In short: Kreisle has no accounts, no ads, no cookies and no tracking across other websites. Your game is stored on your device. The exceptions are below: the website's statistics, the duel in the browser, the duel and Game Center in the iOS app, and the check for a new version. The German version is the binding one.
Robert Spicker
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Germany
Email: hello@kreisle.app
The site is served by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. This creates the server logs that are technically necessary: IP address, time, the address requested, browser identification. The legal basis is Art. 6(1)(f) GDPR, my legitimate interest in running the site securely. The transfer to the USA relies on the European Commission's standard contractual clauses.
Kreisle counts page views with Vercel Web Analytics: the page, the page you came from, country, device type, browser and operating system. No cookies are set and nothing is stored on your device; Vercel recognizes a returning visit only by a value computed from the request and discarded after 24 hours. I only see totals, never individual visitors.
Kreisle also counts how often per day a daily puzzle was started, solved or not solved, a practice round played, a result shared, a duel started, finished or given up and a duel notification turned on. Only the daily total is stored, with no identifier, no IP address and nothing on your device, at Upstash (Upstash, Inc., USA) in Frankfurt, and deleted after a little over a year. Legal basis and transfer as above.
The website keeps today's round, whether you have seen the instructions and your recent duels in your browser's local storage. I cannot see this data; what a duel sends is under "Duels in the browser". You delete it by clearing the site data in your browser.
A duel in the browser (kreisle.app/en/duel, in German kreisle.app/duell) needs a place where both sides see the same state. So the duel's state (game and level, the questions, the answers and points given, and whether someone gave up) is stored with Vercel (see above) in Frankfurt, under a random identifier that only appears in the duel's link. Names, phone numbers and IP addresses are not part of it. Anyone with the link can see the duel and play on, so share it only with your opponent. The legal basis is Art. 6(1)(b) GDPR, because you start or accept the duel yourself. Duels not changed for 30 days are deleted automatically.
You can ask to be notified when it is your turn. Only if you choose this and allow notifications in your browser is your browser's notification address (Web Push) stored with the duel, together with a note that the notification should be in English. It is delivered through your browser maker's push service, such as Google, Mozilla, Apple or Microsoft, also in the USA; the content is encrypted and only says that it is your turn or that the duel is over. The provider's privacy terms apply to the delivery. The legal basis is Art. 6(1)(a) GDPR, your consent. You withdraw it by turning off notifications for kreisle.app in your browser. The address is deleted automatically 30 days after it was stored.
In the app, your game and statistics stay on your device and in its backups. If you are signed in to Game Center, the app sends Apple your streaks, the number of puzzles solved, your achievements and, after the daily puzzle, its number, your number of guesses and the places you guessed, so your Game Center friends can see them (in the app only once they have finished the same puzzle). A duel in the app runs through Game Center's turn-based games: Apple stores the questions, answers and points, and your opponent sees them with your Game Center name. Apple Inc. is responsible for Game Center under itsprivacy policy; I receive no copy. You can object at any time by signing out of Game Center in the iOS settings.
At most every six hours the app asks Apple's public App Store directory which version of Kreisle is current, sending only the app's identifier and a country. A daily reminder, if you turn it on, is scheduled on your device; nothing is sent for it.
If you email me, I process your address and message to answer it. The address is a forward through the servers of the domain provider Porkbun LLC (USA). Legal basis is Art. 6(1)(f) GDPR. I delete the message once it is dealt with and nothing requires me to keep it.
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw any consent for the future. You can also complain to a data protection supervisory authority. An informal email to hello@kreisle.app is enough.