Privacy

In short: no email is kept on our servers. There are no accounts, no advertising cookies and no Google Analytics. Audience measurement is anonymous and can be turned off in one click. The service is free: no data is ever sold or used for advertising. To score your writing, your text is sent to an AI provider: never write real emails or personal data.

1. The emails you write in the game

• Your subject and text go to our server (Cloudflare Workers), which scores them with a rules engine.
• For the "recipient reads it" part, the text is sent to an AI provider: Groq, or as backups Cloudflare Workers AI then Google Gemini. We use their free tiers. Under their terms, submitted text may be kept and reused, for example to improve their products. Google Gemini's free tier does this.
• Our server keeps no copy of your emails and doesn't write them to its logs.
• Don't paste real emails, real names, addresses, numbers, health or banking data, or anything confidential. The situations are fictional: keep it that way.

2. Audience measurement (no cookies)

We measure how the site is used to improve it, within the consent exemption defined by the French data protection authority (CNIL):

• Cloudflare Web Analytics counts visits without cookies and without storing any identifier on your device.
• Anonymous events: game started, email sent (with the score, situation, language and scoring engine, never the text), game completed, daily challenge played, share, rewrite, arrival from an example page, forms sent.
• They are linked to a random identifier stored in your browser. It lasts 13 months and is not extended by your visits. Data is kept for 25 months at most.
• No combining with other data, no sharing with third parties, no cross-site tracking, no advertising.
• The "Stop measuring me" link at the bottom of every page deletes the identifier and turns off all measurement on this device.

3. What stays on your device

• Your language, per-criterion scores, streaks and game history (browser local storage). None of it is sent. You can delete it all from the "Progress" page.
• For the length of the tab, an anti-bot token so you aren't checked on every send.

4. Forms

• Daily challenge by email (optional, box unticked by default): your email address, language, date and proof of consent (the text you accepted and an irreversible fingerprint of your IP address). The subscription only becomes active after you confirm through a link sent by email (double opt-in). Every email will include an unsubscribe link. Proof of consent (including the IP fingerprint) is kept while the subscription is active: unsubscribing deletes your address and this proof. Unconfirmed sign-ups are deleted at most 6 months after the request.
• Premium waitlist: your email address, language and the date, to email you once at launch. Deleted after that email, or earlier on request.
• "Teams" pilot programme: name, organisation, type, number of people, email address and message, to reply to you and run the pilot. Kept for 3 years after the last contact.
• This data is stored with Cloudflare (D1 database). It is never sold, rented or used for advertising.

5. Abuse prevention

To limit abuse (about 30 corrections per hour), we keep send times for at most one hour, linked to an irreversible fingerprint of your IP address. The Cloudflare Turnstile anti-bot check loads on your first send and on forms; it uses no advertising cookies.

6. Service providers

• Cloudflare: hosting, database, audience measurement, anti-bot, and backup AI scoring (Workers AI), as described in section 1.
• Groq and Google: AI scoring, as described in section 1.
• Resend: sends an alert to the publisher when someone applies to the "teams" pilot (organisation name, type and number of people; not your message or your address).
• Fonts are self-hosted: no requests to Google Fonts.

Some providers are based outside the European Union (United States). These transfers outside the European Union rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.

7. Your rights

For any request (access, correction, deletion, restriction of your data or objection to its processing), write to contact (at) mailathlon (dot) com. We reply within one month.

If you believe your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr), or your local data protection authority.

8. Data controller

The data controller is the publisher of Mailathlon, a private individual (see the legal notice), who can be reached at contact (at) mailathlon (dot) com for any request.