Privacy Policy

Controller

Jan Kilian, Kolonnenstraße 8, 10827 Berlin, Germany — contact details in the Impressum.

What we process, and why

• Email address — to sign you in via magic link and administer your account (Art. 6 (1) b GDPR). Sign-in links expire after 15 minutes; sessions use an httpOnly cookie for 30 days.
• Entry data (domain, name, tagline, logo) — published on the board at your request (Art. 6 (1) b).
• Run data (game inputs, scores, timestamps) — to verify runs server-side and prevent manipulation (Art. 6 (1) b, f).
• Click statistics — outbound visits are counted with a truncated hash of the IP address for de-duplication; we do not store plain IP addresses for this purpose (Art. 6 (1) f: fraud prevention, honest statistics).
• Purchase data — processed by our payment provider; we store the transaction reference, amount, and credited honeypots (Art. 6 (1) b, c).
• Server logs — our hosting providers process IP addresses technically to deliver the site and defend against attacks (Art. 6 (1) f).

Cookies

We use one strictly necessary session cookie after sign-in and your local browser storage for game preferences (e.g. your best run). No advertising or tracking cookies, no consent banner needed.

Processors & hosting

• Vercel Inc. — hosting/CDN (EU/US, SCCs).
• Supabase — database and file storage, hosted in the EU (Frankfurt).
• Resend — transactional email, EU sending region.
• A payment provider will process purchases once the shop launches; this policy will be updated accordingly.

Retention

Account and entry data are kept while your account exists. Expired sign-in tokens are functionally dead after 15 minutes. Statutory retention periods (e.g. for purchase records) remain unaffected.

Your rights

You have the right to access, rectification, erasure, restriction, data portability, and objection (Art. 15–21 GDPR), and to lodge a complaint with a supervisory authority — in Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit. To delete your account and entry, email us; we'll confirm when it's done.