Privacy policy

Last updated: 20 October 2026 (feedback form added)

1. Controller

Lukas Müllner, StackTeam, Unterer Winkel 11, 7546 Moschendorf, Austria
E-mail: hello@stackteam.at

2. In short

• No tracking, no analytics, no ads, no third-party content (fonts are served from our own server).
• As a guest, your progress stays in your browser.
• With an account we only store what the game needs: account name, password hash and your game results.
• The only cookie is the technically necessary login cookie – so there is no cookie banner.

3. Hosting and server logs

The game runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (processor). When you visit, the server necessarily processes your IP address, time, requested address and browser identifier. Access logs are kept for secure operation and deleted after 30 days at the latest. To prevent abuse (e.g. password guessing), IP addresses are also counted briefly in memory and not stored permanently. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

4. Playing as a guest

Without an account, no game data is sent to us. Settings (language, sound, graphics), your display name, stars, local results, campaign and puzzle progress and a random browser identifier (prevents two tabs from being matched against each other in quick play) are kept in your browser's local storage. You can delete them at any time in your browser settings.

Online duels (also as a guest): for the duration of a duel we store both players' display names, the moves and the clock. The duel is deleted at the latest 10 minutes after it ends; an invitation nobody accepts after 24 hours. Legal basis: Art. 6(1)(b) GDPR (providing the game you requested).

5. Player account

If you create an account, we store:

• account name, password (only as a scrypt hash, never in plain text) and registration date,
• login sessions (only as a hash of the token) with expiry date,
• results per map (gold, time), map ratings (1–5 stars) and your progress (stars, gold, lands per map and campaign station),
• glory (Elo rating) and the number of rated duels,
• friendships and friend requests.

Visible to others: your account name appears with your result in leaderboards (maps, daily map, hall of glory) and to duel opponents. Friends can see whether you are online. With “Appear anonymously in leaderboards” in your profile, public leaderboards show only “Anonymous player” instead of your name and picture; friends and duel opponents still see your name.

Legal basis: Art. 6(1)(b) GDPR (using the game with an account). You can create an account from the age of 14; younger players need their parents' consent.

6. Feedback form

Via “Feedback” in the game you can write to us. We receive the type (bug, idea, praise, other), your message, optionally a contact detail and the technical details shown on the page (map, mode, language, screen size, browser identifier). To prevent spam, a captcha (“Cap”) on our own server checks that a human is sending; your browser solves a small computing task, and Cap sees your IP address. The message is stored as an entry in our own, non-public project system (Forgejo, git.stackteam.at) until it has been handled; on request we delete it right away. Legal basis: Art. 6(1)(f) GDPR (handling feedback, preventing abuse), for the contact detail your consent (Art. 6(1)(a) GDPR).

7. Cookies and local storage

With an account, the server sets a login cookie (hd_session, HttpOnly, first-party only, 30 days; without “Stay signed in” only until you close the browser, at most one day on the server). It is technically necessary to keep you logged in. Local storage (see section 4) and the app's offline cache (service worker) are also used only for the game. There are no third-party cookies.

8. Retention

• Account data and results: until you delete your account.
• Login sessions: 30 days (without “Stay signed in”: one day) or until you log out.
• Duels: see section 4.
• Database backups: the last 14 backups; deleted data disappears with the oldest backup at the latest.

9. Recipients

Your data is not sold or passed on to third parties. The only recipient is the hosting provider as processor (servers in Germany, no transfer to third countries).

10. Your rights

You can delete your account with all its data at any time yourself: tap your name in the game selection → “Delete account”. You also have the right of access, rectification, erasure, restriction of processing, data portability and objection. Write to hello@stackteam.at and include your account name; for security we may ask for a confirmation from within the account. You can also lodge a complaint with the Austrian data protection authority (Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at).

11. Changes

If the game changes, we will update this policy. The version published here applies.

Legal notice