Privacy policy
Last updated: 30 October 2026 — the French version is the reference version.
“One word, once” (wordfirstgame.com) is a game: every day there is a theme, and players try to find as many answers as they can. This page explains which personal data the site processes, why, for how long, and how to exercise your rights.
In short: the site has no ads, no analytics and no cookies. It only keeps what is needed to run your account and the game, and never sells or shares your data.
Data controller
Dorian Barat, publisher of the site (private individual)
Contact for any question about your data: contact@lettrenuage.fr
Data processed
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email address | Create your account, log you in, send you login and password links. Typed by you, or sent by the service you log in with (only if that service has verified it). | Performance of the contract (terms of use) | As long as the account exists. Erased when the account is deleted, or after 3 years of inactivity. |
| Email address and date of your consent, if you subscribe to the newsletter | Send you the newsletter: game news and new themes. | Your consent, which you can withdraw at any time | Until you unsubscribe, when the account is deleted, or after 3 years of inactivity. The site keeps the date of your consent or withdrawal as long as the account exists, to be able to prove your choice. |
| Identifier at Google, GitHub, Discord or Twitch | Recognise you if you choose to log in with one of these accounts. | Performance of the contract | As long as the account exists. Erased when the account is deleted. |
| Password | Log you in. | Performance of the contract | Never stored in clear: only a scrypt hash is kept, for as long as the account. |
| Nickname | Identify you in the game. It is public: shown on your answers and in the leaderboard. | Performance of the contract | As long as the account exists. When it is deleted, your answers stay on the board without your nickname. |
| Answers and their date | The game itself. They are public and form the history of the boards. | Performance of the contract | Kept in the game history; detached from your account and nickname when the account is deleted. |
| Public profile | Shown to other players when they click your nickname in the leaderboard: your points and ranks, your titles (podium of a theme, and “Beta tester” for an account created during the beta), your daily podiums, the days you played, your pace (answers per minute) and the date of your first answer. It is public. Everything is computed from your answers, which are already public, and from the creation date of your account; nothing more is collected. | Performance of the contract | Computed on request, never stored. Disappears with your nickname when the account is deleted. |
| Random player identifier and login session | Recognise you from one visit to the next. | Performance of the contract | In your browser: until you log out or clear the site’s data. On the server: a hash of the session, until logout, and one year at most. |
| IP address | Prevent abuse (bursts of submissions, password guessing). | Legitimate interest: security of the service | Kept in memory for a few minutes, never stored. |
| Technical logs | Diagnose failures (for example an email that could not be sent). | Legitimate interest: proper operation of the service | A few weeks at most (automatic rotation of the server log). |
Do not put personal information in your nickname or your answers: everyone can see them.
Recipients and processors
Your data is never sold or handed over. Only two providers can access it, on behalf of the publisher and only for their task:
- OVHcloud: hosting of the server (Singapore data centre) and of the domain name.
- Brevo (Sendinblue SAS, Paris): sending the account emails and the newsletter. Brevo receives your email address and the content of the email, and keeps your address in its contact list for as long as you are subscribed to the newsletter; its data is hosted in the European Union.
Newsletter
The newsletter is optional: your account, your points and your access to the game do not depend on it. It is only sent to you if you asked for it, by ticking the box offered when you sign up or log in, or from the leaderboard menu. The box is never ticked in advance.
You can withdraw your consent at any time, without giving a reason: with Unsubscribe from the newsletter in the leaderboard menu, or with the unsubscribe link in every newsletter. From the menu, your contact is deleted at Brevo. From the link in a newsletter, Brevo keeps your address on its exclusion list, only so as not to write to you again. Withdrawing does not affect emails already sent.
Logging in with Google, GitHub, Discord or Twitch
These buttons are optional: you can always create an account with your email address. If you choose one, you are sent to that service’s page, which identifies you under its own privacy policy, then sends back to the site an identifier specific to your account there and, if it has verified it, your email address. The site receives neither your password, nor your contacts, nor any other information from that account, and never posts anything on your behalf. These services are not processors: they process your data as separate controllers, for their own purposes. They only learn that you are logging in to lettrenuage.fr.
If the address sent is already that of an account on the site, the login opens that account. Nothing is sent until you click one of these buttons.
Transfer outside the European Union
The game server is located in OVHcloud’s Singapore data centre; Singapore is not covered by an adequacy decision of the European Commission. The publisher’s provider is OVH SAS, a French company; the Singapore data centre is operated by an OVHcloud subsidiary, with which OVHcloud has concluded the European Commission’s standard contractual clauses (article 46 of the GDPR). The data concerned is limited to your email address, your nickname, your answers and the hashes of your password and sessions.
Storage in your browser
The site uses no cookies. It keeps in your browser’s local storage: your player identifier, your login session, your nickname, your email address (to pre-fill the login form), your chosen language and the fact that you have seen the rules. While you log in with Google, GitHub, Discord or Twitch, a single-use secret and your newsletter choice are kept in the tab’s storage for the round trip, then erased: the secret stops anyone else from completing the login in your place. These are strictly necessary for the service you request and therefore do not require your consent. You can erase them by logging out or by clearing the site’s data in your browser.
All resources of the page, including the font, are served by the site itself: browsing the game sends no data to any third party. The links to the sources of the lists (GeoNames, Wikidata, PokéAPI, Grammalecte) are only followed if you click them.
Security
- Encrypted connection (HTTPS) on the whole site.
- Passwords hashed with scrypt; only hashes of sessions and emailed links are kept.
- Single-use, time-limited links (24 hours to create a password, 2 hours to change it or to log in); changing your password closes every open session.
- Limits against abuse: emails per address, login attempts and submissions per minute.
- The data is stored on a server that only the publisher can access.
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, and to withdraw your consent at any time. From the game (leaderboard menu):
- Change your nickname;
- Subscribe to the newsletter or Unsubscribe from the newsletter;
- My data: download your email address, your login methods, your newsletter subscription, your nickname and all your answers in a file;
- Delete my account: your email address, password, identifiers at Google, GitHub…, sessions, nickname and, if you were subscribed, your contact at Brevo are erased; your answers stay on the boards, with nothing that identifies you, and your public profile disappears. To confirm, you enter your password, or your nickname if you have no password.
For any other request, write to contact@lettrenuage.fr; you will get an answer within one month. You can also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of your country.
Children
The game is open to everyone. If you are under 15, ask a parent before creating an account or subscribing to the newsletter.
Changes
This policy may change, for example when a feature changes. The date of the last update is shown at the top of the page.