Privacy

In short

You don’t need an account to play. The game itself stores only what it needs: a random identifier for your device, the name you enter and your game results. Decadio is funded by ads; what is processed for that is described under “Advertising”.

Controller

[[Name, address and email address as in the legal notice]]

Visiting the pages

When you visit Decadio, the server processes technically necessary data: your IP address, date and time, the address requested and details about your browser. This is needed to deliver the pages and keep the service secure (Art. 6(1)(f) GDPR).

[[Whether and for how long the server logs requests]] The server is hosted by [[hosting provider and its location]].

Device identifier, name and game results

On first start, your browser creates a random identifier and stores it on your device. Your device uses it to identify itself to the server; the server stores only a hash of it.

The server also stores the name you enter and your games: the themes chosen, the songs played, your guesses, results and reactions. The people you play with see your name and how your games went. Anyone who knows the link to a duel sees the names of the two players and how far along they are.

We need this data to provide the game (Art. 6(1)(b) GDPR). Duels that aren’t played to the end are deleted once nobody has played for 48 hours. Finished duels remain stored for your stats. [[Retention period for finished duels]]

Live groups

In a live group, all members see your name, your guesses, whether you’re connected and the preset short messages you send. A group disappears when it is closed or when nobody has played in it for some time.

Storage on your device

The game itself sets no cookies. Your browser’s local storage holds the device identifier, your name, the language you chose, the volume, the theme you last picked, your practice record, a game night in progress with the names of the players, and links to songs on Apple Music.

This storage is strictly necessary for the game (Section 25(2) no. 2 of the German TDDDG). You can clear it in your browser settings; your device then gets a new identifier and no longer knows your previous duels.

Connecting devices

You can connect several devices. One device shows a code that is only valid briefly; once it is entered on the other device, the server links the two identifiers.

Notifications

Only if you turn on notifications does the server store a push subscription for your browser: an address at the push service of the browser maker (such as Apple, Google or Mozilla), two keys and the language of the app. This is how you find out that it’s your turn; the message travels encrypted via that push service.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the settings of your browser or device.

Music from Apple

The songs play as previews from Apple. Our server handles the search for a song; Apple sees the server, not your device. The preview itself is loaded by your browser directly from Apple’s servers. In the process, Apple learns your IP address and details about your browser. Without this request the game can’t be played (Art. 6(1)(b) GDPR).

If you tap “On Apple Music”, you open a page run by Apple. The provider in Europe is Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland. You can find out more in Apple’s privacy policy.

Advertising

[[Ad provider, consent, the cookies set in the process and the note in the browser that a round has already been played; comes with the ads (plans/werbung.md)]]

No other third-party services

Apart from the music from Apple and the ads, Decadio does not embed any third-party services, including analytics or social media services. The font is served by our own server.

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, as well as the right to object to processing based on a legitimate interest (Art. 15 to 21 GDPR). To exercise them, write to the address given above. Because there are no accounts, your data can only be matched to you via your device’s identifier.

You can also lodge a complaint with a data protection supervisory authority.

Last updated

[[Date of publication]]