Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

2. Hosting and Infrastructure

Our web application and its associated databases are hosted on servers of an external cloud hosting provider located within the European Union (Germany).

When accessing our website, the system automatically collects connection data transmitted by your device (server log files). The following data is processed:

• IP address of the user
• Date and time of access
• Requested URL / path
• HTTP status code and volume of transmitted data
• Browser type, browser version, and operating system (User-Agent)
• Previously visited website (referrer URL, if transmitted by the browser)

Purpose and Legal Basis

Server logs are processed to ensure the technical operation, stability, and security of the platform, as well as to detect and defend against attacks (such as DDoS incidents) and software defects.

Legal basis: Our legitimate interest in providing a reliable, performant, and secure web application pursuant to Art. 6(1)(f) GDPR. A Data Processing Agreement (DPA) pursuant to Art. 28 GDPR has been concluded with the hosting provider.

Retention Period

Server log files are erased as soon as they are no longer necessary for the purpose for which they were collected—typically within 7 to 14 days, unless retention is required for evidentiary purposes in connection with security incidents.

3. Content Delivery Network and Reverse Proxy (Cloudflare)

To enhance performance, ensure load distribution, and mitigate cyberattacks, we use services provided by Cloudflare Inc. (101 Townsend St, San Francisco, CA 94107, USA).

Network traffic between your browser and our origin servers is routed through Cloudflare’s global edge network. In this process, connection data (including IP addresses, HTTP headers, and security fingerprints) is processed to block malicious traffic and cache static assets.

Legal Basis and International Transfers

Legal basis: Our legitimate interest in delivering a fast, resilient, and secure application pursuant to Art. 6(1)(f) GDPR.

Data transfers to the United States are governed by Standard Contractual Clauses (SCCs) issued by the European Commission and Cloudflare’s certification under the EU-US Data Privacy Framework (DPF). We have entered into a Data Processing Addendum with Cloudflare.

4. Media and File Storage (Cloudflare R2)

If users upload custom media (such as player avatars), these files are stored on an object storage service (Cloudflare R2 provided by Cloudflare Inc.).

This processing occurs strictly for the purpose of displaying profile elements within the game. Legal basis: Performance of our service relationship pursuant to Art. 6(1)(b) GDPR.

5. Game Operation, Gameplay Logs, and Multiplayer

Scope of Processing

During use of the web application (interactive tutorials, single-player, and multiplayer modes), technical gameplay and session data are stored in a database:

• Anonymous or pseudonymous session identifiers
• Gameplay actions (e.g., played cards, announcements, round results, move timestamps)
• Freely chosen player display names (pseudonyms) in multiplayer sessions
• Uploaded media files and technical metadata (for custom avatars)

Purpose and Legal Basis

• Operation of the Game: Processing game moves and real-time state is technically necessary to synchronize turns, scores, and multiplayer sessions across participants. Legal basis: Performance of the contractual/usage relationship pursuant to Art. 6(1)(b) GDPR.
• Bug Tracking and Game Logic Optimization: Gameplay logs are evaluated to detect rule anomalies, repair logic bugs, and compile anonymous statistical balances. Legal basis: Our legitimate interest in platform stability and defect-free mechanics pursuant to Art. 6(1)(f) GDPR. Where feasible, evaluations are performed on aggregated or pseudonymized records.

6. Local Storage and Cookies

Our application relies exclusively on strictly necessary browser storage mechanisms (such as session cookies or localStorage). These are used solely to store technical state:

• Session identifiers (IDs required for maintaining HTTP / WebSocket connections)
• Local interface preferences (e.g., card sorting order, animation speed, audio settings)

We do not use tracking, profiling, or third-party marketing cookies.

Legal basis: Storage of and access to information stored on your terminal equipment is permitted under Section 25(2) No. 2 of the German Telecommunications-Telemedia Data Protection Act (TDDDG) as strictly necessary to deliver the service explicitly requested, in conjunction with Art. 6(1)(b) and Art. 6(1)(f) GDPR.

7. Web Analytics (Plausible Analytics)

For reach measurement and aggregated usage trends, we use Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia).

Plausible is designed with privacy by default. It does not use cookies, does not store persistent identifiers on your terminal equipment, and does not conduct cross-site tracking. For visit counting, the IP address and User-Agent are temporarily hashed and discarded immediately thereafter, preventing any connection to individual persons.

Legal basis: Our legitimate interest in evaluating usage trends to optimize the service pursuant to Art. 6(1)(f) GDPR. A Data Processing Agreement has been established with the provider.

8. Error Monitoring and Diagnostic Telemetry (PostHog EU)

To detect application bugs, collect diagnostic traces, and ensure software reliability, we utilize PostHog (PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA).

We utilize PostHog’s EU Cloud infrastructure (data hosted exclusively on servers within the European Union, Frankfurt am Main, Germany).

PostHog is configured in a cookieless mode without persistent personal user profiling. In the event of application exceptions or performance regressions, technical diagnostic data (such as accessed URL, error stack traces, timestamps, browser version, and transient IP addresses) are transmitted to isolate the root cause.

Legal basis: Our legitimate interest in debugging, software security, and operational stability pursuant to Art. 6(1)(f) GDPR. A Data Processing Addendum (DPA) incorporating standard data protection safeguards has been executed with the provider.

9. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): You have the right to obtain confirmation as to whether personal data concerning you is processed and to receive information regarding that processing.
• Right to Rectification (Art. 16 GDPR): You have the right to request the correction of inaccurate or completion of incomplete personal data.
• Right to Erasure (Art. 17 GDPR): You have the right to request the deletion of your personal data, provided statutory retention grounds do not apply.
• Right to Restriction of Processing (Art. 18 GDPR): You have the right to demand restriction of data processing under certain statutory conditions.
• Right to Data Portability (Art. 20 GDPR): You have the right to receive data you provided to us in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data based on Art. 6(1)(f) GDPR (legitimate interests).

To exercise any of these rights, contact us informally at the email address specified in Section 1.

10. Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR. You may do so with the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our legal obligations, infrastructure, or technical features. The current version published on this website shall apply.