Privacy Policy
Last update: February 07, 2026
This policy details the data flows specific to our Next.js and Firebase architecture, in compliance with GDPR.
1. Data Controller
Personal data collected on the 2ROUE site is processed by the editor, whose details appear in the Legal Notice.
2. Collected Data and Purposes
In accordance with the GDPR minimization principle, we only collect data necessary for specific purposes:
- For account creation and management: Email address and username. This processing is necessary for the execution of the contract (our ToU) that you accept when registering.
- For gamification functionality: Your score (XP), badges, and Team membership. These data are processed for execution of the contract and interactive service provision.
- For site security and maintenance: IP address, technical logs, and session identifier (`__session` cookie). This processing relies on our legitimate interest in ensuring service integrity and availability. We consider this processing necessary for the security of our service and fraud prevention.
- For personalize advertising: Navigation data and interaction with ads, via cookies like `__gads`. This processing is based on your express consent, which you can manage via our cookie banner.
3. Data Recipients
Your data may be transmitted to our technical subcontractors for the needs of the above services:
We require all our subcontractors to guarantee an adequate level of data protection, in accordance with GDPR.
- Google Firebase (hosting, authentication, Firestore database).
- Vercel Inc. (Next.js frontend platform hosting).
- Google AdSense (advertising network).
We require all our subcontractors to guarantee an adequate level of data protection, in accordance with GDPR.
4. Non-EU Data Transfers
Some of our subcontractors, notably Google, may transfer data to countries outside the European Economic Area (EEA), specifically the USA. These transfers are framed by the European Commission's Standard Contractual Clauses (SCC), guaranteeing a sufficient level of protection. You can consult Google's data protection commitments on their site.
5. Retention Period
- Account and game data: Kept for the life of your account. In case of prolonged inactivity (over 24 months), the account and associated data may be deleted.
- Technical data (logs): Kept for a maximum of 12 months.
- Advertising cookies: The retention period is specified in our Cookie Policy.
6. Your Rights
In accordance with GDPR, you have the following rights over your data: right of access, rectification, erasure, restriction, portability, and objection. This processing is also carried out in compliance with Moroccan Law 09-08 on the protection of personal data. To exercise them, contact us at: admin@2roue.com.
If you believe, after contacting us, that your rights are not respected, you can lodge a complaint with the competent authority in your country of residence.
If you believe, after contacting us, that your rights are not respected, you can lodge a complaint with the competent authority in your country of residence.
7. Specific Clause - Google AdSense Advertising
Our site uses Google AdSense. In accordance with Google's requirements, we inform you that:
- Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to your website or other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to your users based on their visit to your sites and/or other sites on the Internet.
- Users may opt out of personalized advertising by visiting Google Ad Settings. (Alternatively, you can direct users to opt out of a third-party vendor's use of cookies for personalized advertising by visiting www.aboutads.info.)