Legal
Privacy Policy
How we collect, use, and protect your personal data.
Last updated: May 15, 2026
Data controller
The data controller is OUTERFRAME STUDIO, 91 route des romains, 67200 STRASBOURG, France.
Contact: archive@miskatonicexpedition.com.
Data we collect
We only collect data you voluntarily provide:
- Account data when you register or sign in (email address, display name, profile photo if provided by Google).
- Authentication timestamps and technical identifiers required to maintain your session.
- Minimal technical data sent by your browser (IP address, user-agent) in hosting logs, for security and proper operation of the site.
Purposes and legal bases
Your data is processed for the following purposes:
- Providing and securing your researcher account and access to the Expedition experience (contract performance and consent, GDPR Articles 6.1(b) and 6.1(a)).
- Security, maintenance, and technical improvement of the site (legitimate interest, GDPR Article 6.1(f)).
- Compliance with applicable legal obligations.
Recipients and processors
Your data may be processed by the following providers, strictly within the scope of their services:
- Vercel Inc.: site hosting (https://vercel.com).
- Google Firebase (Google Ireland Limited): authentication and user account management (email, profile data, sign-in timestamps). Policy: https://policies.google.com/privacy
- Google Analytics (Google Ireland Limited): audience measurement after cookie consent (pages viewed, session statistics, approximate location, device type). Policy: https://policies.google.com/privacy
Retention period
Account data is kept for as long as your account is active. You may request deletion at any time; data is then removed within a reasonable period, subject to legal retention obligations.
The host's technical logs are retained according to Vercel's policy.
Your rights
Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection, and portability (where applicable).
To exercise them, email archive@miskatonicexpedition.com. You may also lodge a complaint with the CNIL (www.cnil.fr).
Transfers outside the European Union
Some processors (including Vercel and Google) may process data in the United States or other countries. Such transfers are governed by GDPR mechanisms (standard contractual clauses, adequacy decisions, or equivalent safeguards as applicable).
Security
We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or alteration.