There is no data protection officer; none is legally required for this small private website.
| Processing | Legal basis (GDPR) |
|---|---|
| Creating a random profile, storing name and picture, running rooms and chat | Art. 6(1)(b) – providing the service you request |
| Linking a sign-in account (Discord, Twitch, Google, GitHub and others) | Art. 6(1)(a) – your consent (you start it and can withdraw it by disconnecting) |
| IP hash, rate limiting, VPN/Tor blocking, automatic name/chat filtering, bans, security logs | Art. 6(1)(f) – legitimate interest in keeping the site secure, free of abuse and available |
| Storing the login token in your browser | § 25(2) no. 2 TDDDG – technically necessary to provide the service you asked for (no consent banner needed) |
| Two-step protection (2FA) for the developer page | Art. 6(1)(a) – your consent (you turn it on and can turn it off); Art. 6(1)(f) – security of accounts and apps |
| Developer apps and “Sign in with miowawa”: storing your apps (with their contact e-mail address), confirming the deletion of an app by e-mail, storing the apps you allowed, handing your data to an app after you click “Allow” | Art. 6(1)(a) – your consent for each app (you can remove it at any time); Art. 6(1)(b) for the app owner's own apps |
Profile ID, hashed login token, display name, profile picture, optional identity data from a linked account (Discord, Twitch, Google, GitHub and other sign-in services) and tokens (encrypted), optional 2FA data (encrypted secret, hashed recovery codes, optional recovery e-mail address), optional developer apps and the list of apps you allowed (with the date and the data parts), role (team only), game statistics and achievements, friends list, friend requests and direct messages between friends, last-seen time, keyed IP hash, ban status, and short-lived room/chat data held in memory (with a temporary copy for restarts). Details and retention periods are listed in the Privacy Policy. Automatic name and chat filters only block or restrict inappropriate content. The only automated decision with a real effect is the bot check: while you play, the server briefly looks at your answer times and whether you type before sending a word (held in memory for the last few turns only, not stored). Your browser also checks, only on the game page, whether the word field is used with a real keyboard, whether the browser is remote controlled and whether the game connection was tampered with by a script (your extensions are not read or listed, and only one of these three results is sent to the server). If a profile without a bot account clearly acts like a bot or a cheat script, it is banned automatically, and the IP hash is blocked too (never for team members' networks) (Art. 6(1)(f), protecting the game from automated abuse). Every such ban can be reviewed by a person: write to the contact address and we will check it and lift the ban if it was a mistake (Art. 22 GDPR). Word suggestions you send through the suggestion form (the words, your optional comment, your display name and the time) are stored until the team has reviewed and deleted them.
Profile data is kept until the profile is deleted. Room and chat data is held in memory and disappears when the room closes. To keep running games alive during a server restart, a temporary copy of open rooms (including the last 50 chat messages) is written to the server and deleted right after the restart (or discarded after 10 minutes). Ban records are kept as long as the ban is in force. Web-server security logs are kept only for a limited period and then deleted.
You have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). If processing is based on consent you can withdraw it at any time (Art. 7(3)); this does not affect earlier processing.
How to use them: write to the contact address above and tell us your display name (and, if possible, your profile ID, which a team member can look up by name). Because the site does not collect your identity, we may ask you to prove that the profile is yours, for example by showing the profile in your browser. You can already change your name and picture and disconnect linked accounts yourself in the panel under your name.
You may lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, workplace or the place of the alleged infringement. A list is available at edpb.europa.eu.
Encrypted connections (HTTPS/WSS), encrypted storage of profile data, hashed login tokens, hashed IP addresses, per-connection encryption of game prompts, rate limiting and abuse protection.
We may update this notice when the site or the law changes. The date at the top shows the latest version.