Publisher
RepoMasters is published by MINDLET (SAS with share capital of €500), the controller of your data.
Full legal notice: terms of use.
Contact: contact@masters-masters.com.
Hosting
The site and its data are hosted by Cloudflare (Cloudflare Workers, D1 databases and related storage). The D1 databases hold shared data (accounts, profiles, market, and the exchange of duplicate files and wanted repos). Each player’s game state is stored in the European Union. Cloudflare, a US company, may process some data outside the European Union on its global network, with the safeguards required by the GDPR.
Data we collect
You access RepoMasters with your MastersMasters account (masters-masters.com), the shared account for the Masters games: signing up, logging in, verifying your email address and declaring your age all happen there, under its own privacy policy. RepoMasters never receives your login credentials.
We only collect what we need to create and run your account:
- what your MastersMasters account sends RepoMasters each time you log in: your email address and whether it’s verified, your username, your display name, your profile photo if you have one and your MastersMasters account ID;
- your game progress (repos, inserted floppies, bytes, streak, watchlists), the time of your last visit (shown to your friends as “online” or “seen … ago”, unless you hide it in Settings) and your display language;
- the history of your auctions, bids, trades and settlements, kept to run the service, prevent fraud and publish price history (anonymously);
- if you joined RepoMasters through another player’s invite link, the link between your two accounts, so they can receive their reward; they see your username in their notification. This link is deleted when either account is deleted; a notification the referrer has already received stays in their history;
- Masters Pass: RepoMasters sends MastersMasters the days you insert a floppy, under your MastersMasters account ID, for the Masters Tour;
- your public profile (username, level, showcase) and, on the exchange, your duplicate files and the repos you’re looking for: only signed-in players can see them, according to your profile visibility setting; none of it is indexed by search engines.
- Purpose
- managing your player account and your drive.
- Legal basis
- performance of the service you request by creating an account.
- Retention
- for as long as your account exists; when it’s deleted, everything is erased except market and trade history, which is anonymized.
- Your rights
- access, rectification, erasure, portability and objection, available on request at contact@masters-masters.com. You can also file a complaint with the CNIL (cnil.fr).
The service is for people aged 15 and over.
No data is sold or shared for advertising purposes.
Deleting your account (right to erasure)
You can delete your account yourself, at any time, from Settings › Delete my RepoMasters account. You can also request it by email at contact@masters-masters.com.
To prevent deletion by mistake or by someone else, we ask you to type your username and to have logged in within the last 10 minutes (otherwise, log in again with MastersMasters).
- Deleted: your RepoMasters account (its link to your MastersMasters account, your username and display name in the game), your drive, your bytes, your progress, your profile and showcase, your friends, your watchlist and lists of wanted repos, your notifications and all your sessions. Your MastersMasters account is kept: you delete it on MastersMasters.
- Your ongoing auctions and trades are canceled: other players get their cards and bytes back. Finished auctions and trades stay in other players’ history, anonymized (“Deleted player”): nothing links them to you anymore.
- Your username stays reserved for 30 days, as a fingerprint that cannot be read back, so nobody can use it to impersonate you.
- The technical logs of the deletion only keep a hashed identifier, without your email or username.
Timing: deletion is immediate. If a trade or sale involving you is being settled, you need to wait for it to finish: usually a few seconds, up to 24 hours for a sale held for review. Our host’s technical backups (point-in-time restore) expire on their own within 30 days.
Security and abuse prevention
To protect your account and the service, without any device fingerprinting:
- each session records the IP address and browser used to log in, kept for the life of the session; attempt counters tied to your IP address limit repeated logins;
- RepoMasters doesn’t record any device fingerprint, nor any IP address for the market or trades.
- When you delete your account, the remaining market and trade records are anonymized. Legal basis: performance of the contract and legitimate interest.
- Moderation flags linked to your account are deleted along with it.
Cookies
The site only sets strictly necessary cookies: the session cookie after you sign in, its signed cached copy (5 minutes), a temporary state cookie during a MastersMasters sign-in (a few minutes), and the cookie that remembers your display language (400 days). The site uses no trackers or audience measurement, and loads no third-party players or content.
If you accept a player’s invitation (the “Accept the invitation” button), a cookie keeps that invitation until you create your account, then it is deleted (30 days at most). It is only set at your request, for the service you asked for; without that click, nothing is kept.
Data sources
Repository information (name, owner, description, stars, language, license, topics) is the public metadata of GitHub, credited wherever it appears.
RepoMasters never asks for access to your GitHub account: only public repository data is read.
Game rules
- Bytes, the in-game currency, can never be converted into real money.
- No card is ever sold for real money.
- The odds of every floppy are published and open to everyone.