Privacy Policy

The controller responsible for data processing in this app is:

No data protection officer is currently appointed, as the legal requirements for this are not met.

This app processes only the following data:

• Account/login data: email address and an encrypted password (hash) created during registration. The password is never stored in plain text.
• Player profiles: display name or player name within a league and the assignment of accounts to leagues (membership, role).
• Match data: recorded match results, participating players and chosen characters, confirmations, and match deletion requests/votes.
• Rankings and statistics: evaluations derived from match data (e.g. Elo ratings, win rates, character statistics). These are not entered separately but calculated automatically.
• Technical data: when the app is accessed, the hosting provider processes technically necessary connection data (e.g. IP address, time, requested page) in server logs to provide and secure the service.

• Operating the account and sign-in (Art. 6(1)(b) GDPR – performance of a contract).
• Running the league: recording, confirming and deleting matches (Art. 6(1)(b) GDPR).
• Calculating and displaying rankings and statistics within the league (Art. 6(1)(b) GDPR).
• Technical provision and security of the app, including server logs (Art. 6(1)(f) GDPR – legitimate interest in secure operation).

There is no advertising tracking, no profiling and no sharing of data for marketing purposes.

The app is operated via the Lovable platform. All app data (accounts, profiles, matches, leagues) is stored in a managed cloud database (Supabase technology). Access is restricted by database-level access rules (row level security), so users only see the data of their own leagues.

TODO: Specify the exact hosting location / server region

This app uses your browser's local storage for technically necessary settings:

• Login session: a session token that keeps you signed in. It is deleted when you sign out.
• Language preference (German/English).
• Last selected league, so you land in the same league on your next visit.

Beyond that, the app sets no cookies of its own, no advertising tracking and no analytics tools. Consent under § 25 TDDDG is not required for the technically necessary storage mentioned.

• Hosting and database: Lovable (app platform and delivery) and Supabase (database and authentication service) process data on our behalf (data processing agreement).
• Fonts: The app loads fonts from Google Fonts. In doing so, your IP address is transmitted to Google servers; this may also involve a transfer to the USA (third-country transfer). Google provides the fonts under the EU-US Data Privacy Framework.

No further transfer of data to third countries takes place.

TODO: Verify and name data processing agreements (DPA) with the service providers

Account and league data is stored for as long as the account or league membership exists. Matches can be removed by the participating players via the app's deletion procedure. When an account is deleted, the associated personal data is deleted; matches already confirmed by other players remain in anonymized form.

TODO: Define concrete retention and deletion periods

You have the right to access, rectification, erasure, restriction of processing, data portability and objection to processing (Art. 15–21 GDPR). Please contact the controller named above. Where processing is based on consent, you can withdraw it at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates data protection law.

This privacy policy is updated whenever the technology used or the data processed changes. The current version is always available at this location.