Privacy Policy

The controller responsible for data processing in this app is:

No data protection officer is currently appointed, as the legal requirements for this are not met.

This app processes only the following data:

• Account/login data: email address and an encrypted password (hash) created during registration. The password is never stored in plain text.
• Player profiles: display name or player name within a league and the assignment of accounts to leagues (membership, role).
• Match data: recorded match results, participating players and chosen characters, confirmations, and match deletion requests/votes.
• Rankings and statistics: evaluations derived from match data (e.g. Elo ratings, win rates, character statistics). These are not entered separately but calculated automatically.
• Technical data: when the app is accessed, the hosting provider processes technically necessary connection data (e.g. IP address, time, requested page) in server logs to provide and secure the service.

• Operating the account and sign-in (Art. 6(1)(b) GDPR – performance of a contract).
• Running the league: recording, confirming and deleting matches (Art. 6(1)(b) GDPR).
• Calculating and displaying rankings and statistics within the league (Art. 6(1)(b) GDPR).
• Technical provision and security of the app, including server logs (Art. 6(1)(f) GDPR – legitimate interest in secure operation).

There is no advertising tracking, no profiling and no sharing of data for marketing purposes.

The app is operated via the Lovable platform. All app data (accounts, profiles, matches, leagues) is stored in a managed cloud database (Supabase technology). Access is restricted by database-level access rules (row level security), so users only see the data of their own leagues.

TODO: Specify the exact hosting location / server region

This app uses your browser's local storage for technically necessary settings:

• Login session: a session token that keeps you signed in. It is deleted when you sign out.
• Language preference (German/English).
• Last selected league, so you land in the same league on your next visit.
• Display settings, for example the “owned heroes only” filter.
• Tournament guest access: one access token per tournament if you join via an invitation link without an account. Without it you could not continue your tournament participation in this browser.

Beyond that, the app sets no cookies of its own, no advertising tracking and no analytics tools. Consent under § 25 TDDDG is not required for the technically necessary storage mentioned.

• Hosting and database: Lovable (app platform and delivery) and Supabase (database and authentication service) process data on our behalf (data processing agreement).
• Email delivery: notifications (e.g. invitations, reminders about pending confirmations) are sent via the Resend service, technically connected through Lovable. Your email address is transmitted to Resend for this; processing in the USA is possible (third-country transfer).
• Fonts: The app loads fonts from Google Fonts. In doing so, your IP address is transmitted to Google servers; this may also involve a transfer to the USA (third-country transfer). Google provides the fonts under the EU-US Data Privacy Framework.
• AI rules oracle: questions and optionally uploaded photos are transmitted through the Lovable AI Gateway to the OpenAI language model used there and processed by it. This may include a transfer to the USA (third-country transfer).

No further transfer of data to third countries takes place.

TODO: Verify and name data processing agreements (DPA) with the service providers

Purpose: In the rules oracle under “Rules & FAQ” you can ask a rules question and optionally add a photo, for example of a hero board, a card, a status token or a table situation. The photo is only used to identify the relevant character, text or state. The legal basis is your request for this analysis (Art. 6(1)(b) or (f) GDPR).

Data: the question text and – if you add one – the photo. Please photograph only game material, no people or other personal content.

Processing: The photo is resized and re-encoded in your browser, which removes metadata such as EXIF and GPS information. It is transmitted for the current request only, is not stored in the app database or any public storage, and no publicly accessible image URL is created.

Recipients: The request and the photo are forwarded through the Lovable AI Gateway (Lovable) to the OpenAI model used there, which analyses the image. This may involve processing in the USA.

No automatic storage: a photo is never kept automatically. Only if you explicitly submit an image later through a separate function (e.g. a bug report) will it be stored for that purpose.

In addition to email and password, you can voluntarily sign in with “Sign in with Apple” or “Sign in with Google”. The purpose is solely authentication and assignment to your account. The legal basis is providing the sign-in you requested (Art. 6(1)(b) GDPR).

The following data may be processed: the provider ID of your account, the email address supplied by the provider – with Apple also a relay address at your choice (“Hide My Email”) – and a name if you share it. No further permissions are requested: only the standard sign-in data (profile, email, OpenID) needed for account assignment.

If the email address confirmed by the provider already belongs to an existing account, the sign-in is assigned to that account so no second player profile is created. If the address differs (e.g. an Apple relay address), no silent merge happens; instead you can deliberately link or unlink the method in your profile under “Sign-in methods”.

Recipients are Apple Inc. (Apple Account/Sign in with Apple) or Google Ireland Limited/Google LLC (Google account) and our auth service at Lovable/Supabase, which technically handles the sign-in. When you open the provider page, that provider also processes your IP address and device details under its own responsibility. Processing in the USA, and therefore a third-country transfer, is possible.

Provider privacy information: Apple at https://www.apple.com/legal/privacy/ and Google at https://policies.google.com/privacy. Use is voluntary; signing in with email and password remains possible without a provider.

If you have enabled email notifications in your profile, we send messages about your leagues and tournaments (e.g. invitation, pending confirmation, confirmed result, automatic confirmation after the deadline). The legal basis is the operation of the league/tournament use (Art. 6(1)(b) GDPR).

You can turn email notifications off in your profile at any time. Guests without an account receive no emails because no email address is stored for them.

Account and league data is stored for as long as the account or league membership exists. Matches can be removed by the participating players via the app's deletion procedure. When an account is deleted, the associated personal data is deleted; matches already confirmed by other players remain in anonymized form.

TODO: Define concrete retention and deletion periods

You have the right to access, rectification, erasure, restriction of processing, data portability and objection to processing (Art. 15–21 GDPR). Please contact the controller named above. Where processing is based on consent, you can withdraw it at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates data protection law.

This privacy policy is updated whenever the technology used or the data processed changes. The current version is always available at this location.