Privacy policy

1. Controller

Rebrained Consulting
Owner: Dejan Čivša
Bruno-Walter-Ring 22
81927 Munich
Germany

Email: dejan@rebrained.de

2. What we process

• Account: email address, password (stored as a hash only), display name, handle, language, registration time; optionally a second factor (TOTP) for admin roles.

• Runs: the inputs of a run (which key or touch on which game tick), the score computed from them, the duration, the game version used, timestamps, the server's verification verdict.

• Device and connection: a random device id in the browser's local storage (for practice without an account and to protect against multi-accounts), a hash of the IP address and a hash of the browser user-agent string (never in clear text), coarse device facts such as pixel density and touch capability.

• Progress: experience points, level, play coins (no cash value), streaks, personal bests, participation in daily events and boards, each as a traceable journal.

• Usage events: technical events such as "run verified" or "event closed" with timestamps and ids, for debugging and operating statistics.

3. Purposes and legal bases

• Operating the service (account, runs, boards, progress): Art. 6 (1) (b) GDPR.

• Fairness and security (replaying runs, detecting automation and multi-accounts, rate limits, bans): Art. 6 (1) (f) GDPR; our legitimate interest is a competition in which only real, replayed runs count.

• Aggregated statistics and debugging: Art. 6 (1) (f) GDPR.

• Emails about your account (confirmation, password reset): Art. 6 (1) (b) GDPR. We send no marketing emails.

4. Recipients and processors

• Supabase Inc. (database and sign-in), data centre in the EU (Frankfurt, eu-central-1).

• Vercel Inc. (hosting, server functions in Frankfurt, delivery through a global network), data processing under EU standard contractual clauses.

• Cloudflare Inc. (DNS of the domain; planned: Turnstile bot protection on the registration form).

We do not pass data to third parties for their own purposes. Boards show display name, handle and result; practice runs without an account appear nowhere publicly.

5. Cookies and local storage

We set only strictly necessary cookies: the session of your account. There are no advertising or tracking cookies and no third-party services that follow you across websites. The browser's local storage holds the device id, your settings (e.g. sound) and your practice bests.

6. Retention

Account data is kept as long as the account exists. When you delete your account, display name and handle are anonymised, the account is locked and your personal data is removed; already verified results may remain in board archives without reference to a person where that is needed for running competitions or for the traceability of verifications. Input logs of practice runs are meant to be reduced to a checksum and the score after 30 days; until that routine runs they are kept until account deletion. We store IP addresses nowhere in clear text: with a run as a hash, for rate limits as a short-lived hashed key (minutes to an hour). Our host's access logs are short-lived (days, not months).

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). In Settings you can download your data as a file and delete your account. For anything else write to the email address above. You may also lodge a complaint with a data protection supervisory authority; the competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach.

8. Changes

When the service changes (e.g. tournaments with entry, notification emails) we update this policy and state the date of the change above.