about your data, or to exercise a right that is not directly available inside the application: 4hm3du51v3@gmail.com
← Back to home