Datenschutzerklärung

Verantwortlicher (controller)

Felix Weber
Erich-Zeigner-Allee 34, 04229 Leipzig, Germany
Email: contact@mausi24.de

Playing without an account

You can play without signing up. While a game runs, its room (the four-letter code, the names you type, your guesses and scores) is kept in memory in our Redis database (Upstash). A room expires 30 minutes after the last activity and after 12 hours at most. Names in a room are visible to everyone in it.

Legal basis: Art. 6(1)(b) GDPR (providing the game you asked for).

Anonymous usage counts

To decide what to improve, our server keeps simple daily counters in our Postgres database (Neon). Per day, they count how many games started and finished, how many rounds were played, and with which settings (format, map, preset, twists, movement, rounds, time), in which player-count range (for example 3–4), whether it was played in Couch mode (on a TV), and whether the game was rated.

Not stored: names, accounts, room codes, IP addresses, locations, guesses or scores. The counters use no cookies and no browser storage, and the smallest unit of time is a day. We keep them for two years. There is no third-party analytics.

These are anonymous, aggregated statistics. We do not use them to identify anyone and do not combine them with account data.

Accounts

If you sign up, we store in our Postgres database (Neon, region EU / Frankfurt):

• your email address and whether you confirmed it,
• your display name (public, shown to other players and in league tables),
• your password, only as a salted scrypt hash (we never store the password itself),
• when the account was created and when you last signed in,
• your leagues, ratings and the results of rated games,
• one-time tokens for email links (confirmation, password reset, email change, league invites), stored as hashes and deleted after they expire (1 hour to 14 days).

If you invite someone to a league by email, we store their address with the invitation until it expires (14 days) and send them one invitation mail.

Shirt prints you save are stored with your account. Prints you make public are visible to everyone in the gallery, together with your display name, and anyone may wear a copy. If you report a print, we store the report (and the reason, if you give one) with your account. Your prints and your reports are deleted together with your account.

When you delete your account, your name and email address are removed and you leave all leagues. Past results stay in league histories under an anonymous name.

Legal basis: Art. 6(1)(b) GDPR. Invitations: Art. 6(1)(f) GDPR (our users' interest in inviting friends).

Cookie

Signing in sets one cookie, __Host-gp_session. It holds a random session token (we store only its hash), is sent only to this site over HTTPS, can't be read by scripts and expires after 90 days or when you sign out. It is strictly necessary for staying signed in (§ 25(2) no. 2 TDDDG); without an account no cookie is set.

Storage in your browser

To let you rejoin a game after a reload, the site keeps these entries in your browser. They never leave your device except to rejoin the game they belong to, and you can delete them in your browser settings at any time.

• pinsquad-seat:<CODE> (localStorage): your seat in game <CODE> (player id and a rejoin token),
• pinsquad-host:<CODE> (localStorage): the host token, if you created game <CODE>,
• pinsquad-player (localStorage, couch mode phones): game code, player id, rejoin token and name,
• pinsquad-host (sessionStorage, couch mode TV): game code and host token, deleted when the tab closes.

Two more settings stay local only and are never sent to a server: gp.3d (localStorage), your “3D figures” on/off choice, and the gp.portrait.* and gp.3dstep keys (sessionStorage), which cache small head-portrait images and the graphics step of this visit.

These settings are kept in your browser too: pinsquad-name (the name you last joined with), pinsquad-look (your figure, including a shirt print you drew), pinsquad-lang (English or German), pinsquad-sound (sound on or off) and pinsquad-print-public-seen (whether you have seen the note on public prints). Your name and figure are sent to the server when you join a party, because the other players see them. If you are signed in, your figure and your language are also saved on your account, so they apply on all your devices.

Legal basis: § 25(2) no. 2 TDDDG (strictly necessary for the game you started).

Abuse protection

To stop password guessing, spam sign-ups and mail floods, we count requests in our Redis database (Upstash). The counters are keyed by your IP address (for sign-in lockouts only by its network part: the first three blocks of an IPv4 address, the first four of an IPv6 address) or by a hash of the email address concerned. Each counter deletes itself when its time window ends, after 24 hours at the latest. Session lookups are cached there for 10 minutes.

Legal basis: Art. 6(1)(f) GDPR (keeping the service and its users' accounts safe).

Email

Account and invitation mails are sent through Resend (Resend, Inc., USA). Resend receives the recipient address and the content of the mail. We send only mails you triggered or that concern your account; there is no newsletter.

Hosting

The site runs on Vercel (Vercel Inc., USA; functions in the Frankfurt region). Each request is processed there, and Vercel keeps short-lived technical logs (such as IP address, time, requested URL and browser identification) to run and secure the service.

Legal basis: Art. 6(1)(f) GDPR (operating a secure website).

Maps and imagery

Google Maps / Street View. In Street View rounds your browser loads the Google Maps JavaScript API and the panoramas directly from Google (Google Ireland Limited / Google LLC, USA). Google receives your IP address and the usual browser data when they load. See Google's privacy policy.

OpenStreetMap. The guessing and result maps load their tiles directly from tile.openstreetmap.org (OpenStreetMap Foundation, UK), which receives your IP address. See the OSMF privacy policy.

Wikipedia photos. Photo rounds use pictures from Wikimedia Commons, but our server fetches them for you (and strips their metadata), so Wikimedia does not see your IP address.

The font and the map library are served from this site, not from third parties.

Legal basis: Art. 6(1)(f) GDPR (showing the places the game is about).

Recipients outside the EU

Vercel, Neon, Upstash, Resend and Google are based in or have parent companies in the USA. Data is transferred on the basis of the EU-US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses. Vercel, Neon, Upstash and Resend process data on our behalf (Art. 28 GDPR).

Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can change your email and password and delete your account yourself on the account page; for anything else write to contact@mausi24.de. You may also complain to a data protection supervisory authority, for example the one for Saxony (Sächsische Datenschutz- und Transparenzbeauftragte).