Duck Splash

Privacy Policy

Draft. This policy is still being reviewed and will be finalised before launch.

Who is responsible

taptonic GmbH, Alpenblick 10, 82237 Wörthsee, Germany, [email protected]. See the imprint for full details.

Hosting and delivery

The site is served from our own server [hosting provider, location]. Requests pass through Cloudflare, Inc. as a content delivery network, which processes your IP address and request data to deliver the page and protect it from attacks. [data processing agreement / transfer basis].

Our web server keeps technical log entries (IP address, time, requested page, browser) for [n] days to keep the service running and secure, then deletes them. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Cookies

We only set cookies that are strictly necessary: a session cookie, a security token against cross-site request forgery, and, if you choose “remember me”, a login cookie. We set no tracking or advertising cookies. Legal basis: § 25(2) TDDDG and Art. 6(1)(b) and (f) GDPR.

Visitor statistics

We count page views with Umami, which we host ourselves at uma.duckempire.com. Umami sets no cookies and stores no IP addresses or other data that identifies you; it only records the page, referrer, browser type, device type and country. Nothing is shared with third parties. Legal basis: legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR).

Your account

You can create an account to play with a persistent profile and appear on the leaderboard. We store your display name, email address, a hashed password if you set one, your two-factor settings if you enable them, and when you last visited. Your display name is public. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).

We send emails only for your account: address verification, password resets and security notices. [email delivery provider].

Signing in with Google, Steam, Discord or Reddit

If you sign in through one of these providers, you are sent to their site, and they tell us who you are once you agree. We store the provider's ID for your account, plus the name, email address and avatar they share with us, so we can recognise you next time. We receive no password. The provider learns that you signed in to Duck Splash; its own privacy policy applies to that:

Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR). [transfer basis for US providers].

Game stats and leaderboard

When you play Duck Splash, the game sends your match results and stats (for example matches played, wins and goals) to our server and links them to your account. We use them to show your stats and the public leaderboard, which lists your display name next to your results, and to detect cheating. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR). [retention period].

Error monitoring

If something breaks, technical error reports (including the affected page and, where relevant, your account ID) may be sent to [error monitoring provider] so we can fix the problem. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

How long we keep data

We keep your account data until you delete your account; you can ask us to do so at any time at the address above. [retention for game stats and backups].

Links to other sites

Links to Reddit, Steam, YouTube, X and Discord are plain links. Nothing is loaded from those sites until you click one; after that, their privacy policies apply.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection. Contact us at the address above. You can also lodge a complaint with a data protection supervisory authority, for us the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach.