Privacy notice

Yannick Rodrigo, Heikendorfer Weg 50, 24149 Kiel, Germany. E-mail: user7464193044891041@protonmail.com. Phone: 01578 9064933.

This notice covers the website forgottenwordsgame.com, the public game server play.forgottenwordsgame.com, and what the game itself does on your PC.

If you play on a server someone else runs, for example a friend's table over Radmin VPN, that host is responsible for what their server keeps. Their server receives the same kinds of data as described in section 3.

The website, its downloads and the public game server run on a server rented from Contabo GmbH, Munich, Germany, in a data centre in Lauterbourg, France, run by Contabo France SAS. Contabo processes data only on my behalf, under a data processing agreement (Art. 28 GDPR).

When you open a page or a download, your browser sends its IP address, the address of the page, the time, and its own name and version. The web server uses them only to send you the page or file, and does not keep them. Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in delivering the website.

To know how often the website is used, the web server notes each request without any of that: only the time, the page or file asked for (without anything added after a question mark), whether it was sent, and its size. Your IP address, your browser's name, the page you came from and every other detail of the request are removed before anything is written. These notes are counted into daily totals per page and per download. Nothing in them points to you, so they are not personal data, and nothing is stored on your device.

The website sets no cookies, runs no scripts, and uses no tracking, advertising or content from other sites: its fonts, pictures and the trailer all come from this server.

The domain's name servers are run by Cloudflare, Inc. They only answer which address the name belongs to; the website's and the game's traffic does not pass through them.

The "Support the game" link opens ko-fi.com only when you click it. From there, Ko-fi's own privacy policy applies.

Connecting. To play, the game connects to the server, and the server receives your IP address and port with every message. The game uses them only to answer you: it does not store, log or print them, and they are gone when you disconnect. A connection that sends far too much too fast is closed; that check, too, works only in memory. Legal basis: Art. 6(1)(b) GDPR, providing the game you chose to play.

Your account. The first time you connect, the server makes an account for you and gives your game a key, which is saved only on your PC. The server keeps a fingerprint of the key, never the key itself. There is no password, and the game never asks for your e-mail address or your real name. Your account holds:

• a random account number;
• the name and look you choose (icon, card back, Health bar);
• your collection, your decks and their names, and your packs, with the date and time each was opened;
• your progress in the Journey and its records, with dates;
• your friends and friend requests, with their dates (an unanswered request lapses after 30 days);
• words you typed into the game that it recognised as game words (at most 1,000; never chat);
• for a reward earned together with another player, that player's name and look and the date (it is kept in both players' accounts).

Legal basis: Art. 6(1)(b) GDPR, providing the game.

What other players see. In a duel: your name and look, the cards you play, your chat messages and whether you are away. Your friends also see whether you are online or in a duel. Anyone you give your friend code can send you a friend request and sees your name with it. Other players never see your IP address or your account number: everything goes through the server.

Chat is passed on to your opponent and is not stored on the server.

Duel statistics. For every finished duel between two players matched by the server, it records the time, both decks, the cards played and the result, without account numbers or names. They are used to balance the cards and are kept without a time limit. Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in a balanced game.

Server log. The server writes down what it does (for example which two accounts a duel room holds, a duel's end, errors), with account numbers but no names, chat or IP addresses. It is used to find faults and abuse and is deleted after 14 days. For that time it could tie a duel record to the two accounts. Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in a working and safe server.

Custom cards. When you check a card in the Card Maker, its text and effects are sent to the server, which checks them and keeps nothing; your pictures stay on your PC (only their size is sent). Cards the host adds to the server, pictures included, are sent to every player.

How long. Your account is kept as long as the public server runs, or until you ask me to delete it (section 6). When the public server is shut down for good, all accounts and logs are deleted.

The game keeps its files in %APPDATA%\Godot\app_userdata\Forgotten Words on your PC:

• session.cfg: your account key for each server. It is your account: back it up, and never send it to anyone;
• your settings and your notebook;
• replays of your last 20 duels, with your opponents' names and the chat;
• bug reports you write (F8). They hold your PC's system details (Windows version, processor, graphics card) and the duel's history, and stay on your PC unless you send one yourself;
• custom cards, and pictures the servers you play on sent to your game.

The game sends nothing anywhere but to the server you connect to: no telemetry, no analytics, no update checks, no crash reports. It opens a web page (Ko-fi, or this notice) only when you press that button.

If you write to me or call, I use your message and your address or number to answer you, and delete them when the matter is settled. Legal basis: Art. 6(1)(b) and (f) GDPR. E-mail reaches me through Proton AG, Geneva, Switzerland, a country the EU recognises as protecting personal data adequately.

Contabo (hosting) and Proton (e-mail) process data on my behalf. Other players see what section 3 lists. Nothing is sold or passed on to anyone else, and no data leaves the EU except e-mail through Switzerland.

You have the right of access (Art. 15 GDPR), to correction (Art. 16), to deletion (Art. 17), to restriction (Art. 18), to receive your data (Art. 20), and to object to processing based on a legitimate interest (Art. 21). You can complain to a data protection authority (Art. 77), for example the one responsible for me: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany.

To use these rights, write to user7464193044891041@protonmail.com with your friend code (on the Friends page) and your account number: the account_id line in session.cfg. Never send the token line: it is your key. You can change your name in Customize at any time.

The game cannot connect without your IP address, and cannot keep your progress without an account: without them you cannot play online. Nothing is decided about you automatically; matchmaking only pairs players who are both searching for a duel.

When the game or the server changes what they keep, this notice changes with them. The date at the top says when it last did.