Volkalca – Privacy policy
Who is responsible
Operator (controller): Peter Lukan, [email protected]. Write to this address for any question or request about your data.
Playing offline
Games against the computer, your settings, statistics, achievements and daily streak are stored only on your device (browser or app storage) and are never sent anywhere. Nothing is sent to the Volkalca server until you use online play (open “Play online” or an invite link). The iOS and Android apps load ads from Google also when you play against the computer; see “Ads and purchases (iOS and Android apps)” below.
What the server stores when you play online
- A random player id and a name generated from a word list (adjective, animal and number). You cannot type a name, so no text you write is stored.
- The SHA-256 hash of your access token. The token itself stays on your device and lets the app reconnect as you.
- Your online games: the rules, the move timer, the two players' ids and generated names, the status, the result, how the game ended and when it was created, started and finished.
- The moves of each online game (the points on the board, which side moved and when).
What the Volkalca server does not collect
No accounts, no e-mail addresses, no phone numbers, no location, no contacts, no advertising identifiers, no analytics or tracking, no cookies, no device or browser details. Nothing about ads or purchases is ever sent to the Volkalca server. Your IP address is used only briefly in the server's memory to limit abuse (rate limiting); it is never stored or written to a log. The website sets no cookies, shows no ads and makes no requests to third parties. The apps contact third parties only for ads (Google) and for the purchase (Apple or Google), as described below.
Ads and purchases (iOS and Android apps)
- Where ads appear. The iOS and Android apps show full-screen ads from Google AdMob, only when you start a new game against the computer after finished games, never during a game. There are no ads on the website and none in online play.
- What Google processes. To choose, deliver and measure ads and to prevent fraud, the Google Mobile Ads SDK in the app sends data directly to Google: the advertising identifier of your device (where available), your IP address (from which your approximate location can be estimated), device and app information (such as the device model, operating system, language and app performance) and how you interact with the ads. Google processes this data under its own responsibility and its own policies, and may process it outside the EU, for example in the USA. How Google uses data from apps that show its ads: policies.google.com/technologies/ads. The operator of Volkalca does not receive this data, apart from aggregated ad reports from Google that identify no one.
- Your consent (EU, EEA, UK and Switzerland). Before any ad is requested, the app shows Google's consent form. Personalised ads are shown only if you agree; storing and reading information on your device for ads follows your choices in that form. If you decline, ads are still shown, but they are not personalised (non-personalised ads are chosen by context; Google may still use some data, for example to limit how often an ad appears, to count ads and to prevent fraud). Where Google's consent form is not required (outside the EEA, UK and Switzerland), no consent is asked: ads on Android may be personalised unless you reset or delete the advertising ID or opt out of personalised ads in the Android settings; on iOS, personalised ads additionally require your permission in the tracking prompt.
- Tracking question (iPhone and iPad). The app asks with Apple's prompt whether ads may use your device's advertising identifier to track you across apps and websites of other companies. If you choose “Ask App Not to Track”, the identifier is not available and the app requests only non-personalised ads.
- Changing your choices. In the app: Settings → “Privacy options for ads” (shown where the consent form applies). On iOS: Settings → Privacy & Security → Tracking. On Android: for example Settings → Privacy → Ads, or Settings → Google → Ads on many devices (the path differs by manufacturer); there you can delete or reset the advertising ID. You can withdraw your consent at any time; this does not affect processing before the withdrawal.
- On your device. To space the ads, the app stores on your device how many games you finished, when the last ad was shown and whether ads are removed. This stays on the device.
- Remove ads. A one-time in-app purchase removes the ads. The purchase is handled entirely by Apple (App Store) or Google (Google Play) under their terms and privacy policies; Volkalca receives no payment data and stores nothing about the purchase on any server. The app only asks the store on your device whether you own it. The purchase belongs to your Apple or Google account and can be restored on another device of the same platform with “Restore purchases” in Settings. After the purchase the app shows no ads and no longer asks for ad consent or tracking.
Why, and on what basis
The data on the Volkalca server is used only to run the online games you choose to play: to match you with an opponent, to check and deliver moves, and to let you reconnect. The legal basis is the provision of the service you request (Article 6(1)(b) GDPR). The brief, in-memory use of your IP address to limit abuse is based on the legitimate interest in protecting the service and its players (Article 6(1)(f) GDPR). The data on the Volkalca server is not sold, not used for advertising or profiling and not shared with anyone, except the hosting provider that runs the server for the operator.
In the apps, where Google's consent form applies, personalised ads and the storing and reading of information on your device for ads are based on your consent (Article 6(1)(a) GDPR), which you give or refuse in Google's consent form and can withdraw at any time. Showing non-personalised ads to finance the free app is based on the legitimate interest of the operator (Article 6(1)(f) GDPR). The purchase is processed by Apple or Google under their own terms and privacy policies; the app only checks on your device that you own it, to provide what you bought (Article 6(1)(b) GDPR).
How long it is kept
- Finished games and their moves: 30 days after the game ends. Unanswered invites: 24 hours.
- Players: removed after one year (365 days) without playing online.
Deleting your data
In the app, open “Play online”, then “Privacy: what is stored”, and press “Delete my online data”. Your player record is deleted at once (your token stops working), a game in progress is forfeited and a waiting invite is removed. Finished games stay on the server without your player id or name until their 30 days are over. The next time you open online play you get a new identity. You can also ask the operator to delete your data; please include your player name.
Your rights
You may ask for access to, correction or erasure of your data, restriction of processing and data portability, you may object to processing, and you may withdraw a consent at any time. For the data Google processes for ads, you can also contact Google (see its policies above). You also have the right to lodge a complaint with the supervisory authority: Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia), Dunajska cesta 22, 1000 Ljubljana, Slovenia, [email protected], www.ip-rs.si.
Changes
If this policy changes, the new version is published at this address with a new date.
Volkalca – Politika zasebnosti
Kdo je odgovoren
Upravljavec: Peter Lukan, [email protected]. Na ta naslov piši za vsa vprašanja in zahteve glede svojih podatkov.
Igranje brez povezave
Igre proti računalniku, nastavitve, statistika, dosežki in dnevni niz so shranjeni samo v tvoji napravi (v shrambi brskalnika ali aplikacije) in se nikamor ne pošiljajo. Strežnik Volkalca ne dobi ničesar, dokler ne uporabiš spletne igre (ne odpreš »Igraj na spletu« ali povezave za povabilo). Aplikaciji za iOS in Android nalagata oglase od Googla tudi med igranjem proti računalniku; glej spodaj »Oglasi in nakupi (aplikaciji za iOS in Android)«.
Kaj strežnik shrani pri spletni igri
- Naključno številko igralca in ime, sestavljeno iz besed s seznama (pridevnik, žival in število). Imena ne moreš vpisati, zato se ne shrani nobeno besedilo, ki bi ga napisal.
- Zgoščeno vrednost SHA-256 tvojega dostopnega žetona. Sam žeton ostane v tvoji napravi in aplikaciji omogoča, da se znova poveže kot ti.
- Tvoje spletne igre: pravila, časovnik potez, številki in imeni obeh igralcev, stanje, izid, način konca igre ter čas nastanka, začetka in konca.
- Poteze vsake spletne igre (točke na plošči, katera stran je naredila potezo in kdaj).
Česa strežnik Volkalca ne zbira
Ni uporabniških računov, e-poštnih naslovov, telefonskih številk, lokacije, stikov, oglaševalskih identifikatorjev, analitike ali sledenja, piškotkov ali podatkov o napravi in brskalniku. Strežnik Volkalca nikoli ne dobi ničesar o oglasih ali nakupih. Tvoj naslov IP strežnik le za kratek čas uporabi v pomnilniku za omejevanje zlorab; nikoli ga ne shrani in ne zapiše v dnevnik. Spletna stran ne nastavlja piškotkov, ne prikazuje oglasov in ne pošilja zahtev tretjim osebam. Aplikaciji se s tretjimi osebami povezujeta samo zaradi oglasov (Google) in nakupa (Apple ali Google), kot je opisano spodaj.
Oglasi in nakupi (aplikaciji za iOS in Android)
- Kje so oglasi. Aplikaciji za iOS in Android prikazujeta celozaslonske oglase Google AdMob, in sicer samo, ko po končanih igrah začneš novo igro proti računalniku, nikoli med igro. Na spletni strani ni oglasov, prav tako jih ni pri spletni igri.
- Kaj obdeluje Google. Za izbiro, prikaz in merjenje oglasov ter za preprečevanje goljufij Googlov oglasni SDK v aplikaciji pošilja podatke neposredno Googlu: oglaševalski identifikator naprave (če je na voljo), naslov IP (iz katerega je mogoče oceniti tvojo približno lokacijo), podatke o napravi in aplikaciji (na primer model naprave, operacijski sistem, jezik in delovanje aplikacije) ter podatke o tem, kako se odzivaš na oglase. Google te podatke obdeluje na lastno odgovornost in po svojih pravilnikih ter jih lahko obdeluje tudi zunaj EU, na primer v ZDA. Kako Google uporablja podatke iz aplikacij, ki prikazujejo njegove oglase: policies.google.com/technologies/ads. Upravljavec aplikacije Volkalca teh podatkov ne prejme, razen zbirnih poročil o oglasih, iz katerih ni mogoče nikogar prepoznati.
- Tvoja privolitev (EU, EGP, Združeno kraljestvo in Švica). Preden aplikacija zahteva kateri koli oglas, prikaže Googlov obrazec za privolitev. Prilagojeni oglasi se prikazujejo samo, če se s tem strinjaš; shranjevanje podatkov v napravi in branje iz nje za namene oglasov sledi tvojim izbiram v tem obrazcu. Če privolitev zavrneš, se oglasi še vedno prikazujejo, vendar niso prilagojeni (neprilagojeni oglasi so izbrani glede na vsebino; Google lahko vseeno uporabi nekatere podatke, na primer za omejitev, kako pogosto se oglas prikaže, za štetje oglasov in za preprečevanje goljufij). Kjer Googlov obrazec za privolitev ni potreben (zunaj EGP, Združenega kraljestva in Švice), privolitve ne zahtevamo: oglasi v sistemu Android so lahko prilagojeni, razen če oglaševalski ID ponastaviš ali izbrišeš ali prilagojene oglase izklopiš v nastavitvah sistema Android; v sistemu iOS je za prilagojene oglase dodatno potrebno tvoje dovoljenje v pozivu za sledenje.
- Vprašanje o sledenju (iPhone in iPad). Aplikacija te z Applovim pozivom vpraša, ali smejo oglasi uporabiti oglaševalski identifikator tvoje naprave za sledenje v aplikacijah in na spletnih straneh drugih podjetij. Če sledenje zavrneš, identifikator ni na voljo in aplikacija zahteva samo neprilagojene oglase.
- Kako spremeniš izbire. V aplikaciji: Nastavitve → »Možnosti zasebnosti za oglase« (prikazano tam, kjer velja obrazec za privolitev). V sistemu iOS: Nastavitve → Zasebnost in varnost → Sledenje. V sistemu Android: na primer Nastavitve → Zasebnost → Oglasi ali na mnogih napravah Nastavitve → Google → Oglasi (pot se razlikuje glede na proizvajalca); tam lahko oglaševalski ID izbrišeš ali ponastaviš. Privolitev lahko kadar koli prekličeš; to ne vpliva na obdelavo pred preklicem.
- V tvoji napravi. Da so oglasi dovolj narazen, aplikacija v tvoji napravi shrani, koliko iger si končal, kdaj je bil prikazan zadnji oglas in ali so oglasi odstranjeni. Ti podatki ostanejo v napravi.
- Odstranitev oglasov. Oglase odstraniš z enkratnim nakupom v aplikaciji. Nakup v celoti izvede Apple (App Store) ali Google (Google Play) po svojih pogojih in pravilnikih o zasebnosti; Volkalca ne prejme nobenih plačilnih podatkov in o nakupu ne shrani ničesar na nobenem strežniku. Aplikacija samo v napravi vpraša trgovino, ali nakup imaš. Nakup pripada tvojemu računu Apple ali Google in ga lahko na drugi napravi iste platforme obnoviš z gumbom »Obnovi nakupe« v nastavitvah. Po nakupu aplikacija ne prikazuje več oglasov in ne sprašuje več za privolitev za oglase ali za sledenje.
Zakaj in na kateri podlagi
Podatke na strežniku Volkalca uporabljamo samo za delovanje spletnih iger, ki jih izbereš: za iskanje nasprotnika, preverjanje in prenos potez ter ponovno povezavo. Pravna podlaga je izvajanje storitve, ki jo zahtevaš (člen 6(1)(b) GDPR). Kratkotrajna uporaba tvojega naslova IP v pomnilniku za omejevanje zlorab temelji na zakonitem interesu za zaščito storitve in igralcev (člen 6(1)(f) GDPR). Podatkov s strežnika Volkalca ne prodajamo, ne uporabljamo za oglaševanje ali profiliranje in jih ne delimo z nikomer, razen s ponudnikom gostovanja, ki za upravljavca poganja strežnik.
V aplikacijah tam, kjer velja Googlov obrazec za privolitev, prilagojeni oglasi ter shranjevanje podatkov v napravi in branje iz nje za namene oglasov temeljijo na tvoji privolitvi (člen 6(1)(a) GDPR), ki jo daš ali zavrneš v Googlovem obrazcu za privolitev in jo lahko kadar koli prekličeš. Prikazovanje neprilagojenih oglasov za financiranje brezplačne aplikacije temelji na zakonitem interesu upravljavca (člen 6(1)(f) GDPR). Nakup obdelata Apple ali Google po svojih pogojih in pravilnikih o zasebnosti; aplikacija v tvoji napravi samo preveri, ali nakup imaš, da ti zagotovi, kar si kupil (člen 6(1)(b) GDPR).
Kako dolgo jih hranimo
- Končane igre in njihove poteze: 30 dni po koncu igre. Neodgovorjena povabila: 24 ur.
- Igralce izbrišemo po enem letu (365 dneh) brez spletnega igranja.
Brisanje podatkov
V aplikaciji odpri »Igraj na spletu«, nato »Zasebnost: kaj se shrani« in pritisni »Izbriši moje spletne podatke«. Tvoj zapis igralca se takoj izbriše (žeton preneha delovati), igra v teku se šteje kot predana in čakajoče povabilo se odstrani. Končane igre ostanejo na strežniku brez tvoje številke in imena, dokler ne poteče 30 dni. Ko naslednjič odpreš spletno igro, dobiš novo identiteto. Izbris lahko zahtevaš tudi pri upravljavcu; navedi svoje ime igralca.
Tvoje pravice
Zahtevaš lahko dostop do svojih podatkov, njihov popravek ali izbris, omejitev obdelave in prenosljivost, ugovarjaš obdelavi in kadar koli prekličeš dano privolitev. Glede podatkov, ki jih za oglase obdeluje Google, se lahko obrneš tudi na Google (glej njegove pravilnike zgoraj). Imaš tudi pravico do pritožbe pri nadzornem organu: Informacijski pooblaščenec Republike Slovenije, Dunajska cesta 22, 1000 Ljubljana, [email protected], www.ip-rs.si.
Spremembe
Če se politika spremeni, je nova različica z novim datumom objavljena na tem naslovu.