Datenschutzerklärung

Verantwortlicher (controller)

Felix Weber
Erich-Zeigner-Allee 34, 04229 Leipzig, Germany
Email: contact@mausi24.de

Playing without an account

You can play without signing up. While a game runs, its room (the four-letter code, the names you type, your guesses and scores) is kept in memory in our Redis database (Upstash). A room expires 30 minutes after the last activity and after 12 hours at most. Names in a room are visible to everyone in it.

Legal basis: Art. 6(1)(b) GDPR (providing the game you asked for).

Chat and voice chat

Text messages in a party go through our server to the other players and the big screen of that party, and are not stored: not in the room, not in a database, not in logs. Each device keeps the latest 50 messages in memory until the page is closed. If you mute someone just for you, that choice is kept in your browser (pinsquad-chat-mute: and the party code); pinsquad-voice-note remembers that you have read the note on voice chat.

Voice chat is optional and starts only when you press “Join voice”. It runs through LiveKit Cloud (LiveKit, Inc., USA): your browser sends your microphone audio to LiveKit’s servers, which pass it on to the others in the voice chat of your party. LiveKit processes your IP address, the audio while your mic is on, your player id in the party and the name you play under. The region of the LiveKit project is chosen when it is set up; where LiveKit offers it, we pick servers in the EU. Neither we nor LiveKit (with our settings) record the audio. Voice ends when you leave it, close the page or the host mutes you.

Legal basis: Art. 6(1)(b) GDPR (the voice chat you chose to join). Transfers to LiveKit in the USA are based on the EU–US Data Privacy Framework or the EU standard contractual clauses.

Anonymous usage counts

To decide what to improve, our server keeps simple daily counters in our Postgres database (Neon). Per day, they count how many games started and finished, how many rounds were played, and with which settings (format, map, preset, twists, movement, rounds, time), in which player-count range (for example 3–4), whether it was played in Couch mode (on a TV), and whether the game was rated.

Not stored: names, accounts, room codes, IP addresses, locations, guesses or scores. The counters use no cookies and no browser storage, and the smallest unit of time is a day. We keep them for two years. There is no third-party analytics.

These are anonymous, aggregated statistics. We do not use them to identify anyone and do not combine them with account data.

Accounts

If you sign up, we store in our Postgres database (Neon, region EU / Frankfurt):

• your email address and whether you confirmed it,
• your display name (public, shown to other players and in league tables),
• your password, only as a salted scrypt hash (we never store the password itself),
• when the account was created and when you last signed in,
• your leagues, ratings and the results of rated games,
• one-time tokens for email links (confirmation, password reset, email change, league invites), stored as hashes and deleted after they expire (1 hour to 14 days).

If you invite someone to a league by email, we store their address with the invitation until it expires (14 days) and send them one invitation mail.

Shirt prints you save are stored with your account. Prints you make public are visible to everyone in the gallery, together with your display name, and anyone may wear a copy. If you report a print, we store the report (and the reason, if you give one) with your account. Your prints and your reports are deleted together with your account.

When you delete your account, your name and email address are removed and you leave all leagues. Past results stay in league histories under an anonymous name.

Legal basis: Art. 6(1)(b) GDPR. Invitations: Art. 6(1)(f) GDPR (our users' interest in inviting friends).

Cookie

Signing in sets one cookie, __Host-gp_session. It holds a random session token (we store only its hash), is sent only to this site over HTTPS, can't be read by scripts and expires after 90 days or when you sign out. It is strictly necessary for staying signed in (§ 25(2) no. 2 TDDDG); without an account no cookie is set.

Storage in your browser

To let you rejoin a game after a reload, the site keeps these entries in your browser. They never leave your device except to rejoin the game they belong to, and you can delete them in your browser settings at any time.

• pinsquad-seat:<CODE> (localStorage): your seat in game <CODE> (player id and a rejoin token),
• pinsquad-host:<CODE> (localStorage): the host token, if you created game <CODE>,
• pinsquad-player (localStorage, couch mode phones): game code, player id, rejoin token and name,
• pinsquad-host (sessionStorage, couch mode TV): game code and host token, deleted when the tab closes.

More settings stay local only and are never sent to a server: gp.3d and gp.fps (localStorage), your “3D figures” and “120 fps” on/off choices, and the gp.portrait.* and gp.3dstep keys (sessionStorage), which cache small head-portrait images and the graphics step of this visit.

These settings are kept in your browser too: pinsquad-name (the name you last joined with), pinsquad-look (your figure, including a shirt print you drew), pinsquad-lang (English or German; a link with a language in it sets pinsquad-lang-visit for that tab only), pinsquad-sound (sound on or off) and pinsquad-print-public-seen (whether you have seen the note on public prints). Your name and figure are sent to the server when you join a party, because the other players see them. If you are signed in, your figure and your language are also saved on your account, so they apply on all your devices.

Legal basis: § 25(2) no. 2 TDDDG (strictly necessary for the game you started).

Abuse protection

To stop password guessing, spam sign-ups and mail floods, we count requests in our Redis database (Upstash). The counters are keyed by your IP address (for sign-in lockouts only by its network part: the first three blocks of an IPv4 address, the first four of an IPv6 address) or by a hash of the email address concerned. Each counter deletes itself when its time window ends, after 24 hours at the latest. Session lookups are cached there for 10 minutes.

Legal basis: Art. 6(1)(f) GDPR (keeping the service and its users' accounts safe).

Email

Account and invitation mails are sent through Resend (Resend, Inc., USA). Resend receives the recipient address and the content of the mail. We send only mails you triggered or that concern your account; there is no newsletter.

Hosting

The site runs on Vercel (Vercel Inc., USA; functions in the Frankfurt region). Each request is processed there, and Vercel keeps short-lived technical logs (such as IP address, time, requested URL and browser identification) to run and secure the service.

Legal basis: Art. 6(1)(f) GDPR (operating a secure website).

Maps and imagery

Google Maps / Street View. The guessing, result and home-turf maps, and in Street View rounds the panoramas, come from Google: your browser loads the Google Maps JavaScript API, the map tiles and the panoramas directly from Google (Google Ireland Limited / Google LLC, USA). Google receives your IP address and the usual browser data when they load. See Google's privacy policy.

Wikipedia photos. Photo rounds use pictures from Wikimedia Commons, but our server fetches them for you (and strips their metadata), so Wikimedia does not see your IP address.

The font and the map library are served from this site, not from third parties.

Legal basis: Art. 6(1)(f) GDPR (showing the places the game is about).

Recipients outside the EU

Vercel, Neon, Upstash, Resend and Google are based in or have parent companies in the USA. Data is transferred on the basis of the EU-US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses. Vercel, Neon, Upstash and Resend process data on our behalf (Art. 28 GDPR).

Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can change your email and password and delete your account yourself on the account page; for anything else write to contact@mausi24.de. You may also complain to a data protection supervisory authority, for example the one for Saxony (Sächsische Datenschutz- und Transparenzbeauftragte).