Privacy

ELVN SAS, 60 rue François Ier, 75008 Paris, France, registered with the Paris Trade and Companies Register (RCS) under number 979 732 906. ELVN has not appointed a data protection officer: for any question about your data, write to contact@zoora.app.

Account. With “Continue with Google”: the identifier, e‑mail address, name and photo of your Google account, and the technical tokens of the sign-in. With “Sign in with Apple”, in the iPhone app: the identifier Apple gives your account for Zoora, your e‑mail address (or Apple’s relay address, if you choose to hide yours) and a token used to revoke the sign-in when you delete your account; your name is not asked for. With an e‑mail address and a password: the address, its confirmation, and the password in a hashed form that cannot be read back. Then the username you choose, your year of birth (and, in the year you turn 16, your confirmation that you have had your birthday), the profile picture you choose and your e‑mail preferences.

Game. Your cards and their history of owners, your Booster openings and their draws, your Reserve, your Shards and their log, your Missions and completions, your profile (showcase, title, friend code, whether your collection is private), your friends, your Trades and your Market listings, and the messages the team sends you in the game.

Purchases. The offers purchased, their dates and amounts, the invoices, the box ticked before paying (date and version of the text) and, where applicable, the withdrawal or cancellation. The card number stays with Stripe: ELVN neither sees nor stores it. For a purchase made in an app: the product, the date, the price and currency, the store’s country, the identifiers of the transaction and of the subscription at Apple or Google, and what follows (renewal, cancellation, refund), passed on by RevenueCat; the payment itself stays with Apple or Google.

Trial Booster, without an account. A random token kept in a cookie (on the site) or on the phone (in the app), the pending draw, and the network it was opened from, truncated (the first three numbers of an IPv4 address, the prefix of an IPv6 address): never the full address.

Game attendance. The days you come into the game signed in: the time of your first and last visit of the day, and the number of 5-minute slots you were there. Neither the pages viewed nor your IP address.

Security. For each open session: the IP address and the browser. The technical logs of the service (IP address, page, date and time of requests and errors).

One address, one start. A fingerprint of your e‑mail address: a hash (SHA-256) computed on the address reduced to its basic form (lower case, without “+tag”, and without the dots of a Gmail address), which does not contain the address in clear. It ensures that the same mailbox, variants included, opens only one account at a time and receives the welcome gifts (trial Booster, welcome pack) only once.

Moderation. Reports received, and measures taken on an account with their reason.

Mobile apps. Your session token, kept in the iPhone’s keychain or Android’s encrypted storage; the operating system (iOS or Android), the app’s version and that of its latest update, sent with each request to check that this version is still served. The camera is only used to read a friend’s QR code, on the phone: no image is sent. Access to Photos is only used to save a card’s picture there (“Download”): the app never reads your photos. The app contains no advertising and no tracking or audience measurement tool. When the app runs into an error, it sends us a technical report so that we can fix it: the error message, the place in the code, the screen concerned, the operating system, the app’s version and that of its update, and your account’s identifier if you are signed in. The report contains neither your e-mail, nor your IP address, nor what you typed, and it is deleted after 30 days. If you have agreed, in your phone’s settings, to share diagnostics with app developers, Apple or Google pass on crash reports and performance measurements to us, without your name or address.

Notifications. If you allow notifications on your phone: a notification token specific to the device and the app, linked to your account, with the operating system, the language and the app’s version, and the date it was last used; and the notifications sent, with their delivery receipt.

Feedback. What you send us with “Send feedback”: the type (bug, idea, question, purchase), your message, the order concerned if you choose one, and what the game attaches to it, shown before sending: the page, the browser and operating system, the screen size and the game version. Our reply arrives in your in-game mail.

The e‑mail address and the year of birth are required to play with an account; without them, only the trial Booster is possible. An account whose declared age is under 16 is deleted immediately, along with its data.

Only the optional e‑mails and the app’s notifications rely on your consent. Zoora uses neither advertising nor advertising trackers: the only audience measurement, without cookies, is used to understand attendance (see “Audience measurement and error tracking”). Your data is never sold.

Always sent, because they serve the contract or the law: the welcome e‑mail, purchases and their confirmation, withdrawal, Zoora+ (activation, cancellation and, for the yearly offer, the reminder before its renewal), moderation measures and the deletion of the account.

Your choice: Trades and friends, Market sales, the Saturday reminder, events, messages from the team, new season. They are all off by default; you turn them on and off in “Account settings”. Each one also carries an unsubscribe link that turns it off in one click, without signing in.

E‑mails are sent from bonjour@zoora.app, through Resend; your replies arrive at contact@zoora.app.

The Zoora app on iPhone and Android can send you notifications, only if you allowed it on your phone: a trade offered or its answer, a friend request, a card sold on the Market, a message from the team, your Booster Reserve becoming full and, if you turn it on, an event that begins. Each category can be turned off in the app’s settings. Between 10 pm and 8 am, your phone’s time, the game’s reminders (full Reserve, event, team message) wait for the morning; what other players do arrives at any hour. Never for each Booster that arrives, and never for advertising.

For this, we keep the phone’s notification token (an address provided by Expo, Apple and Google, which does not identify you elsewhere), its system (iOS or Android), its time zone and the app’s version. They are erased when you sign out, withdraw the permission, uninstall the app or delete your account, or after 270 days without use. You choose the notifications in the app’s settings or in “Account settings”.

Your username, your showcase, your title and your Market listings. A shared card has a public page (my.zoora.app/c/…) that shows its owner by username; with “Private collection”, your username no longer appears there.

Your profile picture: if you choose an animal from your collection, it is visible to everyone; if you choose your Google photo, only you can see it, and others see your initial. Your name, your e‑mail address and your year of birth are never shown.

If you invite a friend or were invited by one, each of you sees the other’s username and how many days the invitee has played, never their purchases.

The team has an administration console, restricted to a few addresses and protected by two-factor authentication. There it sees accounts (e‑mail address, username, year of birth, dates), their cards, openings, Shards and purchases, in order to help players, check draws and fight fraud. Each of its actions on an account (message, correction, sanction) requires a reason and is logged: who, what, on what, when and why.

The zoora.app site sets no cookies. The my.zoora.app game uses only strictly necessary cookies, which do not require consent: so there is no banner.

For the trial Booster and sensitive actions, Zoora tells visitors apart from bots with Cloudflare Turnstile, in invisible mode, which analyses browser signals and the IP address (in the app, in a web view); Turnstile is governed by the Cloudflare Turnstile Privacy Addendum. At the time of payment on the site, Stripe’s script may set cookies necessary for the security of the payment.

The apps use no cookies. They keep on the phone your session token (in its secure storage), the trial Booster’s token, your preferences (sound, haptics, language) and the pictures of the cards already shown, to go faster. Signing out erases the session token.

Audience measurement. zoora.app and my.zoora.app count their visits with Elvn, ELVN’s audience measurement tool, operated by ELVN itself, for the sole purpose of understanding attendance (pages viewed, where visits come from, devices) and improving Zoora: no advertising, no profiling, no resale, no sharing. The measurement works without cookies or storage on your device, contains no account, e‑mail or username, and does not track anyone from one site to another. It falls within the consent exemption of Article 82 of the French Data Protection Act (loi Informatique et Libertés) as clarified by the CNIL: so there is no banner.

For each page viewed, an ephemeral technical pseudonym is computed on the server from a secret salt renewed every month (destroyed no later than 40 days afterwards), the site identifier, your IP address and your browser; the IP address and the browser signature are never recorded. The following are processed: the page viewed (without parameters, except utm_* campaign tags), the site you came from, the country, region and city inferred from the IP, the browser, the operating system, the type of device, the screen width and the language. Raw pseudonymised events are purged within 1 to 2 months, hourly aggregates after 90 days; only anonymous daily counters are kept beyond that. The game also counts a few actions, with nothing that identifies you: trial Booster opened (biome), account created, username chosen, welcome pack chosen (biome), Booster opened (biome, type), Legendary or Mythic card pulled (rarity), share (format), Market purchase and listing (rarity, origin), sale at the Counter (number of cards), gift code used (number of Boosters), Mission and Flames tier claimed (type). On the PRISM Booster demo shared on X: demo opened and click-through to the game (biome, best rarity, in the post or on the page).

To stop being counted: turn on your browser’s Global Privacy Control signal (your visits are then ignored as soon as it is received), or use this button, which keeps a simple local preference (elvn_ignore) in your browser.

Error tracking. When the game crashes, a technical report is sent to Sentry so that we can fix it: the error message, the place in the code, the browser and operating system, the page concerned and, for serious errors, a short recording of the screen in which all texts and images are masked. These reports contain neither your e‑mail, nor your IP address, nor the content of your forms, and are deleted after 90 days. This tracking is necessary for the proper functioning of the service and sets no cookies.

These providers process your data on behalf of ELVN, in accordance with its instructions, except Google and Apple, which act on their own behalf for sign-in, the distribution of the apps and the payment of purchases made in the apps, under their own privacy policies.

Cloudflare, Google, Apple, Resend, RevenueCat and Expo may process data in the United States. These transfers are covered by the EU–US Data Privacy Framework, for the companies certified under it, and by the European Commission’s standard contractual clauses.

You can access your data, rectify it, erase it, restrict its processing, object to processing based on legitimate interest, withdraw your consent to optional e‑mails, and receive your data in a readable format to take it with you.

From your profile, in “Account settings” (on the site), or in Menu, Settings (in the app): “Download my data” gives you everything we keep about you, in JSON, and “Delete my account” deletes it; the my.zoora.app/delete-account page does so too, without the app. For anything else, write to contact@zoora.app from your account’s address: we reply within one month.

Access to the camera, to Photos and to notifications can be withdrawn at any time in your phone’s settings.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France).

All connections are encrypted. A password is never kept in clear: only its hashed form is, and sign-in attempts are limited. Session cookies are inaccessible to the page’s scripts, the apps’ session token is kept in the phone’s secure storage, access to the administration requires two-factor authentication, and its logs cannot be modified.

This policy may change along with the game. Each version is published at this address with its date of update; a significant change is announced in the game.