Privacy policy
In short: FIVE° has no ads, no tracking and no analytics services. We only store what the game needs to run, the game histories so we can improve the game, and – if you create one – your player account.
1. Controller
Jarno Räther
Wacholderweg 15, 21256 Handeloh, Germany
Email: playfive.de@gmail.com
There is no data protection officer, as there is no legal obligation to appoint one.
2. Hosting and delivery
The website and the game servers run on Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit, Cloudflare processes technically necessary connection data such as IP address, time, requested address and browser identifier in order to deliver the page and protect it against attacks.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is providing the site securely, quickly and reliably. We have a data processing agreement with Cloudflare under Art. 28 GDPR. Cloudflare is certified under the EU-US Data Privacy Framework. Transfers to the USA are therefore covered by the European Commission’s adequacy decision; the EU Standard Contractual Clauses apply in addition.
3. Game histories (archive)
So that we can improve the rules and balance and find bugs, game histories are stored in a database at Cloudflare. This applies to all game types: solo, pass & play and online. We store:
- the player names entered,
- cards, moves, rounds and results,
- game type, timestamps and a random game ID.
No email addresses, accounts or device identifiers are stored. You don’t have to enter your real name; a nickname is enough. Only the operator has access to the archive.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is developing the game further and fixing bugs. Game histories are deleted regularly once the last move is more than 12 months old.
4. Online rooms
For an online game, the room code, player names and the game state are stored. Each device gets a random access key. Only an irreversible hash of it is kept on the server. A room is closed after seven days without a move.
To limit abuse, such as rooms or game reports created in bulk, we derive an irreversible hash from the IP address (partly together with the date) and use it to count requests. We do not store the IP address itself. The legal basis is Art. 6(1)(b) GDPR, because this is necessary to provide the online game you requested, and Art. 6(1)(f) GDPR, because we have a legitimate interest in protection against abuse.
5. Player account (optional)
You can play FIVE° without an account. If you create one, we store:
- your username (publicly visible, for example on leaderboards and to friends),
- your password only as an irreversible, salted hash (PBKDF2) – we don’t know your password,
- your profile picture (a chosen card motif or a picture you uploaded, reduced to 256 × 256 pixels; publicly visible),
- EXP, league, statistics, achievements and equipped badges (league and badges are publicly visible),
- your ranked games and Daily Challenge results,
- sign-in sessions (random key stored as a hash, expiring after 90 days).
The legal basis is Art. 6(1)(b) GDPR (providing the account you want to use). Accounts are allowed from the age of 16. The data is kept until you delete your account. You can permanently delete it at any time in your profile under “Delete account”; this also deletes your ranked games and sessions. We review reports of inappropriate names or pictures and remove them if necessary (Art. 6(1)(f) GDPR, protecting our users).
6. Storage on your device
FIVE° stores some information in your browser’s local storage (localStorage). This keeps a game going and lets the game work offline:
- the current game,
- the player name you used last,
- settings such as sound and difficulty,
- for online games, the room code and access key,
- game reports not yet uploaded.
The browser also keeps a copy of the game files (service worker) so that FIVE° starts offline. This data only leaves your device to the extent described in sections 3 to 5.
The legal basis is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), because the storage is strictly necessary for the game you requested. You can delete the data at any time in your browser settings (“Clear site data”).
7. Cookies, no tracking, no external content
Without an account, we set no cookies. When you sign in, we store a technically necessary sign-in cookie (“five_user”, 90 days) so that you stay signed in (§ 25(2) no. 2 TDDDG). The password-protected operator area also uses a sign-in cookie. There are no analytics or advertising services, no social media plugins and no externally loaded fonts.
8. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Just send an email to the address above. If possible, include the player name, date and game type so we can find the game.
You can also lodge a complaint with a data protection supervisory authority, for example the authority where you live or the authority responsible for us: Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, www.lfd.niedersachsen.de.
9. Changes
When the game changes, we update this policy. The version published here applies.