Privacy

In short

Hefau has no accounts, no ads and no profiling, and no data is sold. The game sets no cookies. Online play only exchanges game data between the two phones – no names or contact details.

Who is responsible

The data controller is Jacek Mariusz Taczała (a private individual, the author of the game), contact: kontakt@stop60.no.

Cookie-free statistics

We count visits with GoatCounter (the script is hosted with the game): page and referring page, browser and system, language, screen width, country (derived from the IP address) and the events “game started” and “game finished”. The IP address and browser are only used in the server’s memory (up to 8 hours) to count unique visits; only aggregate statistics are stored, without IP address or identifier. GoatCounter stores nothing in your browser.

Purpose: to know how many people play and where they come from. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). You can object at any time: block scripts, or open the game with #toggle-goatcounter at the end of the address (counting then stays off on that device; this is remembered in localStorage as “skipgc”), or write to us.

Data on your device

The browser’s storage keeps your language, sound setting, a game in progress (so you can continue) and a random technical ID that gives you your seat back in online play; for the open tab only (sessionStorage) the current room code and whether the intro has been shown. These are not cookies and do not leave the device, except what online play needs (below).

They are strictly necessary for features you use, so no consent is needed. You can delete them at any time in your browser’s settings for this site (clear site data).

Online play

When you start or join an online game, the moves, game state, room code and the random technical ID are sent via Supabase Realtime to the other phone. The messages are only broadcast live between the players in the room and are not stored by us. No names, accounts or contact details are used. The room code is part of the invite link; you decide whom you send it to.

Purpose: to make the online mode you start work. Legal basis: legitimate interest (GDPR Art. 6(1)(f)); online play is optional.

Sharing and QR code

The Share button opens your device’s share menu or copies the game link; the QR code is drawn in your browser and only contains the game’s address. For online play you can send the invite link (with the room code) the same way. Nothing about this is sent to us; what you share goes through the app you choose.

Fonts and sounds

The fonts are hosted with the game (no Google Fonts or other external font or script services). Sounds are played or generated in your browser.

Recipients

Supabase (Supabase Pte. Ltd., Singapore, part of Supabase, Inc., USA) – the real-time connection for online play, on servers in the EU (AWS, Ireland), as processor under a data processing agreement (DPA) with the EU standard contractual clauses for any access from outside the EEA (e.g. support); its server logs may briefly record the IP address (Supabase privacy policy).

GoatCounter (Martin Tournoij, Ireland) – statistics, servers at Hetzner in Finland and Germany (GoatCounter privacy policy).

GitHub, Inc. (USA) – hosting via GitHub Pages; GitHub may log the IP address and browser data when pages are loaded. Transfer to the USA under the EU–US Data Privacy Framework (GitHub privacy statement).

E-mail: messages to kontakt@stop60.no are forwarded by ImprovMX Inc. (USA) (ImprovMX privacy policy) to a mailbox at Proton AG (Switzerland, a country with an EU adequacy decision) (Proton privacy policy). We use e-mails only to reply.

How long

Online play: the messages are relayed live and not stored by us. Statistics: aggregate figures only (IP address and browser at most 8 hours in server memory). Server logs at Supabase and GitHub: briefly, as set out in their policies. E-mails: deleted when the matter is closed. Data on your device: until you delete it.

Your rights

You have the right of access, rectification, erasure, restriction, data portability and to object (GDPR Art. 21). Write to kontakt@stop60.no.

You can also complain to a data protection authority: Datatilsynet (Norway), UODO (Poland, Prezes Urzędu Ochrony Danych Osobowych) or the authority where you live, e.g. the ICO (UK).

Children

The game asks for no names, contact details or other personal data, so children can play it too. If you think a child has sent us personal data (e.g. by e-mail), write to us and we will delete it.

Changes

If the game starts to process data differently, we will update this page and the date at the top before the change takes effect.

Contact

kontakt@stop60.no