Privacy policy

Last updated: October 29, 2026.

Tomojoo never asks for an account, an email address, a password or a phone number. This page explains in plain words what the site keeps to run your word chains, and for how long.

Who is responsible for your data?

Christelle Chocho, sole trader (entrepreneur individuel), publisher of Tomojoo. Address: 28 rue de la Paix, 77170 Servon, France. Email: contact@prozissimo.com.

The data we process

The chain: its secret code, the words played and when, the word length, the time allowed to play, the language, and how the chain ended.
First names: the first name (or nickname) of each player, of the person the word was passed to, and of the person who broke the chain. A nickname is enough; please don’t write a last name.
A browser fingerprint: your browser creates a random identifier; the server only keeps a salted fingerprint of it (HMAC). It is used for one thing only: stopping someone from playing twice in a row in a chain.
IP address: it is never stored in the database. A salted fingerprint is kept for a few minutes, in the server’s memory only, to limit abuse.
Daily totals: number of visits, page views, chains started, words played and shares, with no cookie and no identifier.

Nothing else: Tomojoo doesn’t read your contacts and doesn’t know your email or your phone number.

Who sees what?

A chain (its words and names) can only be seen by people who have its link. That link is the only key: send it only to the people you choose. Chain pages are never indexed by search engines.

The leaderboard is public, but it shows no names and no links: only the starting word, the last word, the number of words and players, and how long the chain lasted.

Why, and on what legal basis?

To run the game you’re using (start a chain, play, pass the word, show the result and the records). Legal basis: performance of the service you ask for (Article 6(1)(b) of the GDPR).
To protect the site against abuse and measure its traffic with anonymous statistics. Legal basis: our legitimate interest (Article 6(1)(f) of the GDPR).
To measure the audience with Google Analytics and, later, show Google AdSense ads. Legal basis: your consent (Article 6(1)(a) of the GDPR), which you can withdraw at any time.

What your browser keeps (no consent needed, because it’s essential)

The site uses your browser’s local storage (localStorage), not a cookie, to keep the random identifier, the name you chose, the list of chains opened on this device (“My chains”) and your practice records. This information stays in your browser and is never sent to third parties.

The Tomojoo app (Android and iPhone)

The Tomojoo app plays the same games as the website, on the same server: everything on this page applies to the app too. It still never asks for an account, an email address or a phone number.

On your phone: the app keeps a random identifier (just like the browser), the name you chose, the list of your games, your solo records and your settings (sounds, vibration, reminder time). This information stays on the phone and disappears when you uninstall the app.
Notifications: they are prepared by the app itself, on your phone (“Your turn”, “Only 2 hours left”, end of a game, rematch, solo reminder). To know whether it’s your turn, the app regularly checks your games on tomojoo.com. No outside notification service is used and no notification identifier is sent to the server. You can turn them off in the app’s settings or in your phone’s settings.
What the app doesn’t read: your contacts, your photos, your location or your microphone.
Advertising: the app is free thanks to Google AdMob ads. An ad may appear at the bottom of the “How to play” screen, on the end-of-game screen and on the screen after your move (“the word has been passed”); never during your 30-second turn or in solo play. Google may use your phone’s advertising ID and information about the device to show, measure and protect these ads; in the European Union, the United Kingdom and Switzerland, personalized ads depend on your choice in the Google-certified consent message, which you can review at any time in the app’s settings (“My ad choices”). You can also reset or delete this advertising ID in your phone’s settings. Google’s rules: https://policies.google.com/technologies/partner-sites
Deleting your data: uninstall the app to erase what it keeps on the phone; for the names kept on the server (deleted anyway 30 days after a game ends), write to contact@prozissimo.com with the link to the game and the name you used.

Cookies and Google services

By default, Tomojoo sets no cookies.

Audience measurement: if the publisher turns it on, Google Analytics 4 is only loaded if you accept it in the consent window.
Advertising: later on, the site may show Google AdSense ads on the rules, leaderboard and guide pages, only after your choice in the Google-certified consent message (CMP), and never on a chain screen.

How long do we keep your data?

The names in a chain: automatically deleted 30 days after the chain ends. A chain in progress ends at the latest 3 days after the last word played.
The words and numbers of the chain (without names): kept for the leaderboard.
The IP address fingerprint: a few minutes, in memory only.
Daily totals: 400 days.

Who receives your data?

We don’t sell your data and we don’t pass it on to any third party.

OVH SAS hosts the site and its database, on servers located in France.
Google provides, only if you accept it, Google Analytics audience measurement and, later, AdSense ads. Google then processes this data under its own rules, possibly outside the European Union with the safeguards required by the GDPR: see Google’s privacy policy. Apart from this case, no data leaves the European Union.
Authorities may receive data when the law requires us to share it.

Younger players

Tomojoo is for everyone, families and friends alike. If you are under 15 in France (or under the age of digital consent in your country, for example 13 in the United Kingdom and 16 in some EU countries), don’t accept audience measurement (or, later, advertising) without a parent’s permission: decline it in the consent window. A nickname is enough to play.

Your rights

You can ask to access, correct or delete your data, or object to its processing, by writing to contact@prozissimo.com. Since there’s no account, tell us the link to the chain concerned and the name you used.

If you think your rights are not being respected, you can file a complaint with the CNIL, the French data protection authority (www.cnil.fr).