Privacy policy
Last updated: 12 September 2026
1. Controller
The controller for data processing on this website is:
Yannick Lutz
Dachauer Straße 435
80992 München
Deutschland
Email: info@kowalski.games
2. What data we process
2.1 When you open the site
When you visit the site, the hosting provider automatically processes access data: IP address, time of the request, the address requested, the amount of data transferred, browser type and operating system. This data is technically required to deliver the site and serves the security of its operation.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and uninterrupted operation).
2.2 When you register an account
For a user account we process:
- Email address (for signing in and confirming the account)
- Password (stored in encrypted form only)
- Display name (visible to other players)
- Time of registration and of the last sign-in
- The language you chose (in a strictly necessary cookie, so the site appears in that language on your next visit)
The legal basis is Art. 6(1)(b) GDPR (performance of the terms of use). During registration you expressly confirm that you have read this policy.
2.3 When you play
Games played are stored: the accounts involved, the game settings, every move, the thinking times and the result. Ratings and game history are derived from this. Some of this information is visible to other users.
The legal basis is Art. 6(1)(b) GDPR.
2.4 Moderation and unlocks
If an account breaks the rules, it can be warned or suspended. The reason, the period and an internal note are stored for this. The affected user is shown the reason and the end of the suspension, but not the internal note. An account can also be granted access without payment; in that case the scope, an expiry date and the reason are stored. IP addresses are not stored for this.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in fair play) together with Art. 6(1)(b) GDPR.
3. Cookies
The site sets strictly necessary cookies only. They keep you signed in beyond a single page view and remember the language you chose. No cookies are set for analytics or advertising, and no audience measurement takes place. For that reason there is no cookie banner.
The legal basis is § 25(2) no. 2 TDDDG (the German implementation of the ePrivacy Directive).
4. Service providers we use
Data processing agreements under Art. 28 GDPR are in place with the following providers.
4.1 Hosting: Vercel
The site runs on Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes the access data described in 2.1. Transfer to the USA is possible; the basis for this is the European Commission's Standard Contractual Clauses.
Privacy policy: vercel.com/legal/privacy-policy
4.2 Database and sign-in: Supabase
Accounts, profiles, games and moves are held by Supabase, Inc., 970 Toa Payoh North, Singapur. The project used for this site is located in the region Ireland (eu-west-1), so the data is stored inside the European Union. Supabase also sends the confirmation and password emails.
Privacy policy: supabase.com/privacy
4.3 Fonts
The fonts used are served from our own server. No connection to Google or any other third party is made, and no IP address is transmitted to third parties.
5. How long we keep data
Account data is stored for as long as the account exists. You can delete your account yourself at any time — the button is in your account under “Delete account”. This irreversibly removes your email address, your password and your profile including the display name. Warnings, suspensions and unlocks for your account are deleted as well.
The games you played are kept in anonymised form: the link to your account is removed, the moves and the result remain. The reason is that every game is also your opponent's game — deleting it would take away their own game history and the basis of their rating. After deletion, such a game can no longer be traced back to you.
Access data from opening the site (section 2.1) is stored by the hosting provider for the period stated in its own privacy policy; we do not evaluate it and do not store it additionally.
6. Your rights
You have the right to
- access to the data stored about you (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- object to processing (Art. 21 GDPR)
Please use the email address given above. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for the controller of this site is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Deutschland
www.lda.bayern.de
You may also contact the supervisory authority of your own country or of your habitual residence.
7. Changes
This policy will be adapted if the processing changes — for example when a subscription with payment processing is added. The payment provider will then have to be listed here as well.