Privacy policy

Who looks after your data

The operator and data controller is a private individual running Mastíme on a non-commercial basis. Contact: [email protected].

What data and why

• Guest: the player name you choose and a random identifier. We need no e-mail or anything else from you.
• Account: your e-mail, player name and password, which we store only in an irreversibly encrypted form. When you sign in with Google, Google gives us your name, e-mail, a link to your profile picture, your Google account identifier and sign-in tokens; we never see your Google password.
• Games: results of finished games (game, placement, number of players, time and game totals) for your statistics, the players you saved as friends, the table settings you chose as a host, and the app language if you picked one.
• Table chat and reactions are only delivered to the players at the table. We never store them.
• Technical logs: time, page address and the outcome of a request, and the player identifier during a game. They help us fix errors and prevent abuse. We do not write IP addresses or e-mails into them.
• The server keeps your IP address in memory only briefly to limit repeated sign-in attempts. It is not stored anywhere.

We process game and account data to provide the game you chose (performance of a contract, Art. 6(1)(b) GDPR). Technical logs and abuse prevention are our legitimate interest in a safe, working app (Art. 6(1)(f) GDPR). We do no automated decision-making or profiling.

What other players see

Players at your table and in the list of public tables see your player name. Players you meet can view your game statistics. Nobody else sees your e-mail.

Cookies and browser storage

We use only what the app needs to work or what remembers your own settings. That is why we need no consent and show no cookie banner.

• Cookie __Secure-better-auth.session_token: keeps you signed in, also as a guest. Valid for 400 days and extended on every visit.
• Cookie __Secure-better-auth.state: protects Google sign-in against forgery. Valid for 5 minutes.
• Cookie locale: the app language you picked, or the one we guessed on your first visit. Valid for 1 year.
• Browser storage (durak-… keys): sound and volume, vibration, the last game you picked, a guest’s table settings, tips already seen and a snoozed install offer. They stay until you delete them.
• App cache (service worker): the app’s files, so it loads fast and shows a page even offline. It holds no personal data.

Cloudflare, which the app runs through, may set its own security cookie (such as __cf_bm) on suspicious traffic. It is used only for protection.

Who we share data with

The app runs on the operator’s own server. We sell data to no one. Only these providers help us:

• Cloudflare, Inc. delivers the site, encrypts the connection and protects against attacks. In doing so it sees your IP address and the data transferred. It processes them on our instructions under a data processing agreement.
• Google Ireland Limited and Google LLC, only if you choose to sign in with Google. Google confirms your identity and decides about its own account data under its own policy.

Cloudflare and Google may process data outside the EU, mainly in the USA. Both are certified under the EU–US Data Privacy Framework and use the standard contractual clauses approved by the European Commission.

How long

• We keep your account and everything in it until you delete it.
• A guest is deleted automatically when its sign-in expires, that is after 400 days without a visit. Clearing the site’s data in your browser loses the guest at once and for good.
• Expired sign-ins are deleted daily.
• Technical logs are capped at 30 MB; older entries are overwritten continuously and deleted with every app update.
• After you delete your account, only an anonymous record that a game was played (game, number of players and time) remains, with no link to you.

Your rights

• Access and portability: download all your data at once in your profile (the Download my data button).
• Rectification: change your name in your profile; we correct anything else on request.
• Erasure: delete your account with one button in your profile (Delete account).
• Restriction of processing and objection to processing based on legitimate interest.
• Complaint to a supervisory authority: in Czechia the Úřad pro ochranu osobních údajů (uoou.gov.cz), in Slovakia the Úrad na ochranu osobných údajov SR (dataprotection.gov.sk), or the authority where you live.

For anything else write to [email protected]. We reply without undue delay, within one month at the latest.

Children

Anyone can play as a guest; a guest gives us no contact details. You can create an account from the age of 16 (15 in Czechia), younger players only with a parent’s consent. If we learn that a younger child created an account without a parent’s consent, we delete it.

Security

The connection is encrypted, passwords are stored only in an irreversibly encrypted form and the sign-in cookie is out of reach of scripts on the page. Only the operator has access to the data.

Changes

When we change this policy, we publish the new version here with its effective date. We announce important changes in the app.