Privacy Policy

Datenschutzerklärung

1. Controller

Matthias Grawinkel
Wilmersdorfer Str. 154
10585 Berlin
Deutschland

2. Overview of Data Processing

We process personal data only to the extent necessary to provide our services. The following types of data may be processed:

· Contact data (email address)
· Usage data (pages visited, interactions)
· Device data (browser type, operating system)
· Connection data (IP address, access times)
· Payment data (when purchasing premium features)

3. Legal Bases

We process your data based on the following legal grounds:

· Art. 6(1)(a) GDPR — Consent - for analytics cookies (PostHog)
· Art. 6(1)(b) GDPR — Contract performance - to provide our service, process payments, and send authentication emails
· Art. 6(1)(f) GDPR — Legitimate interests - for security, fraud prevention, and service improvement

4. Cookies and Local Storage

We use the following types of cookies and storage:

Essential (always active)

· sessionid — Session cookie for authentication (expires after 1 year)
· csrftoken — Security token to prevent cross-site request forgery
· django_language — Stores your language preference
· analytics_consent — Remembers your analytics choice: cookies accepted, declined (anonymous only), or off (expires after 1 year)

Analytics (your choice)

· PostHog — Usage analytics to improve the app. If you accept, we use cookies and can recognise return visits. If you decline, we count your visit anonymously without cookies and without storing anything on your device. You can also switch analytics off entirely.

5. Services We Use

Fly.io — Hosting

Our application is hosted on Fly.io servers in Frankfurt, Germany (EU). Fly.io processes server logs containing IP addresses and request metadata for security and operational purposes.

Art. 6(1)(f) GDPR · fly.io/legal/privacy-policy

Amazon Web Services SES — Email

We use AWS Simple Email Service (Frankfurt region, EU) to send transactional emails, including magic link authentication emails. AWS processes your email address and email content for delivery.

Art. 6(1)(b) GDPR · aws.amazon.com/privacy

Cloudflare — CDN, DNS, Security

We use Cloudflare for DNS management, content delivery, and security protection. Cloudflare may process IP addresses and request metadata to provide these services and protect against attacks.

Art. 6(1)(f) GDPR · cloudflare.com/privacypolicy

PostHog — Analytics

We use PostHog (EU Cloud) to understand how the game is used so we can improve it. You choose how. If you accept cookies, PostHog stores an identifier on your device so we can tell that a return visit is the same browser; the basis is your consent, Art. 6(1)(a) GDPR and §25(1) TDDDG, and you may withdraw it at any time. If you decline, PostHog runs in cookieless mode: nothing is stored on or read from your device, and your visit is counted using an identifier PostHog derives on its own servers from a salt that changes daily, which cannot be traced back to you or linked across days. Because nothing is stored on your device in that mode, §25 TDDDG does not apply and the basis is our legitimate interest in improving the product, Art. 6(1)(f) GDPR. We never track you across other websites and we do not record your screen. You can object to all analytics, including the cookieless kind, via Privacy Settings in the footer; we also record how the game itself is played (cards drawn, decks chosen), keyed to a game rather than to you, and that stops too when you object.

Art. 6(1)(a) / 6(1)(f) GDPR · posthog.com/privacy

Stripe — Payments

We use Stripe to process payments for premium features. When you make a payment, your payment information is processed directly by Stripe. We do not store your full credit card details. Stripe acts as an independent data controller for payment processing.

Art. 6(1)(b) GDPR · stripe.com/privacy

Google Sign-In — Authentication

You may choose to sign in using your Google account. When you do, Google shares your email address and basic profile information with us to create or link your account. We do not receive your Google password or access any other Google services. Google acts as an identity provider for authentication purposes.

Art. 6(1)(b) GDPR · policies.google.com/privacy

6. Data Retention

We retain your personal data only as long as necessary for the purposes described above or as required by law. Account data is retained until you request deletion. Server logs are typically retained for 30 days.

7. Your Rights

Under GDPR, you have the following rights:

· Art. 15 — Right of access - request a copy of your data
· Art. 16 — Right to rectification - correct inaccurate data
· Art. 17 — Right to erasure - request deletion of your data
· Art. 18 — Right to restriction - limit how we process your data
· Art. 20 — Right to data portability - receive your data in a portable format
· Art. 21 — Right to object - object to processing based on legitimate interests
· Art. 7(3) — Right to withdraw consent - withdraw consent at any time (e.g., via Cookie Settings)

To exercise these rights, please contact us at [email protected].

8. Right to Complain

You have the right to lodge a complaint with a supervisory authority if you believe your data is being processed unlawfully. The competent authority in Berlin is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
datenschutz-berlin.de

9. Changes to this Policy

We may update this privacy policy from time to time. We will notify you of significant changes by posting a notice on our website. Please check this page periodically for updates.