Data controller
The data controller is the site publisher, Oscar Lesage, a private individual publishing Music Masters on a non-professional basis. Questions about your data: [email protected].
What we collect and why
| Data | Use | Legal basis |
|---|---|---|
| Email, username, hashed password | Create your account, sign in, verify your address and reset your password | Performance of the terms of use |
| Your Google or Discord account ID if used to sign in | Passwordless sign-in. Your Google or Discord photo is never displayed. | Performance of the terms of use |
| Cards, Beats, profile vinyl and items bought with Beats, trades, auctions, collections, achievements, friends, groups and group messages | Run the game and retain your transaction history | Performance of the terms of use |
| IP address and browser for each session, request counters | Secure accounts and limit abuse | Legitimate interest: service security |
| Bot verification when opening packs | Prevent automated opening | Legitimate interest: fair play |
What other players see
Other players see your username, profile vinyl, auctions and ranking. A trade is visible only to the two players involved. Your profile and showcase follow your visibility settings. Group messages are visible only to members. Your email is never shown.
Service providers
Your data is shared only with providers needed for the service, limited to their role:
- The hosting provider (see the legal notice): application server, database and backups, local album cover copies, in Düsseldorf, Germany.
- Cloudflare (Turnstile): bot verification; receives your IP address and browser information.
- Google and Discord : only if you choose to sign in with them.
- Resend : account emails (address verification, password reset); receives your email address and message contents.
No payments are offered on the site; no banking data is collected.
Cloudflare, Google, Discord and Resend may process data in the United States. These transfers are covered by the EU–US Data Privacy Framework or European Commission standard contractual clauses.
Les pochettes sont téléchargées par le serveur et servies depuis le site : ton navigateur ne contacte pas le Cover Art Archive. En revanche, les liens d’écoute t’envoient sur Spotify, Deezer, Apple Music ou YouTube, qui appliquent leur propre politique.
Retention periods
- Account, collection, vinyl and game history: while your account exists. Deleted when you close it.
- Session IP and browser: for the session duration, no later than its expiry.
- Group messages: while the group and your account exist.
Your rights
You may request access, correction, deletion or a reusable copy of your data. You may also object to processing based on legitimate interest, request restriction, and give instructions for your data after death.
Change your username, vinyl and password in the game. For other requests, write to [email protected] from your account email. Response within one month.
If you believe your rights are not respected, you may contact the CNIL (cnil.fr/fr/plaintes).
Security
Connections use HTTPS encryption. Passwords are hashed, never stored in plain text. Database access is restricted to the publisher. You will be notified of a data breach that poses a risk to you.