Privacy Policy
Version 1.5 — effective 13 September 2026
English translation of our privacy policy. It describes the same processing as the French original.
Who is responsible for your data
Karim Shaker and Dan Sfedj, the two individuals who operate 10 à l'ancienne, are joint controllers of your personal data. The European General Data Protection Regulation requires us to tell you who decides how your data is used: that is why their names appear here.
For any question, or to exercise your rights: legal@10alancienne.com
What we collect
What you give us
- Your account: email address, username, password (encrypted, we never see it). If you sign in with Google, we receive your email address and your name.
- Your age declaration: you declare that you are sixteen or older, and we keep the date of that declaration. We do not ask for your date of birth and we do not store it. This declaration is never shown on your profile.
- Your profile: display name, bio, favourite club, town and department if you fill them in, profile picture.
- Your collection: shirts, photos, seasons, sizes, stories, condition, provenance, and the purchase price if you enter one — that last one stays private, it is never shown to anyone.
- What you post: posts, comments, line-ups, authenticity votes.
- Your messages and the photos you send in them.
- Your listings on the Market and the offers you make or receive.
What is generated as you use the Service
- Your likes, wishlist, follows, badges earned.
- The reports you submit.
- Your acceptance of the Terms: the version accepted, the date, the language you read it in, your IP address and the browser used. Those last two serve only to establish proof of the agreement: they are neither cross-referenced, nor used to track you, nor kept anywhere else.
- Minimal technical data needed to run and secure the Service, and your device identifier if you turn on push notifications.
What we do not do
We use no advertising cookies, no trackers and no third-party analytics tools. We sell no data, we share none for advertising purposes, and we build no advertising profile.
Why, and on what legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Create and manage your account, display your collection, enable exchanges | Running the application | Performance of the contract |
| Show your public content to other members | It is the very purpose of the Service | Performance of the contract |
| Check your age | Legal obligation | Legal obligation |
| Keep a record of your acceptance of the Terms | Proving the agreement | Legitimate interest |
| Handle reports, moderate, fight counterfeiting and fraud | Security of the Service and regulatory obligations | Legal obligation and legitimate interest |
| Send you push notifications | Keeping you informed | Your consent |
| Keep session, language and theme cookies | Running the site | Performance of the contract |
For how long
- Your account and its content: for as long as your account exists.
- After a deletion request: erased within one month at the latest, excluding backups still in rotation.
- Reports and moderation decisions: 1 year after they are handled, so that we can account for our diligence and deal with a repeat offence.
- Records of acceptance of the Terms: for as long as your account exists. They are deleted with it: your right to erasure prevails over our interest in keeping proof of the agreement.
- Messages you have sent: they remain visible to their recipient after your account is deleted, with no link to your identity.
Who has access
Your data is hosted by Supabase, Inc., on servers located in the European Union, and the application is served by Vercel Inc.
Other members see what you have chosen to make public. Your purchase price, your wishlist, your age declaration, your private messages and your email address are never public.
We may disclose data to a judicial or administrative authority where the law requires us to.
Transfers outside the European Union
Your data is stored on servers located in the European Union. Our hosting providers are however companies established in the United States, whose technical teams may access the data for support and maintenance purposes.
Those accesses are framed by the safeguards provided for by the GDPR: standard contractual clauses and, where applicable, the EU–US Data Privacy Framework. The same applies to the technical service that delivers push notifications if you turn them on.
You can ask us for the details of those safeguards at legal@10alancienne.com.
Your rights
You have the right to access, rectify, erase, restrict and object to the processing of your data, and the right to data portability.
In practice:
- Rectify: from your settings.
- Erase, get your data back, and everything else: write to us at legal@10alancienne.com, or use the button provided in your settings. We reply within one month at the latest, and the export is provided in a structured, machine-readable format.
If our answer does not satisfy you, you may refer the matter to the French data protection authority: Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris — cnil.fr.
Cookies
We use only cookies that are strictly necessary to run the Service: your session, your language preference, the display of the home screen, and picking your browsing back up where you left it — this last one records the last page you visited, solely in order to return you to it. Your theme choice is kept in your browser's local storage, not in a cookie.
None of these requires your consent and none is used for tracking. There is no advertising cookie and no third-party tracker, which is why you see no banner.
Security
Access to your data is protected at the database level itself by security rules (row level security): each query can only read what those rules allow, however it arrives. These rules are covered by automated tests on every change to the database, and the application has undergone a security audit.
Passwords are encrypted and we cannot read them. Exchanges with the application are encrypted in transit.
In the event of a data breach likely to result in a risk to your rights, we notify the CNIL within 72 hours and, if the risk is high, we notify you directly.