Privacy Policy

The publisher of What Plays Next ?, identified below, is the controller for the processing described on this page. Use the contact address shown to ask about your data or exercise your rights.

Controller

Maxence Lepeuve

Privacy contact

contact@whatplaysnext.com

The website offers Instant Gaming affiliate links. No partner content is embedded in game pages. The website does not use audience analytics.

Functional settings and abuse prevention rely on the legitimate interest in providing requested preferences and securing the service. Loading YouTube/Twitch players relies on your consent. Form feedback is processed to handle requests and improve the service, based on the publisher’s legitimate interest.

• Website preferences

  The user_lang, user_timezone and user_timezone_auto cookies expire after 12 months. Their local storage copies have no automatic expiry and remain until replaced, removed or cleared with website data. jv-preferred-platforms saves favourite platforms, wpx_stream_event_<id> the selected stream for each event, wpx_stream_accessibility the accessibility preference, and wpn_pwa_dismissed dismissal of the installation prompt. These preferences remain locally without automatic expiry. wpn_media_consent retains YouTube/Twitch permissions for up to 183 days. These values apply your choices.

• Server logs

  Technical logs available to the publisher may include timestamps, request methods and paths, HTTP status codes and server diagnostic messages. Vercel may also process IP addresses, user agents and technical information to operate and secure hosting. Its documentation specifies 1 hour of Runtime Logs retention on Hobby; this does not cover all platform logs, metadata or backups. The purpose is maintenance and security, based on the publisher’s legitimate interest.

• Abuse prevention

  The limiter computes an HMAC identifier from the received IP address. This identifier is pseudonymised, not anonymous, and may remain personal data. In shared mode, Supabase stores the route-prefixed identifier, counter, and creation, modification and expiry timestamps, without a raw IP in that table. Local mode uses server memory. Windows last 1 minute, or 15 minutes for the form. After expiry, physical deletion occurs on subsequent calls, in batches of one thousand in shared mode; without traffic, data may remain until the next cleanup. This processing prevents abuse based on the legitimate interest in securing the service.

• Feedback form and email messages

  The category and message are required; the interface language is added automatically and an email address is optional. Without an email address, the publisher cannot reply by email. An antispam field is checked before sending and is not included in the email. These details pass through Vercel and are emailed to the publisher’s OVHcloud mailbox, without storing the message in the WPN database. The supplied email is used as the reply address. The publisher confirms deleting these messages from the mailbox no later than 12 months after the last exchange, except for legal obligations or disputes; the application does not automate deletion. Any provider backups follow its own terms.

Three functional cookies save the language, time zone and automatic detection mode for 12 months. They contain no account or advertising identifier. Local copies of these preferences and the other choices described above have no automatic expiry, except YouTube/Twitch permissions, which are limited to 183 days.

Functional cookies only apply your choices. YouTube and Twitch players remain blocked until you explicitly activate them in the media area. Permission can be withdrawn at any time in Settings.

When your browser contacts a third-party provider, it may receive your IP address, technical headers and, depending on your session with that provider, other information. Its own terms apply.

• Vercel Hobby: hosting and SSR execution may process requests and technical data in the United States. Vercel’s public DPA covers Pro and Enterprise plans and is not represented here as applying to Hobby.
• Supabase hosts the catalogue and, when the shared limiter is used, its pseudonymised counters. The project region confirmed by the publisher is West EU (Ireland). The database region does not guarantee that support, metadata and all provider processing stay in the European Union.
• YouTube and Twitch: no embedded player loads before permission, granted in the video area or Settings and saved for later visits. Any video previews are requested through the WPN server. Once activated, the provider receives technical data and may use its own trackers. YouTube uses youtube-nocookie.com, which does not guarantee an absence of all trackers after activation. Each permission expires after at most 183 days; expired records are cleaned during a later check. Withdrawal in Settings removes permission and active players, without erasing data already received by the provider.
• Instant Gaming: game pages only provide a text affiliate link to the partner’s homepage, with the WPN tag maxoulezouzou shared by all visitors. This link loads no Instant Gaming script, frame, image or font before you click. It does not set an Instant Gaming cookie on WPN. Clicking opens the partner’s website in a new tab, where its privacy policy applies; it may then receive your IP address and technical data and use its own cookies. WPN may earn a commission after a purchase through this link.
• Google Calendar, Microsoft Outlook and Yahoo Calendar: these services are contacted only when you choose an add or subscription action. Event details are then included in the transmitted URL.
• IGDB/Twitch: catalogue API requests are made by the WPN server. Cover art and screenshots displayed from images.igdb.com are instead loaded directly by your browser, which sends its IP address and technical headers. Loading catalogue images is separate from YouTube/Twitch players, which require your permission.
• OVHcloud Zimbra: messages received at contact@whatplaysnext.com are stored in OVHcloud datacentres in France, according to the hosting location published for this service. Transmission to the mailbox uses encrypted SMTP. This location concerns email storage: the form also passes through Vercel, so the processing chain is not exclusively located in France.

Provider policies and documents

• Vercel (privacy)
• Supabase (privacy)
• OVHcloud (privacy)
• OVHcloud (Zimbra)
• YouTube / Google (privacy)
• Twitch (privacy)
• Instant Gaming (privacy)
• Vercel (data processing)
• Supabase (data processing)
• OVHcloud (contracts)
• Vercel (Runtime Logs)
• Supabase (regions and transfers)

Data is accessible to the publisher and the relevant providers: Vercel for hosting, Supabase for the catalogue and shared counters, and OVHcloud for messages. Activated players transmit data to Google/YouTube or Twitch. Instant Gaming is contacted when you open its link. Some processing, including by Vercel, Google/YouTube, Twitch, Instant Gaming after clicking its link, and providers’ subprocessors, may occur outside the European Economic Area. WPN does not sell your personal data.

Vercel states that it participates in the Data Privacy Framework for transfers covered by its certification; its public DPA does not cover Hobby. Supabase’s published DPA provides for standard contractual clauses where its conditions apply. OVHcloud publishes a data processing appendix and a subprocessor list. These documents are linked below: publication alone does not establish their applicability to every WPN service or an absence of transfers. You can ask the publisher for available information about applicable safeguards.

You may request access, rectification, erasure, restriction or objection, and portability where its conditions are met. You may withdraw player consent at any time without retroactive effect. Send requests to the contact shown above. A response is required within one month; this may be extended by two months for complex or numerous requests, with notice during the first month. Proportionate identity checks may be requested where there is reasonable doubt. You may also complain to the French data protection authority, the CNIL.

This page will be updated if the website changes. The French version is authoritative. Other languages are translations.