Privacy Policy

1. Who is responsible for your data

The data controller is AURôRE home design, registered in France under company number 949 137 889, of 636 Chemin de Lanoye, 32490 Marestaing, France. For any privacy matter, write to [email protected].

2. What we collect

If you create an account

• Display name — chosen by you, shown to you in the site header.
• Email address — used to identify the account and to contact you about it.
• Password — never stored as you typed it. We keep only a one-way scrypt hash with a unique random salt, from which the original password cannot be recovered.
• Virtual coin balance and the date of your last daily bonus — so your balance persists and the bonus can be limited to once a day.
• Account creation date.

That is the entire account record. We do not ask for your real name, date of birth, address, phone number or any document. We never ask for payment details, because there is nothing to pay for.

If you just browse or play as a guest

You can use the site and open any game without an account, and we store nothing about you in our database. Our web server keeps standard technical logs — IP address, timestamp, page requested, browser user-agent — which exist to keep the service running and secure, and are retained for a short period before deletion.

What we deliberately do not collect

• No payment or card data of any kind.
• No advertising or cross-site tracking identifiers.
• No third-party analytics or social media pixels.
• No special category data (health, beliefs, biometrics and similar).

3. Why we use it, and on what legal basis

• To provide your account — signing you in, keeping your coin balance, awarding the daily bonus. Legal basis: performance of our agreement with you.
• To keep the site secure and working — server logs, preventing abuse and automated misuse. Legal basis: our legitimate interests in a safe, functioning service.
• To comply with our age restriction — recording that you confirmed you are 18 or over. Legal basis: our legitimate interest in restricting the site to adults, and our legal obligations.
• To answer your messages — replying to email you send us. Legal basis: legitimate interests.

We do not use your data for automated decision-making or profiling.

4. Who else sees it

We do not sell, rent or trade personal data — to anyone, ever. Data is shared only with:

• Our hosting provider, which operates the server the site runs on and therefore processes technical log data on our behalf.
• Game providers, indirectly. Games load inside our pages straight from the provider's own servers, so your browser connects to them and they will see your IP address, browser information and any cookies they set. That connection is governed by the provider's own privacy policy, not ours. We pass them no account data — they do not receive your display name, email or coin balance.
• Authorities, if we are legally required to disclose something.

5. Cookies

We use a small number of strictly functional cookies and local storage entries — a signed session cookie so you stay logged in, and a record that you passed the age confirmation. We set no advertising or analytics cookies. Full details are in our Cookie Policy.

6. How long we keep it

• Account data — for as long as your account exists. Ask us to delete it and the record is removed from our database.
• Server logs — a short rolling period for security and diagnostics, then deleted or overwritten.
• Emails you send us — kept while the matter is open and for a reasonable period afterwards.

7. Security

The site is served over HTTPS. Passwords are hashed with scrypt and a per-user random salt. Session cookies are cryptographically signed, marked HttpOnly and Secure, and cannot be read or forged by scripts. Access to the server is restricted to the people who need it. No system is perfect, but we keep the amount of data we hold small precisely so that a breach would expose as little as possible.

8. Your rights

Under the GDPR and France data protection law you may ask us to: give you a copy of your data; correct it; delete it; restrict or object to our use of it; or provide it in a portable format. You may also withdraw consent where we relied on it.

Email [email protected] from your account address and we will respond within 30 days, free of charge. If you are unhappy with our response you may complain to the supervisory authority in France — the CNIL (www.cnil.fr) — or to the data protection authority in the country where you live.

9. Children

Sweet Candy is for adults aged 18 and over and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, contact us and we will delete the account and its data promptly.

10. International transfers

We are established in France, but the server hosting this website is located in the United States. That means the limited technical data described above — principally your IP address in server logs, and your account record — is stored outside the European Economic Area.

Where data leaves the EEA we rely on the European Commission's Standard Contractual Clauses with our hosting provider, together with the practical safeguard that we hold very little: no payment data, no identity documents and no tracking profiles. Game providers load their demos from their own infrastructure, which may also sit outside the EEA, under their own policies.

11. Changes to this policy

If we change this policy we will update the "Last updated" date above, and for significant changes we will make it clear on the site. The version published here is always the one that applies.