Privacy policy

1. Controller and contact

Please send data protection requests to this email address. Further provider details are in the imprint (Impressum).

2. Hosting and technical logs

The website is operated by IONOS on a server in Spain. When pages are requested, the server processes in particular the IP address, time, requested host name and path, HTTP method, status code, amount of data transferred and processing time. This serves to provide the website, analyse errors and prevent abuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.

The HTTP access logs contain no request content, no cookie or authorization headers and no URL query parameters. Log files are rotated at about 10 MiB. At most ten archived files are kept; archives older than 168 hours are removed during rotation. With low traffic, the current file may exist for longer. This is not a guaranteed complete deletion after seven days.

Successful and failed sign-ins are additionally logged with the time, the email address entered, IP address, browser/device details and the outcome. Security-relevant account management and administrative changes are also recorded. Passwords, session and recovery tokens are never logged in plain text. This security logging takes place independently of consent to the voluntary click recording.

3. Visitor statistics and registration analysis

To understand how many people visit the website and the apps and how many of them register, we count visits and registration steps. When you open the website or the app, it sends one short message to our server per page load; blog pages, the privacy policy and the imprint are counted directly when they are requested. We also record when the registration form is opened, every submitted registration attempt with its result (for example account created, email address already registered, bot check failed), created accounts and confirmed email addresses.

For this we process the time, IP address, browser and device information (the user agent and, derived from it, browser, operating system, device type and whether the request is automated), platform (website or Android app), the area visited and the language. To count unique visitors, a keyed hash value is formed from the IP address and user agent. No cookies and no identifier on your device are stored for this. Entries such as your email address or password are not stored in these statistics; created accounts and confirmations are linked to the account ID.

The purpose is to evaluate reach and the registration process and to detect abuse, such as large numbers of automated registration attempts. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving the service and operating it securely. Only authorised administrators have access. IP addresses are shortened after 30 days (IPv4 to the first three blocks, IPv6 to the first three groups) and the entries are deleted after 180 days. When you delete your account, the link to your account is removed, as are the IP address and browser information of these entries. You can object to this processing under Art. 21 GDPR on grounds relating to your particular situation.

4. Gameplay, account and communication

Games against bots can be played without an account. For account features and online games we process your email address, account name, a salted password hash (none for accounts that only sign in with Google), verification status, permissions and session data. For signing in with Google, see section 8. Online games involve, among other things, room membership, moves, results, statistics and, where applicable, club memberships. The start and end of games may be recorded in game logs.

Messages and chats are processed when you use these features. Other participants see the information intended for each feature, such as account names, scores, leaderboards or messages addressed to them. Please do not share confidential information in chats. For registration, sign-in, recovery, messaging and gameplay, the legal basis is Art. 6(1)(b) GDPR.

For account confirmations, recovery and contact requests, your email address, the message content and related technical details are processed through our email/SMTP provider. For general requests, Art. 6(1)(b) or (f) GDPR applies depending on the request. Account features cannot be used without the information they require.

Reports: Players can report other players’ profile pictures, profile descriptions, room chat messages and private messages. We then store the time, the reporting and the reported account, the chosen reason, an optional comment and a copy of the reported content, so that administrators can review it even after a change. Administrators receive an email about new reports that contains no reported content. The reported player does not learn who reported them. Depending on the outcome, the content may be removed or an account banned. The purpose is safe and respectful play; the legal basis is Art. 6(1)(f) GDPR. If the reported account is deleted, the reports about it are deleted; if the reporting person deletes their account, the report remains without a link to them.

5. Cookies and local storage

The website uses technically necessary session data and local browser storage for account features, settings and consent decisions. If you choose “Stay signed in”, the protected HttpOnly cookie durak_remember is set for up to 30 days. On the public website it is only sent over HTTPS. Normal sign-in sessions are valid on the server for up to one day; signing out and certain account security actions can end sessions earlier. The validity of a token does not mean that all related logs are deleted automatically.

Technically necessary storage serves the function you requested (Section 25(2) no. 2 TDDDG); the related processing is based on Art. 6(1)(b) or (f) GDPR. Storage that is not necessary, for advertising, is used only on the basis of your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR where consent is required. Your browser settings let you delete stored data; this may remove your sign-in and saved choices.

6. Voluntary click recording

Only after your explicit consent, clicks or taps are stored after sign-in with the time, account, predefined action, type of control, screen, area, previous selection/expansion state, IP address and browser details. The purpose is usability analysis and technical troubleshooting. Input values, passwords, message texts and card values are not recorded as click content. Recording is technically not guaranteed for every event.

The legal basis is your consent under Art. 6(1)(a) GDPR. Declining does not restrict playing. You can withdraw this consent in the game under Settings → Privacy and click recording. Withdrawal takes effect for the future; entries already stored are not deleted automatically. To request deletion, please use the contact address above. This decision is separate from consent to advertising.

7. Protection against automated requests

To protect registration we use Cloudflare Turnstile. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When the check is shown and verified on the server, in particular the IP address, technical browser/device information, timing and interaction signals may be transmitted to Cloudflare. The purpose is protection against bots and abusive registrations; the basis is Art. 6(1)(f) GDPR with the legitimate interest in IT security. Where technically necessary device storage is used, Section 25(2) no. 2 TDDDG applies.

Cloudflare processes signals as a processor to protect our website and, under its own responsibility, also to improve its bot detection. Data may be processed outside the EU. Information on purposes, storage and international transfers can be found in the Turnstile privacy policy. The transfer mechanisms described there apply.

8. Signing in with Google

You can register and sign in with your Google account, or connect an existing account with Google in your profile. For users in the European Economic Area, the provider of “Google Identity Services” is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Only when you open the sign-in or registration form, or start connecting Google in your profile, does your browser load the script and the “Continue with Google” button from accounts.google.com. For technical reasons Google receives in particular your IP address and browser details; if your browser is signed in to Google, Google can recognise this. The script is not loaded on the other pages of this website.

If you choose “Continue with Google” and confirm the sign-in with Google, Google sends us a signed identity token. We verify it and store the permanent Google account identifier, the email address of your Google account, and the time of connection and of last use, together with your Durak Advanced account. When you register this way, the verified email address of your Google account becomes the email address of your Durak Advanced account. We do not store any name or profile picture contained in the token. We never receive your Google password, and we get no access to other data in your Google account.

The legal basis for signing in and connecting is Art. 6(1)(b) GDPR, as you choose this sign-in method yourself. Loading the button when the form is opened is based on Art. 6(1)(f) GDPR with the legitimate interest in offering a simple sign-in option; where your device is accessed, Section 25(2) no. 2 TDDDG applies. Signing in with Google is voluntary; you can always register with an email address and password instead.

You can disconnect Google in your profile under “Google account”; the stored Google account identifier is then deleted. You can also revoke access in your Google account settings. Google may also process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework. More information is in Google’s privacy policy.

9. Google AdSense and advertising consent

We are preparing the integration of Google AdSense. As long as live advertising is not activated and configured, only a local preview labelled as such is shown, without triggering an AdSense ad request. This privacy page itself loads no advertising, analytics or consent scripts.

When advertising is activated, AdSense is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In the process, IP address, page/device information, cookies and other identifiers may be transmitted to Google or to the advertising partners named in the consent dialog in order to deliver ads, measure their performance and detect abuse. Depending on your consent, advertising may be personalised.

On our website an ad request is only released once the consent management confirms the required consent, or determines that the consent requirement in question does not apply. For processing that requires consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG apply. Details on partners, purposes and storage periods are shown in the consent dialog used. With Google consent management active, you can reopen your advertising choices in the game under Settings → Change privacy choices. Withdrawing consent does not affect the lawfulness of processing up to the withdrawal. Merely publishing this policy does not activate advertising.

Google may also transfer data to the USA and other countries. More information on processing, international transfers and storage periods: Google privacy policy and how Google uses information from sites that use its services. The specific consents and the safeguards explained there apply.

10. Payment features

If you use a PayPal payment feature offered in the shop, transaction/subscription identifiers, status information and the link to your user account, among other things, are processed for the payment. You are only forwarded to PayPal when you use the payment feature. You enter payment data such as bank or card details at PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. The legal basis for processing payments is Art. 6(1)(b) GDPR; for legally required retention, Art. 6(1)(c) GDPR. More information is in the PayPal privacy statement. A test/sandbox flow offered for technical purposes is not a real payment.

In the app installed through Google Play, the ad-free subscription is purchased exclusively through Google Play Billing. For users in the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. You enter payment data at Google; we do not receive it. We process the purchase token issued by Google, the subscription status and expiry date, the link to your user account, and a pseudonymous account identifier that we pass to Google at purchase time to assign the purchase to your account. We do not pass your email address or account ID. To verify, acknowledge and renew purchases, our server queries the subscription status at Google. The legal basis is Art. 6(1)(b) GDPR. More information is in Google’s privacy policy.

11. Recipients and storage period

Authorised administrators and the hosting, email and technical service providers used for their respective tasks have access to account data and internal logs. Other users only see the information intended for game, leaderboard, club and messaging features. Databases and backups are not publicly accessible. The data described in the respective sections is transmitted to Google (sign-in with Google, advertising) and Cloudflare; this website does not transmit account passwords to advertising providers.

Account data is stored for the existing user account and its features. Expired sessions are cleaned up during later sign-ins; recovery/confirmation tokens are valid for up to 30 minutes and are removed when used. HTTP log rotation is described above.

Current technical status: There is currently no general automatic deletion and no uniform fixed deletion period for security, game, click and administration logs. Messages, statistics and backups are not removed by a general scheduled deletion either. Technical storage alone does not justify unlimited retention. For access and deletion requests, the respective purpose, existing legal obligations and, where applicable, the establishment, exercise or defence of legal claims are assessed. Please contact the controller to have your data reviewed. Withdrawing click or advertising consent does not automatically delete existing data.

12. Your rights

Under the statutory conditions, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Objection: Where processing is based on Art. 6(1)(f) GDPR, you can object on grounds relating to your particular situation under Art. 21 GDPR. You can object to processing for direct marketing at any time.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the place of your habitual residence, your place of work or the place of the alleged infringement. For private bodies in Bavaria, the Bavarian State Office for Data Protection Supervision is responsible.

A message to I_edjibia@outlook.de is sufficient for requests. If there is reasonable doubt, information to verify your identity may be required. This website does not itself use solely automated decision-making with legal or similarly significant effects under Art. 22 GDPR; game rules, leaderboards and abuse checks are distinct from this.

13. Deleting your account

You can delete your account yourself at any time: sign in in the app or at durak-advanced.de, open Online account → Delete account and confirm with your password (for accounts that only sign in with Google, confirming is enough). If you can no longer sign in, an email from the address belonging to the account to I_edjibia@outlook.de is sufficient.

Deleting your account immediately removes: email address, password hash, account name, sessions, confirmation and recovery codes, the connection with Google, statistics and your own game results, private messages, room chat messages, block lists, club membership and invitations, privacy settings, as well as ad-free entitlements and subscription records. Running subscriptions at PayPal or Google Play are cancelled first; remaining paid time ends with the account. A club you founded passes to the member who joined earliest, or is dissolved if there are no other members. Running games and waiting lobbies you take part in end without a result.

So that shared game and tournament histories of other participants stay consistent, an anonymous identifier without email address, name or sign-in method remains; in such histories you then appear only as “Player-” with a random identifier. The email address is removed from security logs; IP address and browser details in these logs are kept to prevent abuse as described in section 11. Statutory retention obligations, for example for payment records at PayPal or Google, remain unaffected.