Skip to content
Koorami

Privacy policy

Last updated: 30 August 2026.

The French version prevails in case of any discrepancy. Lire la version française.

This page describes the personal data actually processed by Koorami, why, for how long, and your rights. It describes only what exists on the platform.

Data controller

Rémi Schmit, sole trader operating under the trade name WebProMax, 73-75 rue de la Plaine, 75020 Paris, France. Contact: contact@webpromax.fr.

Data collected and purposes

  • Player account: username, email address (optional), password (stored only in hashed form, never in clear text). Purpose: creating and managing your account, logging you in, showing your username in the leaderboards of your groups. Legal basis: performance of the service you request.
  • Avatar: by default, your initials — no additional data. If you choose an emblem, a flag or a team crest, we record only your choice from a list that we provide; these images are hosted by us, your browser calls no external site to display them. If you upload a photo, it is cropped and then re-saved by our servers: the metadata of the original file — including the location where it was taken — is not kept. The photo is stored outside the web root under a random name, and it is visible to the members of your groups. You can remove it at any time from “My account” by choosing another avatar: the file is then erased from our servers. Legal basis: performance of the service, based on your choice — an avatar is never mandatory.
  • Proof of consent: version of the text accepted, date and IP address at the time you accept the terms of use and, if you ticked it, the news emails option. Legal basis: obligation to be able to prove consent.
  • Game: your predictions, your groups and your points. Purpose: the operation of the game itself. Your predictions are visible to the other members of a group only once the match is locked.
  • Technical anti-abuse data: temporary counters linked to the IP address or to the email during logins and sign-ups, to block repeated attempts. Legal basis: legitimate interest (security of the service).
  • Temporary tokens: email verification links (48 h) and password reset links, stored hashed and single-use.
  • Usage statistics: the service records operating events (sign-up, creation of a group, opening of an invitation link, prediction entered, sharing of a leaderboard) with the date, your account identifier and the internal identifier of the group or match concerned. No IP address, no browsing content, no advertising identifier. Purpose: understanding how the service is used and improving it. Legal basis: legitimate interest.

Cookies

Koorami sets a single cookie, the session cookie, strictly necessary to keep you logged in. It is exempt from consent and disappears when you log out. The site uses no advertising cookie, no third-party tracker and no audience measurement tool from Google or from any other external provider. The usage statistics described above are produced by our own servers, from the actions you take in the service, with no additional cookie and no tracking of your browsing elsewhere. The audience measurement of public pages is described below. This is why there is no cookie banner.

Audience measurement on public pages

The public pages of the site (home, Koorami Pro offers, guides, sign-up, legal pages) use WebProMax's in-house audience measurement tool, hosted in France at stats.webpromax.fr. It sets no cookie, displays no advertising and uses no Google service. It counts page views, reading time, clicks on action buttons and on contact links, and successful form submissions or account creations. What you type into a form is never sent to this tool. The pages reserved for logged-in players (groups, predictions, leaderboards, account) do not load it.

Your IP address is not kept: the tool derives from it a site-specific fingerprint, valid for a single day, which is used to estimate the number of visitors. A session identifier is kept in your browser's session storage, erased when the tab is closed and after 24 hours at the latest. Legal basis: legitimate interest in knowing how much the site is visited. The statistics are kept for 730 days. The “Do Not Track” signal and Global Privacy Control are respected.

You can also refuse measurement on this device:

Recipients and processors

  • Hosting: Hostinger International Ltd (servers of the site).
  • Sending emails: Mailjet (French company, data hosted in the European Union), solely for service emails: address verification, password reset and, if you have consented, news.

No data is sold or passed to third parties for advertising purposes.

Company and venue instances

A company may have a Koorami space in its colours for its employees, and a venue (restaurant, café, shisha lounge, gym…) an equivalent space for its customers, under a paid subscription described in the general terms of sale of the venue pack. In both cases, the designated administrator sees the usernames and leaderboards of the groups of their space, like any member of a group — they do not receive your password or your account data. For a venue, we also keep: the name, city and colour of the place, the email address of its administrator, and the messages they write for their screen (announcements, opening hours) — free text, never content that we generate for them. No payment data is processed by the app: billing of the subscription goes through WebProMax's management tools, outside Koorami.

Retention periods

  • Account, predictions and consents: as long as the account exists.
  • Verification and reset tokens: a few hours to 48 h, then unusable.
  • Anti-abuse counters: a few hours, deleted after 7 days at the latest.
  • Usage statistics: 13 months, then the events are anonymised — the link with your account is erased and only counters without any identity remain.

Your rights

You may request access, rectification, portability or deletion of your data, as well as the withdrawal of a consent, by writing to contact@webpromax.fr. Deleting the account also deletes the associated predictions and consents — the detailed procedure is on our Account deletion page. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).