1. Who We Are
Data Controller: SELECTED FANS INC.
Address: 8 The Green, Ste R, Dover, DE 19901, USA
Contact: welcome@choopy.co
EU GDPR Art. 27 Representative: Vincent Jouanne (France)
DPO: Not appointed
2. Data We Process
2.1 Account Data
- Email address
- Username
- Hashed password
- Referral code/status
- Email verification status
- OAuth identifiers (if using Google sign-in)
- Account creation IP address
2.2 Session & Security Data
- IP address
- User-agent (browser and OS)
- Session cookies (HttpOnly, SameSite)
- CSRF tokens
- OAuth tokens
- Rate-limit signals
- Security logs
2.3 Game & Choopy Data
- Choopy IDs, traits, color, level
- XP/HP points
- Actions history (feed, love, daily log-ins, PvP)
- Rankings
- Estimated value
2.4 AI "Thoughts" Data
- Minimal context (username, stats)
- Prompts and outputs
2.5 Transaction Data (When Available)
- Stripe identifiers and transaction statuses
- Purchase history (store/marketplace)
- KYC data (from €100 when requested)
2.6 Communications
- Transactional emails (verification, notifications)
3. Purposes & Legal Bases
| Purpose |
Legal Basis |
| Provide the Service (accounts, gameplay, dashboards) |
Contract performance |
| Security & anti-fraud (rate-limits, anomaly detection, multi-account checks, value/XP manipulation detection) |
Legitimate interests / Legal obligation |
| AI "Thoughts" generation |
Contract performance / Consent |
| Billing & compliance |
Contract performance / Legal obligation |
| Marketing (newsletters/updates) |
Consent (opt-in) |
| Analytics (Google Analytics) |
Consent |
4. Cookies & Trackers
4.1 Strictly Necessary (No Consent Required)
- Session cookie (choopy_sid): Maintains your login (up to 30 days)
- Cloudflare Turnstile: Bot protection
- Consent preference cookie: Remembers your cookie choices
4.2 Analytics (Consent Required)
- Google Analytics: Traffic analysis and user behavior (13 months) - OFF by default in EU/EEA until consent
4.3 Advertising Cookies
We currently do not use advertising or targeting cookies.
4.4 Managing Your Preferences
You can modify your cookie preferences at any time through your browser settings or by contacting us.
5. Recipients & International Transfers
5.1 Service Providers
- Hosting: OVHcloud (France/EU) for data residency
- Payments: Stripe (USA) for payment processing - we do not store card numbers
- Banking: Mercury (USA) as SELECTED FANS INC.'s depository bank
- Email: SendGrid (USA) for transactional emails
- Anti-bot: Cloudflare Turnstile
- AI: Third-party AI provider (e.g., Anthropic/Claude)
5.2 International Transfers
ℹ️ Important: Some of our service providers are located in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission and implement supplementary measures to protect your data during these transfers.
5.3 Legal Authorities
We may disclose data if required by law (court order, fraud investigation, etc.).
6. Retention Periods
| Data Type |
Retention Period |
| Account data |
While active, then up to 3 years of inactivity (legal archiving) |
| Active sessions |
Up to 30 days |
| Security logs |
6 months (longer if incident occurs) |
| Email verification tokens |
24 hours |
| Gameplay data (XP, HP, actions) |
Account lifetime (anonymization after deletion) |
| Analytics cookies |
Up to 13 months |
| Consent cookies |
6 to 13 months |
7. Anti-Fraud, Multi-Accounts & PvP Integrity
To ensure fair play and security, we implement detection measures:
7.1 Detection Methods
- Correlation of IP addresses, user-agents, and minimal device signals (strictly necessary for security)
- Analysis of suspicious behavior patterns
- Verification of payment instruments and external IDs
7.2 Possible Measures
In case of suspected fraud or abuse, we may:
- Temporarily freeze accounts, Choopies or virtual assets during investigation
- Cancel fraudulently obtained XP, gains or rankings
- Invalidate suspicious marketplace transactions
- Require identity verification (KYC) from €100
7.3 Legal Basis
These processing activities are based on our legitimate interests in securing the Service, protecting other users, and maintaining a fair gaming environment.
8. Your Rights
8.1 EU/EEA Users (GDPR)
- Right to access: Obtain a copy of your data
- Right to rectification: Correct inaccurate or incomplete data
- Right to erasure: Delete your data (under certain conditions)
- Right to restriction: Limit processing in certain situations
- Right to object: Object to processing based on legitimate interests
- Right to data portability: Receive your data in a structured format
- Right to withdraw consent: At any time, for consent-based processing
- Right to lodge a complaint: With your local data protection authority
8.2 US Residents (State Privacy Laws)
- Right to access: Know what data we collect
- Right to deletion: Request deletion of your data
- Right to correction: Correct inaccurate data
- Right to opt-out: Opt out of data "sales" or targeted advertising
We do not sell your personal information as defined by CCPA/CPRA.
8.3 Exercising Your Rights
Contact us at: welcome@choopy.co
We will respond within one month (extendable by two months if necessary).
9. Children's Privacy
Our Service is not intended for persons under 15 years old in France (or under 13 in the United States).
If we discover that an account was created by an underage person without proper authorization, we will immediately delete that account and associated data.
If you are a parent and believe your child has provided us with data without your consent, contact us immediately.
10. Security Measures
We implement appropriate technical and organizational measures to protect your data:
- Password encryption (bcrypt hashing)
- Secure cookies (HttpOnly, SameSite)
- CSRF protection
- Content Security Policy (CSP)
- Rate-limiting
- Security event logging
- Regular session ID regeneration
- Origin control (CORS)
- Secure hosting infrastructure
⚠️ Note: No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
11. Changes to This Policy
We may update this Privacy Policy at any time. For material changes, we will provide notice:
- Via email to your registered address
- Through a visible notification on the Site
We encourage you to review this page regularly to stay informed about our practices.
12. Contact
For any questions about this Privacy Policy or to exercise your rights:
Email: welcome@choopy.co
Data Controller: SELECTED FANS INC.
8 The Green, Ste R, Dover, DE 19901, USA
EU Representative: Vincent Jouanne (France)