Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of Art. 4 (7) of the EU General Data Protection Regulation (GDPR / DSGVO) is:

Victor Löwen
32547 Bad Oeynhausen, Germany
Email: [email protected]

We have not appointed a Data Protection Officer because we are not legally required to do so under Art. 37 GDPR / § 38 BDSG.

2. Scope of this policy

This policy applies to the website polyomino.io and the multiplayer browser game offered there. It applies to every visitor regardless of where they are located. Personal data are all data that personally identify you or could be used to do so.

Players outside the EU/EEA: the service is operated from Germany. By using it, your data is processed in the European Union under the GDPR — a data-protection regime widely regarded as one of the strictest in the world. The rights described in section 7 apply to you regardless of your country of residence.

3. Data we process

3.1 Server log files

When you access the site, our hosting provider automatically records information that your browser transmits. This includes:

• Browser type and version
• Operating system
• Referrer URL
• IP address (anonymised after a short retention period)
• Date and time of the request

Purpose: ensure technical operation, security, and abuse prevention.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in operating a stable, secure service).
Retention: log files are deleted automatically after at most 14 days unless required for the investigation of a security incident.

3.2 Real-time gameplay data (Socket.IO / WebSocket)

Playing the game requires a persistent WebSocket connection between your browser and our server. During the connection we process:

• The nickname and color you choose (you provide these voluntarily)
• The game mode you select
• Mouse-aim, movement input, and viewport size, in order to render the game
• Your IP address, technically required to maintain the connection

Purpose: running the multiplayer game session you requested.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract / pre-contractual measures at your request).
Retention: game state is held in memory only and discarded the moment your connection ends. We do not store nicknames, scores, or game history beyond your session.

3.3 Local storage in your browser

We store your last chosen nickname under the key polyomino:name in your browser's localStorage so the input is pre-filled the next time you visit. This data never leaves your device.

Legal basis: § 25 (2) Nr. 2 TDDDG (storage strictly necessary to provide a feature you actively requested by entering a nickname). You can clear this entry via your browser settings at any time.

4. Cookies

The game itself does not set any cookies. Cookies and similar technologies may be set by the third-party services described in section 6 (advertising). Storage of, and access to, information on your device that is not strictly necessary requires your consent under § 25 (1) TDDDG (German implementation of the ePrivacy Directive). We ask for this consent via a consent banner before any non-essential cookies, trackers, or ad scripts are loaded. You can withdraw your consent at any time via the "Privacy options" / "Manage privacy" link.

5. Hosting

The website is hosted on a virtual private server provided by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (privacy policy). Servers may be located within the European Union. The hosting provider acts as a processor under Art. 28 GDPR.

6. Third-party services

6.1 Google AdSense and the H5 Games Ad Placement API

We use Google AdSense and the H5 Games Ad Placement API (provided by Google), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). AdSense uses cookies and similar technologies (e.g. web beacons) to serve and personalise ads, measure ad performance, and prevent fraud. Information about your use of this site (including your IP address) may be transmitted to and stored by Google.

Legal basis: Art. 6 (1) (a) GDPR (your consent, given through the consent banner). We only set ad-serving cookies after you actively consent. You can withdraw your consent at any time by clicking the "Manage privacy" / "Privacy options" link displayed by the consent banner.

Recipients / international transfers: Google. Data may be transferred to Google servers in the United States. Google relies on the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses as a transfer mechanism. For more information see Google's privacy policy: https://policies.google.com/privacy and Google's advertising information: https://policies.google.com/technologies/ads.

You can also opt out of personalised advertising in your Google Ads Settings: https://adssettings.google.com/.

6.2 Google Funding Choices (Consent Management)

To collect and manage your consent for advertising and tracking, we use Google Funding Choices, a Google-certified Consent Management Platform. Funding Choices stores your consent decision so we do not have to ask again on every page view. Processing is based on Art. 6 (1) (c) GDPR (legal obligation to obtain valid consent under § 25 (1) TDDDG / Art. 7 GDPR) and Art. 6 (1) (f) GDPR (legitimate interest in providing a compliant consent flow).

6.3 Google Fonts (self-hosted alternative recommended)

The site loads the "Ubuntu" font from Google Fonts (fonts.googleapis.com / fonts.gstatic.com). When the font is requested, your IP address is transmitted to Google. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a consistent visual presentation). Google Ireland Limited is the recipient. See https://policies.google.com/privacy.

7. Your rights as a data subject

Under the GDPR you have the following rights with respect to data we process about you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure / "right to be forgotten" (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on Art. 6 (1) (e) or (f) GDPR (Art. 21 GDPR)
• Right to withdraw consent at any time, without affecting prior lawful processing (Art. 7 (3) GDPR)

To exercise any of these rights, contact us at [email protected]. We will respond within one month (Art. 12 (3) GDPR).

8. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement (Art. 77 GDPR). The competent supervisory authority for the controller is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
Web: https://www.ldi.nrw.de/
Email: [email protected]

Players outside Germany may also lodge a complaint with their local supervisory authority (in the EU/EEA, see edpb.europa.eu/about-edpb/about-edpb/members).

9. Children and minors

Under Art. 8 GDPR in conjunction with § 25 (1) TTDSG/TDDDG, the consent of a child to the processing of personal data based on Art. 6 (1) (a) GDPR (e.g. for personalised advertising) is only valid in Germany if the child is at least 16 years old. The age threshold may be lower in other EU Member States (some allow 13). Children below the applicable age must obtain consent from a parent or legal guardian. We do not knowingly process data of children below this threshold for non-essential purposes.

10. International data transfers

The website is hosted in the EU (see section 5). Some third-party services (in particular Google AdSense, see section 6.1) may transfer personal data to recipients in third countries, including the United States. For such transfers we rely on:

• the EU–U.S. Data Privacy Framework adequacy decision (Commission Implementing Decision (EU) 2023/1795), and
• EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) where the recipient is not certified under the framework.

The list of recipients and the relevant transfer mechanism are described in section 6 above.

11. Changes to this policy

We may update this policy as the service evolves or legal requirements change. The current version, with its "Last updated" date, will always be available at this URL.