Privacy

Last updated: 4 November 2026. This translation is provided for convenience; the French version prevails.

Who is responsible

Crowd is published on a non-professional basis by a private individual (identity disclosed to the host, see the terms of use), who is the data controller. Contact for your data: contact@crowdmusic.fr.

What we collect

Account: email address; if you sign in with Apple or Google (or signed up with Spotify, a sign-in option since removed), the identifier and email that service sends us (Apple may provide a relay address).
Profile photo: the one you upload or, if you sign in with Google (or signed up with Spotify), that account’s photo, copied once at sign-in. It is visible to everyone with your profile; you can change or remove it from your profile.
Public profile: your username, your stats, your showcase and your goals, visible to everyone; your friends list, visible to signed-in players (to spot mutual friends).
Game: cards, pints and their history, boosters, trades, sales and bids, wishlist, goals, friends, activity shared with your friends, notifications.
Blind test: your game settings, your score, and for each round what you found (song, artist), when, and the points. The text you type is not kept. The daily challenge leaderboard shows your username and score to all players; in a room, the other players see your username, your photo and your results. Free games and rooms are deleted after 90 days, the daily challenge (score and streak) after 13 months. No game reward is tied to the blind test.
Fraud prevention: a fingerprint of your IP address (an irreversible calculation; the address itself is never stored), to detect multiple accounts.
Time spent: the number of minutes per day during which Crowd is open and visible in your browser. No page or action is recorded in this counter, and it never gives any reward. The time of the last heartbeat is also used to show your friends whether you are online (or since when you left); you can hide this from your profile.
Performance measurements: page load times and smoothness of the booster opening animation (frames per second), with only the screen type (touch or not); no identifier or device model.
Sign-in: the authentication service keeps a sign-in log (date, IP address, device) to diagnose access problems.
Feedback: the message you send with the “Feedback?” button, the page you were on, the browser type and your username if you are signed in. It is used to fix problems and improve the game. It is kept as long as it is useful for follow-up; when your account is deleted, your username is detached from it.
Moderation: reports concerning you and, where applicable, the reason for and duration of a suspension.
On your device: a session cookie (sign-in), a language cookie if you choose a language, a visitor’s collection and your sound preferences in local storage. No advertising or audience measurement cookies.

Why

To run your account and the game (performance of the contract, see the terms of use).
To let you know by email when the team starts a Happy Hour (legitimate interest: informing players about a service they use). Your address is used for nothing else, and every email contains a link to stop receiving them; the setting is also in your profile.
To protect the game’s economy against cheating and multiple accounts (legitimate interest).
To monitor traffic and the proper functioning of the service, and to fix account problems (legitimate interest): the team can view accounts, their time spent and the log of sensitive actions, and add pints to an account, every addition being logged.

Only what the game needs. No advertising, no resale, no commercial profiling, no exploitation of your data.

Who has access

Our host, Scaleway (France): site, database and authentication in Amsterdam (Netherlands, European Union); emails (sign-in, Happy Hours) sent by Scaleway from Paris.
Deezer: covers and previews are loaded from Deezer’s servers, which therefore see your IP address; as does the song page if you click “Listen on Deezer”. Crowd sends no account data to Deezer.
Apple or Google: only if you use them to sign in.

How long

Account and game data: as long as the account exists; deleted when it is deleted.
Network fingerprints: 90 days after your last visit.
Sign-in log: 30 days.
Notifications: 90 days after being read, 1 year at most.
Time spent (minutes per day): 13 months.
Blind test games: 90 days (daily challenge: 13 months).
Trade security log (technical identifier): 3 years.

Your rights

From your profile, you can download all your data (access, portability), change your username (rectification) and delete your account (erasure). For objection or any other request: contact@crowdmusic.fr. You can also lodge a complaint with the CNIL (the French data protection authority).

Age

Crowd is for people aged 15 and over.

What we collect

Account: email address; if you sign in with Apple or Google (or signed up with Spotify, a sign-in option since removed), the identifier and email that service sends us (Apple may provide a relay address).

Profile photo: the one you upload or, if you sign in with Google (or signed up with Spotify), that account’s photo, copied once at sign-in. It is visible to everyone with your profile; you can change or remove it from your profile.

Public profile: your username, your stats, your showcase and your goals, visible to everyone; your friends list, visible to signed-in players (to spot mutual friends).

Game: cards, pints and their history, boosters, trades, sales and bids, wishlist, goals, friends, activity shared with your friends, notifications.

Blind test: your game settings, your score, and for each round what you found (song, artist), when, and the points. The text you type is not kept. The daily challenge leaderboard shows your username and score to all players; in a room, the other players see your username, your photo and your results. Free games and rooms are deleted after 90 days, the daily challenge (score and streak) after 13 months. No game reward is tied to the blind test.

Fraud prevention: a fingerprint of your IP address (an irreversible calculation; the address itself is never stored), to detect multiple accounts.

Time spent: the number of minutes per day during which Crowd is open and visible in your browser. No page or action is recorded in this counter, and it never gives any reward. The time of the last heartbeat is also used to show your friends whether you are online (or since when you left); you can hide this from your profile.

Performance measurements: page load times and smoothness of the booster opening animation (frames per second), with only the screen type (touch or not); no identifier or device model.

Sign-in: the authentication service keeps a sign-in log (date, IP address, device) to diagnose access problems.

Feedback: the message you send with the “Feedback?” button, the page you were on, the browser type and your username if you are signed in. It is used to fix problems and improve the game. It is kept as long as it is useful for follow-up; when your account is deleted, your username is detached from it.

Moderation: reports concerning you and, where applicable, the reason for and duration of a suspension.

On your device: a session cookie (sign-in), a language cookie if you choose a language, a visitor’s collection and your sound preferences in local storage. No advertising or audience measurement cookies.

Why

To run your account and the game (performance of the contract, see the terms of use).

To let you know by email when the team starts a Happy Hour (legitimate interest: informing players about a service they use). Your address is used for nothing else, and every email contains a link to stop receiving them; the setting is also in your profile.

To protect the game’s economy against cheating and multiple accounts (legitimate interest).

To monitor traffic and the proper functioning of the service, and to fix account problems (legitimate interest): the team can view accounts, their time spent and the log of sensitive actions, and add pints to an account, every addition being logged.

Only what the game needs. No advertising, no resale, no commercial profiling, no exploitation of your data.

Who has access

Our host, Scaleway (France): site, database and authentication in Amsterdam (Netherlands, European Union); emails (sign-in, Happy Hours) sent by Scaleway from Paris.

Deezer: covers and previews are loaded from Deezer’s servers, which therefore see your IP address; as does the song page if you click “Listen on Deezer”. Crowd sends no account data to Deezer.

Apple or Google: only if you use them to sign in.

How long

Account and game data: as long as the account exists; deleted when it is deleted.

Network fingerprints: 90 days after your last visit.

Sign-in log: 30 days.

Notifications: 90 days after being read, 1 year at most.

Time spent (minutes per day): 13 months.

Blind test games: 90 days (daily challenge: 13 months).

Trade security log (technical identifier): 3 years.