Privacy policy

Controller

The controller for the processing of your data on this website is:

Visiting the site

Each page request is recorded by the server in a log file: IP address, time, the address requested, status code, amount of data transferred, referrer and browser identification.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is secure and stable operation. This data is not combined with any other source and is deleted once it is no longer needed for that purpose.

Account

An account is optional. For it we process your email address and, where you provide them, a display name and a profile picture. The legal basis is Art. 6 (1) (b) GDPR. Your sign-in status is held in a strictly necessary cookie (§ 25 (2) no. 2 TDDDG).

Sign-in is handled by Stack Auth Inc. (USA) as a processor. Its SDK loads a script from Stripe, Inc. (USA) on every page for abuse detection, which receives your IP address in the process. If you sign in with Google, Google Ireland Limited also processes your data. Transfers to the USA are covered by the European Commission’s Standard Contractual Clauses.

Games and progress

Games against the characters are played by the app on your device; the game in progress and the most recently finished ones are kept in its local storage. Private tables and the hand of the day are played on our server: live games are held in its memory, and completed ones are archived for replay, even without an account. With an account we store the results of your games so that the balance and replay work. The legal basis is Art. 6 (1) (b) GDPR.

Account sync associates completed lessons, guided-scene results and experience points with your account and synchronizes them between your devices. Without signing in, learning progress stays on your device. Guest progress is never assigned to an account automatically.

When you are signed in, the app sends every game finished on the device to our server: the deal, the game rules, the moves, your seat, the table (place, characters and their playing strength), the day and time the game ended, and the Spuimoasta’s ratings of your cards. The server replays the game, books its winnings into your balance, files it under your games for replay and stores the resulting XP receipt; it prevents duplicate bookings. Lern-Arena hands count for experience only. Without an account your games stay on your device: the app keeps up to the last 100 so that it can offer to bring them into your account after you sign in, and sends them only if you agree.

At a private table the name you enter there is visible to the others — a nickname is enough. Display and game settings stay on your device.

With an account you can add Spezln: whoever opens your personal link and agrees becomes your Spezl. You then see only this of each other: your display name (if you have none, it says “Spezl” — never your email address), your figure, level and title, your weekly streak, this week’s experience points, and the result and rank of your hand of the day, the latter only once the other has played it too. A Spezl never sees your email address, balance, games or when you play. The legal basis is Art. 6 (1) (b) GDPR. Either of you can remove the other at any time; deleting your account also deletes every Spezl connection in both directions.

Analytics

We measure usage with PostHog (EU cloud, servers in Frankfurt am Main) as a processor: screens opened, clicks, the referring page and campaign details in the link, device and browser, approximate origin, load times and errors, plus recordings of the session. Input fields and displayed names are masked.

For this we assign a random device identifier stored in your browser; it contains no name. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is improving the service. You may object at any time:

Analytics on kopfln-oida.de

On the information site kopfln-oida.de we measure without cookies and without storing anything on your device. PostHog (EU cloud, Frankfurt am Main) combines the IP address, the browser identifier and a random value that changes daily into a count value that only groups visits from the same day; the IP address and browser identifier themselves are not stored. We record pages viewed, the referring page and campaign details in the link, device and browser, approximate location, load times and clicks on links to the app and the app stores. Some of these details, such as screen size and language setting, are read by the measuring script in your browser when a page loads and sent along; nothing is stored on your device, and the details are used for statistics only. Campaign details in the link (utm parameters) are passed on to the app when you switch to it.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is understanding how visitors find us. If your browser sends “Do Not Track” or “Global Privacy Control”, nothing is measured on kopfln-oida.de.

Feedback

If you send us feedback through the form, we process your text, the mood you picked and the screen you wrote from. A name is not required. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is improving the service.

The app for iOS and Android

The app from the App Store and Google Play processes the same data as this website, with these differences: sign-in credentials are kept in your device’s protected storage (Keychain or Keystore); settings, learning progress and the games played on the device are kept in the app’s local storage.

Notifications are optional and can be switched off kind by kind; the app first explains in its own words what it uses them for, and only then asks for the operating system’s permission. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. The reminder after a week away and, without an account, the Sunday one are scheduled by the app on your device. With an account, for notifications sent by our server we store your device’s push token with the platform, language, your offset from UTC (for the quiet hours from 9 pm to 9 am) and your switches, plus the kind and day of each notification sent. Signing out deletes the token; deleting your account deletes all of it.

Notifications are delivered through Expo’s push service (650 Industries, Inc., USA) as a processor and from there through the Apple Push Notification Service (Apple) or Firebase Cloud Messaging (Google). The token, the text and the kind of notification are transmitted. Expo is certified under the EU-US Data Privacy Framework; transfers to the USA rely on the European Commission’s adequacy decision (Art. 45 GDPR).

For app updates the app connects to Expo’s update service, which receives the IP address and technical details about the platform, runtime version and update channel. The app reports crashes only through the usage analytics, and only while that is allowed. Apple and Google may process diagnostics and usage data under their own terms.

Retention

We delete personal data once the purpose no longer applies and no statutory retention obligation stands in the way. Account and games are kept until you delete your account. You can do that yourself at any time under “My account” in the app or at kopfln-oida.de/konto-loeschen, and it takes effect immediately.

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR), and you may withdraw any consent at any time. An informal email to the address above is enough; you can also delete your account yourself. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Right to object

You may object at any time, on grounds relating to your particular situation, to processing we base on a legitimate interest (Art. 6 (1) (f) GDPR) — Art. 21 GDPR. For analytics, the switch further up this page is enough.