Regulars

Template – must be reviewed and adapted by the operator. This privacy policy is a sample without warranty and not legal advice. Fill in every [PLACEHOLDER], remove sections that do not apply (e.g. AdSense if ads are disabled) and have the text reviewed before publishing.

Privacy policy

Last updated: [DATE] · In case of doubt, the German version prevails. [adjust]

1. Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
[FULL NAME / COMPANY]
[STREET, NUMBER]
[POSTCODE CITY], [COUNTRY]
Email: [EMAIL]

[If appointed: contact details of the data protection officer]

2. Overview

This website and its games need no user account. We set no cookies of our own and use no analytics or tracking tools. We process personal data only where technically necessary: to deliver the website (server log files), for online lobbies (real-time connection to our lobby server) and – if enabled and only as far as you consent – to show advertising via Google AdSense.

3. Hosting and server log files

The website is hosted by: [HOSTING PROVIDER, ADDRESS].[If applicable: a data processing agreement pursuant to Art. 28 GDPR is in place.]

When you visit the website, the web server automatically processes information transmitted by your browser and stores it in log files: IP address, date and time of access, requested file/URL, HTTP status code and amount of data transferred, referrer URL (if sent), browser type/version and operating system (user agent).

The purpose is to deliver the website and to ensure its stability and security (e.g. defending against attacks). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and error-free operation. Log files are deleted after [NUMBER] days unless they are needed longer to investigate a specific security incident.

4. SSL/TLS encryption

All data is transferred encrypted via HTTPS; the real-time connection of the lobbies is encrypted as well (wss://). You can recognise an encrypted connection by “https://” in your browser’s address bar.

5. Online lobbies (multiplayer)

When you create a lobby or join one via an invite link, your browser opens a WebSocket connection to our lobby server. The following data is processed:

  • your IP address – technically required for the connection and to limit abusive numbers of requests; it may appear in short-lived server logs;
  • the nickname you choose and your language setting;
  • the lobby data: lobby code, members and bots, selected game, game state, moves, and the dice and cup movements of the player whose turn it is, which are forwarded to the other members;
  • the chat messages you write in the lobby;
  • a randomly generated reconnect token that gives you your seat back after a connection drop.

Visibility: nicknames, chat messages and moves are visible to all members of the same lobby. Anyone who knows the invite link or lobby code can join the lobby. Please do not use your full name as a nickname and do not share sensitive information in the chat.

Retention: lobby data – nicknames, chat messages and game states – is kept only in the server’s memory and never written to a database. It is deleted when the lobby closes, at the latest 15 minutes after the last member disconnected, and whenever the server restarts. If your connection drops, your seat is reserved for20 seconds; after that a bot plays your turns until you return. Server logs are deleted after[NUMBER] days.

Legal basis is Art. 6(1)(b) GDPR (providing the multiplayer feature you requested) and Art. 6(1)(f) GDPR (security and abuse prevention). We do not create user accounts, do not build profiles and do not analyse lobby data for analytics or advertising purposes.

6. Local storage in your browser

To keep your settings, a game in progress and your lobby identity, the website stores the following data locally in your browser (Web Storage / localStorage):

  • kniffel3d.settings.v1 – language, sound on/off, volume, graphics quality, dice style, vibration and “shake to roll”;
  • kniffel3d.save.v1 – state of the current single-device game (player names, scores, round, dice);
  • kniffel3d.setup.v1 – the last player line-up (player names you entered, bot levels, rule variant);
  • stammtisch.identity.v1 – your last nickname and the random reconnect token for online lobbies.

In addition, the lobby keeps the code of the lobby you are currently in under stammtisch.lobby.active.v1 in the tab’s session storage (sessionStorage), so that you can return after reloading the page without entering your name again. This entry is removed when you leave the lobby or, at the latest, when you close the tab.

This data is not used for recognition or analysis. Only the nickname, the reconnect token and the lobby code are sent to our server, and only when you open a lobby (see section 5). Storing the data is strictly necessary to provide the functions you explicitly request (Section 25(2) no. 2 TDDDG); the legal basis for any processing of personal data is Art. 6(1)(b) or (f) GDPR. You can delete the data at any time by clearing this site’s data in your browser settings.

7. Motion sensors (optional)

If you turn on “shake to roll” in the game settings, the game reads your device’s motion sensors (DeviceMotion) to detect shaking. Some browsers ask for your permission first. The sensor data is evaluated only locally in your browser and is neither stored nor transmitted.

8. Advertising with Google AdSense

[Remove this section if ads are disabled (environment variable ADSENSE_CLIENT empty). In that case no connection to Google is made.]

This website uses Google AdSense to display advertisements. For users in the European Economic Area and Switzerland the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Ads may appear as display ads labelled “Advertisement” between the sections of the home page and the game pages, as a display ad in a side rail next to the game (large screens only) and – via the Google Ad Placement API (H5 Games Ads) – as full-screen ads between two games.

Data processed

When ads are loaded, your browser connects to Google’s servers. In particular, the following may be processed: IP address, device and browser information, the page visited and the referrer, date and time, information about ads shown and clicked, and cookie or advertising IDs. Google sets and reads cookies and similar technologies for this purpose.

Personalised and non-personalised ads

Personalised ads (based on your interests and browsing behaviour) are shown only if you have consented. Without consent, non-personalised or limited ads may be shown; Google still processes technically necessary data (e.g. the IP address) and – depending on your choices – cookies, e.g. for frequency capping, fraud prevention and reporting.

Consent and withdrawal

Visitors from the EEA, the UK and Switzerland are shown a consent dialog before any non-essential cookies are set. We use Google’s certified consent management platform “Privacy & messaging”, which supports the IAB Transparency & Consent Framework (TCF). Your choice is stored in a cookie. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw or change your consent at any time with effect for the future via[the “Privacy and cookie settings” link or button shown by the consent platform].

Transfers to third countries

Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; transfers are based on the European Commission’s adequacy decision (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46(2)(c) GDPR). Google partly processes data as an independent controller (Google Ads Controller-Controller Data Protection Terms).

More information

9. Fonts

All fonts are bundled with the website and served from our own server. No connection is made to Google Fonts or any other external font service.

10. No analytics or tracking tools

We use no web analytics (such as Google Analytics), no social media plugins and no tracking of our own.[Adjust if you add such services.]

11. Your rights

Within the limits of the law you have the right to: access to your personal data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation.

As we keep no user accounts and hold lobby data only briefly in memory, we usually cannot attribute data to a specific person. To exercise your rights, simply contact [EMAIL]. Without prejudice to other remedies, you also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence. The authority responsible for us is:[SUPERVISORY AUTHORITY, ADDRESS].

12. Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies.