Privacy Policy
Version dated 24 October 2026
Contents
- 1. Data controller
- 2. The essentials
- 3. The data we process
- 4. Purposes and legal bases
- 5. Who sees your data
- 6. Our service providers
- 7. Transfers outside the European Union
- 8. Retention periods
- 9. Security
- 10. Your rights
- 11. Deleting your account
- 12. Notifications, trackers and audience measurement
- 13. Minors
- 14. If you live outside the European Union
- 15. Changes
- 16. Contact
1. Data controller
The controller of your personal data is Kubilay YANAR EI (Bethkepha), entreprise individuelle (EI) (RCS Lyon 130 936 354 (SIRET 130 936 354 00013)), whose registered office is at 30 avenue Maréchal Foch, 69006 Lyon, France (“Constella”, “we”, “us”). For any question about your data or to exercise your rights: contact@constellatcg.com, or Profile › Settings › Help and support, topic “Account, login, personal data”. Constella has not appointed a data protection officer, as it is not required to: these contacts serve that purpose.
2. The essentials
- We only collect what is needed to run Constella, keep it secure and measure it for our own use.
- We do not sell your data or rent it out. The App’s only advertising is the short video you can choose to watch to win a spin of the bonus wheel, served by Google. Depending on your country and your choices, it may be personalised based on your phone’s advertising identifier: you can refuse this at any time, and your spin never depends on it (Article 12). We never send Google your name, your email address or your phone number. Apart from this, no advertising tracker and no third-party audience measurement tool: only an error-tracking tool (Sentry) receives technical reports (Article 12).
- We never see your card numbers or bank details: Stripe processes them.
- Your phone number and your country are never shown to your partner.
- Your friends only see your first name, photo or emoji, your look, your username, your tradeable duplicates and the cards you are missing — never your duos, email address, number, country or money.
- You can export all your data and delete your account from the App.
3. The data we process
| Category | Data |
|---|---|
| Account | email address, first name, password (stored hashed, never in plain text), profile emoji or photo, language, time zone, country and where that information came from, date and version of the accepted terms |
| Phone | verified mobile number, verification date; codes sent by SMS are only kept as a fingerprint; to fight SMS fraud, each code request leaves a trace that contains neither your number nor your account in plain text: the country of the number and non-reversible fingerprints of the number, of its first digits and of the IP address of the request |
| Duos and content | duos, invitation codes, bubbles (titles, descriptions, rewards, statuses, dates), shared notes, vouchers, price or reward counter-offers, duo settings |
| Game | XP, levels, achievements, streaks, star points, chests, boosters, cards, the duo’s sky, chosen look |
| Friends and trades | username (name chosen at sign-up and number); friends list (requests sent and received, acceptances, refusals, removals, with their dates), blocked accounts, dates of the friend requests you sent; card trades (cards offered and asked for, rarity, status, dates), duplicates set aside by a pending trade; your setting for the “Friends and trades” notification category |
| Friends leaderboard | your choice to appear in the leaderboard or not, and its date; the leaderboard is calculated each time it is viewed from your game data (level, constellations and skies lit up, different cards, completed albums), without being stored separately |
| Bonus wheel (video ads) | for each video requested, a ticket (random identifier, duo, creation and expiry times; the token sent to Google is only kept as a hash); for each video confirmed by Google: its transaction identifier, the ad unit, the time of the reward, the day and rank of the video, the prize drawn and its quantity, the time the wheel revealed it; your choice about personalised ads (yes or no, its date, the text shown), kept on your phone only |
| Subscriptions | plan (Constella PLUS or Constella MAX), store (App Store or Google Play) and environment (real or test purchase), product, status, dates (start, expiry, grace period, refund), auto-renewal, transaction identifiers or purchase token provided by the store, Google order number; the random identifier of your account passed to the store at purchase; the store’s notifications (identifier, type, date); the Constella MAX monthly gifts received. We never receive your bank details or your Apple or Google ID |
| Payments | Stripe customer and account identifiers, Wallet status, amounts, currencies, fees, payment statuses and receipts, ledger of transactions; never card numbers or bank details |
| Tax obligations | only if the platform reporting rules apply to you (Terms, Article 9.8): name, address, date of birth, tax identification number, details of the account that receives the sums, sums received and fees collected per quarter |
| Notifications | device notification token, preferences (sound, quiet hours, muted duos), notifications received |
| Support | your requests, your messages, the photo you may attach (re-encoded, without its metadata) and the team’s replies |
| Security | log of sensitive actions (sign-ins, posts, approvals…) with the IP address, sessions, failed sign-in attempts, two-factor authentication secret (encrypted) and backup codes (hashed); restrictions and suspensions placed on your account, with their reason |
| Audience measurement | for each day the App was opened: the date, the platform (iOS, Android) and the App version; your account’s origin (for example an invitation), chosen from a closed list |
| Technical data | App version, phone language, region and time zone, sent with each request; server technical logs |
| Error reports | in case of an error or crash, and for a small share of app launches and requests (performance measurement): the device model, the system and App versions, the technical trace of the error or the duration of the operation; never your name, your email address, your number or the content of your messages |
Stripe directly collects, on its own behalf, the data needed for payments and, if you activate your Wallet, for verifying your identity (ID document, date of birth, address, bank details).
If you watch a bonus wheel video, Google (Google Ireland Limited; Google LLC) directly collects, on its own behalf, the data needed to show the ad, measure its delivery and prevent fraud: IP address, technical information about the device and the App, interactions with the ad and, in the European Economic Area, the United Kingdom and Switzerland, your choices in its consent form. We do not send it your name, email address, phone number or account identifier: only a random single-use token, which it sends back to us to confirm that the video was watched. If personalised ads apply to you (Article 12), Google also uses your phone’s advertising identifier (IDFA on iPhone, advertising ID on Android) and the advertising profile it links to it.
4. Purposes and legal bases
| Why | Legal basis |
|---|---|
| Create and manage your account, duos, bubbles, the game and notifications | performance of the contract (the Terms) |
| Let you add friends by their username, manage your friends list and blocks, and trade cards between friends | performance of the contract (the Terms, Article 8) |
| Calculating and showing the friends leaderboard, if you choose to appear in it | performance of the contract (the Terms, Article 8) |
| Limit trades to prevent abuse (trades per week depending on the plan, pending offers, username lookups, age of the account and of the friendship, verified number, no back-and-forth) and keep a log of trades | legitimate interest (fairness of the game and fraud prevention) |
| Process payments between partners and the service fees | performance of the contract |
| Making, where applicable, the platform reports to the tax authorities (DAC7) | legal obligation (Articles 1649 ter A et seq. of the French General Tax Code) |
| Sell and manage your Constella PLUS or Constella MAX subscription: verify the purchase with the store, unlock the benefits, follow renewals, cancellations and refunds | performance of the contract (the Terms, Article 10) |
| Verify your phone number, prevent multiple accounts, fraud and abuse | legitimate interest (security of the Service and fairness of the game) |
| Secure accounts, keep a log of sensitive actions | legitimate interest; legal obligation to ensure security |
| Answer your support requests and reports | performance of the contract; legitimate interest |
| Handling reports, moderating content and enforcing the Terms (restrictions, suspensions) | legitimate interest (users’ safety); legal obligation (Regulation (EU) 2022/2065, the Digital Services Act) |
| Keep our accounting records, produce the yearly statement, respond to the authorities | legal obligation |
| Measure the App’s audience for our own use | legitimate interest (you can object, Article 12) |
| Detecting and fixing technical errors, measuring performance (error reports) | legitimate interest (proper functioning and security of the Service) |
| Offering you, at your request, rewarded video ads, checking with Google that they were watched, drawing and giving you the bonus wheel prize | performance of the contract (the spin you request); fraud prevention: legitimate interest; Google’s access to your device in the EEA, the United Kingdom and Switzerland: your consent, collected through Google’s form |
| Personalise these ads (advertising identifier, Google’s advertising profile) | European Economic Area, United Kingdom, Switzerland, Quebec, Turkey and wherever the law requires it: your prior consent, which you can withdraw at any time; United States and Canada outside Quebec: our legitimate interest in funding the Service through advertising, with your right to refuse at any time (Article 12) |
| Send you notifications | performance of the contract, with your permission given in the phone’s settings |
5. Who sees your data
- Your partner sees what you share in the duo: first name, emoji or photo, bubbles, notes, rewards, progress. Never your email address, phone number or country.
- Your friends see your first name, photo or emoji and your look, your username, your tradeable duplicates and the cards you are missing, as well as the trades made with them. The person you send a friend request to sees your first name, photo and username. No friend sees your duos, email address, phone number, country or money. The person you form a duo with automatically becomes your friend: they therefore also see your tradeable duplicates and the cards you are missing, including after the duo is dissolved, as long as you do not remove them from your friends.
- Your friends, if you appear in the friends leaderboard, also see your rank, your leaderboard points and the details of your measures (constellations and skies lit up, different cards, completed albums); your level remains visible to them. You can stop appearing in it at any time (Profile › Settings › Privacy): your points are then no longer calculated or shown.
- The Constella team (support and administration) accesses the data needed to handle a request; every access to a case file is logged.
- Our service providers (Article 6), each for its own task only.
- Stripe, which also acts as an independent controller for its own obligations (identity verification, anti-money laundering and fraud prevention).
- Google, only if you watch a bonus wheel video: it serves the ad — and, if it is personalised, uses the advertising identifier and its own advertising profile — as an independent controller, under its own rules (policies.google.com/privacy) and the controller-to-controller data protection terms it applies to its publishers. It receives from us only a random token.
- Apple or Google, for a subscription: the store that sells it to you processes the payment as an independent controller, under its own rules; we only pass it the random identifier of your account (never your name, username, email address or Constella account identifier), and we query it to verify the status of the purchase. Your partner only sees the logo of your plan next to your photo.
- The authorities (tax authorities, police, courts, supervisory authorities), where the law requires us to, in particular the French tax authorities for platform reports (Terms, Article 9.8).
6. Our service providers
| Provider | Role | Location |
|---|---|---|
| Stripe (Stripe Payments Europe, Limited; Stripe, Inc.) | payments, payment accounts, identity verification | Ireland, United States |
| Apple (Apple Distribution International Ltd.; Apple Inc.) and Google (Google Ireland Limited; Google LLC) | sale, billing and refunds of subscriptions through the App Store and Google Play; verification of purchases and notifications of their status | Ireland, United States |
| Twilio (Twilio Ireland Limited; Twilio Inc.) | sending verification codes by SMS (your number and the code) and, if we enable it, checking the number’s line type | Ireland, United States |
| Railway Corporation, San Francisco, CA, USA — railway.com | hosting of the server and database | Union européenne — Pays-Bas (Amsterdam, région « EU West » de Railway) |
| Brevo (Sendinblue SAS), 106 boulevard Haussmann, 75008 Paris, France | sending emails (codes, support replies, security alerts) | see opposite |
| Expo (650 Industries, Inc.) | routing push notifications (device token, notification title and text) | United States |
| Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) | delivering notifications to your phone | United States |
| Sentry (Functional Software, Inc.) | tracking of technical errors and performance (error reports, Article 3), without identifying data | European Union (Germany); company based in the United States |
| Cloudflare (Cloudflare, Inc.), where applicable | delivery of card images: no account data, only technical connection data, including the IP address | global network; company based in the United States |
Providers that process your data on our behalf (processors) are bound by a contract complying with Article 28 of the GDPR, which requires them to process it only on our instructions and to protect it. Stripe, Google for advertising, and Apple and Google for the sale of subscriptions act as independent controllers, for their own purposes (Article 5).
7. Transfers outside the European Union
Some providers, as well as Google for advertising, are established or process data outside the European Economic Area, notably in the United States. These transfers are based on the European Commission’s adequacy decision on the EU–US Data Privacy Framework where the recipient is certified under it, or otherwise on the European Commission’s standard contractual clauses, supplemented where necessary by additional measures. You can obtain a copy by writing to us. The location where our servers are hosted is given in Article 6. If you live outside the European Union, your data is processed in the countries listed in Article 6.
8. Retention periods
| Data | Period |
|---|---|
| Account, duos, bubbles, game | as long as your account exists; anonymised as soon as it is deleted (Article 11) |
| Username, friends list, blocks, trade history | as long as your account exists; when it is deleted, your friends, requests and blocks are erased, your pending trades cancelled, and completed trades stay linked to the anonymised account (Article 11) |
| Phone number | as long as it is linked to your account; after the account is deleted, only a (non-reversible) fingerprint is kept for 30 days to prevent an account from being recreated straight away with the same number |
| Anonymous trace of SMS code requests (country, fingerprints) | 30 days |
| Verification codes (email, SMS) | valid for a few minutes to a few hours, then erased no later than 30 days afterwards |
| Login sessions | at most 90 days, then erased no later than 30 days after they expire |
| Notifications | 90 days after being read; at most 180 days if never read |
| Log of sensitive actions (with IP address) | 365 days |
| Audience measurement | 25 months |
| Bonus wheel | tickets: deleted one day after they expire (they are valid for 30 minutes); videos confirmed by Google and prizes drawn: 90 days (the prize won stays in your game, like other items); Google keeps its own data under its own rules; your choice about personalised ads: on your phone, until you change it or delete the App |
| Support requests | A closed request disappears from the App 30 days after it was closed, and is then deleted automatically (messages and attached photo included); a request about a payment, a report or a bubble is kept 5 years after its last activity, as evidence in case of a dispute, then deleted; the same applies to a request left open. Copies: the support team receives an email alerting it to each new message, without its content; an excerpt of the team’s replies appears in your notifications (duration: “Notifications” row) and the full reply in the email you receive |
| Payments and ledger | 10 years, under accounting obligations; Stripe keeps its own data according to its legal obligations |
| Data for platform tax reports (where applicable) | the period required by law, 10 years at most |
| Subscriptions (transaction identifiers, plan, dates, store) | as long as your account exists; after its deletion, linked to the anonymised account for 10 years, under accounting obligations; store notifications: 90 days |
| Account restrictions and suspensions | as long as your account exists; deleted when it is deleted (a record of the action remains in the log of sensitive actions) |
| Error reports | 90 days at most at Sentry |
9. Security
Hashed passwords, encrypted connections (HTTPS), encrypted two-factor authentication secrets, session tokens stored in the phone’s secure storage, team access protected by mandatory two-factor authentication and logged: we apply measures suited to the risk. As no system is infallible, we will inform you and the competent authority of any data breach that poses a risk to you, as provided by law.
10. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection (in particular to audience measurement, and to processing based on our legitimate interest on grounds relating to your particular situation), the right to withdraw your consent at any time, without affecting what was done before, and the right to set instructions on what happens to your data after your death.
- In the App: change your first name, photo and email address in Profile › My account; export all your data as a JSON file from Profile › Settings › Security and data › Export my data; delete your account from Profile › My account › Delete my account; accept or refuse personalised ads in Profile › Settings › Privacy.
- For anything else: Profile › Settings › Help and support (topic “Account, login, personal data”) or contact@constellatcg.com. We reply within one month, which may be extended in the cases provided by law. We may ask you to confirm your identity.
Automatic measures. Some security measures are taken automatically: payment caps, refusal of a username, a longer or shorter hold on a payment depending on its authentication and the accounts’ history, suspension of receiving money while your Stripe balance is negative (lifted automatically once it is back to zero or positive). They are necessary for performing the contract and preventing fraud (Article 22 of the GDPR): you can at any time have a member of our team review them, express your point of view and challenge them, by writing to support.
You can lodge a complaint with the French data protection authority (CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr) or with the data protection authority of your country.
11. Deleting your account
How: in the App, Profile › My account › Delete my account, then confirm with your password. Deletion is possible as soon as no bubble is in progress in your duos (complete or cancel them first). Without the App, you can also request it on the Delete my account page: enter your account’s email address, then confirm using the link, valid for one hour, that we send there (and your two-factor authentication code if it is on). The deletion is then the same as from the App. If you can no longer access the App, write to contact@constellatcg.com from your account’s email address.
What is deleted immediately: your email address, first name, photo, phone number, country, sessions, notification tokens, notifications, verification codes, two-factor authentication secret, the history of the notes you wrote, and your bonus video tickets and history. Your duos are dissolved. Your username is retired: it is given to no one else for 90 days (only the part of the username before “#”, in lower case and without accents, and the number are kept during that time, with no link to your account); your friends list, friend requests and blocks are erased, and your pending card trades are cancelled (duplicates set aside go back to their owners).
What is kept, linked to an anonymised account that no longer directly identifies you: payments and the ledger (accounting obligations), bubbles and content shared with a partner, support requests and the security log, for the periods in Article 8. Your number’s fingerprint is kept for 30 days. Your subscription data is kept in the same way, and the random identifier passed to the stores is replaced: it no longer designates anyone. Deletion does not cancel an ongoing subscription: only the store (App Store or Google Play) can. The history of card trades completed with your friends also stays linked to the anonymised account: your former friends see “Deleted account” there.
Good to know. The messages and photo of a support request that is kept may still contain information about you: they are only kept for the periods in Article 8, then deleted, and you can ask for them to be deleted earlier once they are no longer needed as evidence. Your Stripe payment account, if you have one, is not closed by the deletion: Stripe, as an independent controller, keeps your data under its own legal obligations, and you can ask it to close the account, directly or through support. Any balance left in it is transferred to you free of charge (Terms, Article 16).
12. Notifications, trackers and audience measurement
- Notifications: they are only sent with your permission, given in the phone’s settings. You manage them in Profile › Settings › Notifications or in the phone’s settings.
- Trackers: apart from the bonus wheel videos below, the App sets no advertising cookies and uses no advertising identifier or cross-app tracking. These web pages use no cookies.
- Bonus wheel videos (advertising): this is Constella’s only advertising, and it only appears if you tap Watch an ad, in Wallet › Bonus wheel or in the “A spin of the wheel?” window that the App may show you after you open a chest or a booster; no feature of the App depends on it. Google stores and reads information on your device to show the ad, limit how often it is repeated, measure it and prevent fraud: in the European Economic Area, the United Kingdom and Switzerland, it first asks you through its consent form, the first time you tap, where accepting and refusing work the same way. Learn more: policies.google.com/technologies/partner-sites.
- Personalised ads: the ad may be chosen based on your interests, using your phone’s advertising identifier (IDFA on iPhone, advertising ID on Android) and the profile Google links to it. In the European Economic Area, the United Kingdom, Switzerland, Quebec, Turkey, the other countries whose law requires it, and whenever we do not know your country, nothing is personalised without your prior consent, requested the first time you tap by Google’s form or by the App (two buttons of equal weight, “Accept” and “Decline”). In the United States and in Canada outside Quebec, ads are personalised by default: the App tells you so the first time you tap, and you can refuse at any time. We determine your country from your account’s country and the region set on your phone; when in doubt, the most protective rule applies. On iPhone, the advertising identifier is only used if you also allow it in Apple’s tracking request, shown the first time you tap and only if you have not refused personalisation; on Android, if you delete your advertising ID in the phone’s settings, ads are no longer personalised. Your spin never depends on your choice: refusing gives non-personalised ads, the same videos, the same spins and the same odds.
- Refusing or withdrawing your consent, at any time: Profile › Settings › Privacy › Personalised ads; where Google offers it (European Economic Area, United Kingdom, Switzerland, some US states), the Ad choices link on the Bonus wheel card, or the button of the same name in Profile › Settings › Privacy, reopens its form; on iPhone, Settings › Privacy & Security › Tracking; on Android, the Ads section of the phone’s settings. Withdrawal applies to subsequent ads. Your choice in the App is kept on your phone, with its date, not on our servers.
- Audience measurement: it is carried out by us alone, on our servers, for our own use, with the minimal data described in Article 3 (no time of day, no IP address, no device identifier). You can object at any time by asking support: we then stop recording any presence data for your account.
- Error reports: the Sentry kit built into the App reads on your phone the technical information needed to diagnose an error or a crash (model, system and App versions) and sends it to Sentry with the error trace. It is not used for advertising or to track you from one app to another; it is necessary for the proper functioning and security of the Service.
13. Minors
Constella is reserved for adults (at least 18, or the age of majority in your country if it is higher). We do not knowingly collect data from minors and therefore never collect a minor’s consent (in France, a minor can only consent alone to the processing of their data from the age of 15); if we learn that an account belongs to a minor, we delete it.
14. If you live outside the European Union
The rights in Article 10 are available to you wherever you live. In addition:
- United Kingdom and Switzerland: you have the rights provided by the UK GDPR and the Swiss Federal Act on Data Protection; you can lodge a complaint with the Information Commissioner’s Office (ICO) or the Federal Data Protection and Information Commissioner (FDPIC).
- United States (in particular California): in the past twelve months, we collected the categories of data in Article 3 (identifiers, account and payment information, activity in the App), for the purposes in Article 4. We do not sell your personal information. When personalised ads are on, your phone’s advertising identifier and your interactions with the ad are made available to Google for targeted advertising, which some state laws call “sharing” or “targeted advertising”: you can opt out at any time in Profile › Settings › Privacy › Personalised ads, or through the “Do not sell or share my personal information” link in Google’s form (Ad choices), where it is offered. We do not use sensitive data to profile you. You can ask to know what data we hold, to have it corrected or deleted, without being discriminated against for doing so; an authorised agent may act for you. Write to contact@constellatcg.com.
- Brazil: under the LGPD, you can obtain confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about the entities your data is shared with, and withdraw your consent where processing depends on it. Contact for our data protection officer (encarregado): contact@constellatcg.com. You can lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).
- Canada: you can access your personal information and have it corrected, and contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information. In Quebec, ads are only personalised with your express consent; elsewhere in Canada, you are told about it the first time you tap and can refuse at any time (Article 12).
- Turkey, the Middle East, North Africa and other countries: ads are only personalised with your explicit consent, requested by the App, which you can withdraw at any time (Article 12). In Turkey, you have the rights provided by Law No. 6698 on the Protection of Personal Data (KVKK) and can lodge a complaint with the Personal Data Protection Authority.
15. Changes
We may change this policy. The date of the update is shown at the top of the page; a significant change is announced in the App.
16. Contact
Kubilay YANAR EI (Bethkepha), 30 avenue Maréchal Foch, 69006 Lyon, France — contact@constellatcg.com. Help and support: contact@constellatcg.com, or Profile › Settings › Help and support.