Privacy notice

Goltrik is a game: someone hides a marble in one of two fists, you watch the hands and find it. To run it we keep a small amount of data, almost all of it about the game itself. This notice says what we keep, why, for how long, who helps us store it, and how you control it. It describes the app and the web page at goltrik.com.

The short version

You can try the starter tricks without giving us anything. To be on the weekly board, play ranked and publish, you sign up with your email: we send you a 6-digit code, there is no password.
Your data is stored in Frankfurt, Germany.
Other players see you only by a nickname you choose from word lists ("QuietFalcon"), never by your name. The only things you type are your email, the code and, if you like, your name, which only we see. Everything else is chosen from lists: no messages, no bios, no photos.
Your city is picked from a list, never from your phone's location. Sex is asked only of adults, is optional, and is never shown to anyone.
No ads. No ad tracking. We do not sell your data or share it for advertising.
The website sets no cookies.
You can delete your account in the app. You have 7 days to change your mind by signing in again.
Goltrik is for people aged 13 and over.

Who is responsible

The controller of your data is [OPERATOR NAME], [POSTAL ADDRESS].

Write to [PRIVACY EMAIL] about anything in this notice. We answer within one month.

[EU REPRESENTATIVE: only if the operator ends up established outside the EU (GDPR Art. 27); otherwise delete this line]

Where your data lives

The game's server and database run on Supabase in the European Union, in Frankfurt, Germany (region eu-central-1). The videos of the tricks are stored there too. If we later move the videos to a content network or add one of the services listed under Who helps us, the table there says so before it happens.

What we keep, feature by feature

Playing without an account

When you first open the app, the server creates a guest account for you. It is a random identifier, not your name, your email or your phone. The server gives the account a default handle of the form "player" followed by the first six characters of that random identifier, and a look built from the game's own parts (the sleeves, colours and table you can choose; never a photo).

On a guest account we keep your plays of the starter tricks and the Daily Five, the tricks you have reported or blocked, and your standing. A guest account that has not been used for 12 months is deleted automatically.

Signing up with your email

Ranked play, the boards and publishing your own tricks need an account. You sign up with your email address: we email you a 6-digit code, you type it into the app, and that is your sign-in. There is no password. We keep your email address to recognise you when you sign in again and to write to you about your account (never newsletters, unless you ask for them separately later). Our sign-in service keeps a log of sign-ins and code requests for security. Sign in with Apple or Google may be added beside the email later; if so, this notice says what they tell us first.

Your nickname

Other players see you by your nickname: on your tricks, on the boards and in the share message when you send a trick. You choose it from word lists we wrote (an adjective and a noun, such as "QuietFalcon"); you cannot type one. Until you choose, your nickname is "player" followed by six characters of your account id. Every nickname is unique, and the lists are checked against a list of blocked words. A moderator may rename a nickname that breaks the community guidelines, and you are told why.

Your profile

After you sign up, the app asks for a few details. Each one says who sees it:

Your name. For us and our support only, to know who we are talking to when you write to us. It is never shown to other players, on any board, share or trick. You may leave it out or delete it.
Your city. You pick it from a list of cities (the GeoNames list of places with 15,000 people or more); the app never reads your location. It is shown next to your nickname on the weekly board and makes the city tab of that board possible. You may leave it out or delete it, and then you are on the "everyone" tab only.
Sex. Asked only if you told us you are 18 or over, and optional, with "prefer not to say". It is never shown to anyone and is used only for our own statistics about who plays (for example how many players are women). If your age range later changes to under 18, it is deleted.
When you finished your profile. So the board can show only players who have.

The weekly board

The weekly board starts again every Monday at midnight (Berlin time). You appear on it after your first ranked play of the week, once your profile is finished. It shows your nickname, your city, how many ranked tricks you found that week (one point each) and how many you played. All signed-in players can see it, on two tabs: everyone, and one city. A player you blocked is left out of what you see. We keep your weekly score for this week and the last one, then delete it.

Playing a trick

When you play a trick we record: which trick, where it was served from (ranked, starter, Daily Five, a link), when you started and answered, the side you chose (or that you made no call), whether that was right, how long you took to decide in milliseconds, whether the answer came after the time ran out, how you answered (holding a fist, tapping, a button or a key), the app version and the rules version. In ranked play we also record how your rating and the hider's rating changed.

Your rating and standing

We keep your finder and hider ratings, how many ranked answers you have given and received, and a record of every rating change, so the ladder can be checked and corrected.

The Daily Five

We keep your answers to each day's five tricks and your total for the day. If you are signed in, your nickname, how many you found and your total time appear on that day's public board. Guest accounts are not shown on the board.

Hiding and publishing a trick

A trick is a recording of moves from the game's own list (the moves, their speeds, the pauses and the starting hand) plus the look you chose for it. When you publish, our server turns that recording into short videos. You never upload a video, a photo or a sound: the server makes the videos from the recording.

We keep your published tricks, their videos, a share code for each (the link goltrik.com/t/ followed by the code), and counts of how often each trick was played and how often it fooled someone. Other players see the trick, your nickname and those counts.

Drafts on your phone

Tricks you keep but have not published are saved only on your phone, in the app's own storage. We never receive a draft until you publish it. Drafts are deleted from your phone when you delete them, when you ask us to delete your account, or when you remove the app.

Blocking

When you block a player we keep who blocked whom, so neither of you is shown the other's tricks.

Reporting

You report a trick or a player by choosing one of nine reasons from a list. There is no text box. We keep who sent the report, what it is about, the reason, its status and when it was decided. The player you report is never told who reported them.

Moderation and fair play

If a moderator acts on a trick or an account (removes a trick, renames a handle, warns, mutes, removes from ranked play, suspends or bans), we keep a written statement of reasons, which the affected player can read in the app, and any restriction with its start and end.

To keep the ladder fair, the server computes statistics over ranked play, such as answers that are right far more often than chance or arrive implausibly fast. These are kept as evidence flags. A flag is never a verdict: a person reviews it before any action is taken against an account.

Using goltrik.com without the app

The challenge page plays a trick in your browser without an account. When you press "Challenge accepted", the server gives your browser a random guest token, which your browser keeps only for that tab (in session storage, never a cookie). We keep:

a fingerprint of the token, never the token itself;
a keyed fingerprint of your network, never your IP address: we take the network part of the address (the first three blocks of an IPv4 address, the first three groups of an IPv6 one) and scramble it with a secret key that we change every quarter;
a keyed fingerprint of your browser's user-agent string, scrambled the same way;
the result of a bot check, the share code you arrived on, how many tricks you played, and when;
for each trick you play: when you pressed Play, the side you chose, whether it was right, how long you took and whether you answered in time.

The network and browser fingerprints let us limit how many plays one network can make, so nobody can flood a trick with fake answers. They cannot be turned back into your address. Web plays are counted separately from app plays ("On the web: 41 tried, 25 fooled") and never touch anyone's rating.

The page itself sets no cookies and loads no third-party scripts, fonts or trackers. Two things may stay in your browser's own storage: a random id for the demo trick, and, if you are on Android and type your email into "Notify me", that email. In this version the email stays in your browser and is never sent to us.

Your age and your choices

When you first open the app, it asks the month and year you were born. The phone works out your age range from them (13 to 15, 16 to 17, or 18 and over) and keeps only that range; the month and year are never stored and never sent to us. If the answer is under 13, the app stops there and sends nothing. Once you have an account we keep your age range and when it reached us, which version of the terms and of this notice you agreed to, and your yes or no to crash reports, each with its date. A change adds a new entry, so we can show which version you agreed to and when.

Security and abuse limits

To stop floods of requests, we count recent requests per account, or per network fingerprint for web guests. These counters are deleted after a day without use. To make sure a request sent twice is only acted on once, we keep the request's fingerprint and our answer for 24 hours.

Things we add later, and only when they ship

These are built into the server but not switched on in this version. When each one starts, we update this notice first.

Devices and notifications. An install id, the platform (iOS or Android), the app and system versions, a push token per install, and your notification settings (for example a daily digest of how your tricks did, and quiet hours).
Product statistics. Events such as "a round started" or "a trick was shared", from a closed list, with a few small details (never a move list, a nickname, a name, an email, an IP address, or the side you chose). They are recorded on our server and may be forwarded from the server to PostHog in the EU. No analytics code runs on your phone.
Crash reports. Only if you say yes. Sent to Sentry in the EU without your name or email.
Purchases. If we ever sell cosmetic items, Apple or Google take the payment; we receive a transaction reference and keep which items you own.

Why we use your data

The law asks us to name a legal basis for each use. Here they are.

What we do	Legal basis (GDPR)
Running the game for you: your account and email, the sign-in code, your nickname, look, plays, ratings, the Daily Five, the weekly board, publishing, share links, blocks, drafts, deleting and exporting your data	Art. 6(1)(b): it is needed to provide the game you asked for
Your city, and the city tab of the weekly board	Art. 6(1)(b): the board you chose to join; optional, you can delete it
Your name, for support	Art. 6(1)(f): knowing who writes to us; optional, you can delete it [UNDER 16: see the reviewer's question 8]
Sex, for our statistics (adults only)	Art. 6(1)(a): your consent, given by answering; you can delete it at any time
Fair play: the statistics and evidence flags over ranked play, the "late answer" signal	Art. 6(1)(f): our legitimate interest, and other players', in a fair ladder
Security and abuse limits: request counters, network and browser fingerprints, the bot check	Art. 6(1)(f): keeping the service available and honest
Playing on goltrik.com as a guest	Art. 6(1)(b) for the play you asked for, and Art. 6(1)(f) for the abuse limits
Reports, moderation and statements of reasons	Art. 6(1)(c): our duties under the EU Digital Services Act (Arts. 16 and 17); and Art. 6(1)(f)
Keeping proof that an account was deleted	Art. 6(1)(c): showing that we honoured your request (GDPR Art. 5(2))
Product statistics recorded on our server (when switched on)	Art. 6(1)(f): understanding how the game is used, with no tracking on your device
Crash reports (when switched on)	Art. 6(1)(a): your consent, which you can withdraw at any time
Game notifications (when switched on)	Art. 6(1)(b), plus your phone's permission; reminders only with your consent, Art. 6(1)(a)
Your age confirmation	Art. 6(1)(c) where a law requires an age check; otherwise Art. 6(1)(f)
Purchases (if they come)	Art. 6(1)(b), and Art. 6(1)(c) for accounting records

Where we rely on legitimate interest, you can object at any time (see Your rights).

How long we keep it

Each table in our database states its own retention rule, and scheduled jobs apply it every night. "With the account" means the data is erased when your account is erased (see Deleting your account).

Data	How long
Your account, email, nickname and look	Until your account is erased. A guest account unused for 12 months is erased automatically
Your name, city and sex	Until you delete them, or with the account. Sex is also deleted when your age range moves below 18
Your weekly board score	This week and last week, then deleted; earlier with the account
Sign-in log of our sign-in service	[AUTH LOG RETENTION: confirm with Supabase]
Your published tricks and their videos	Until you or we delete them, or with the account. A trick removed by a moderator is kept, hidden, for 12 months and then deleted
Your plays	13 months, then deleted; earlier with the account. The trick's play counts remain, without you
Your claims of tricks to play	With the account; old ones are deleted after 13 months
Your ratings and the record of rating changes	With the account
Daily Five results	13 months; earlier with the account
Blocks	Until you unblock, or with either account
Reports you send	Until decided, then 12 months after the decision. When your account is erased, your name is removed from them
Statements of reasons about you	12 months after the decision. When your account is erased, your name is removed from them
Restrictions on your account	With the account; expired ones 12 months after they end
Fair-play evidence flags	With the account; reviewed flags 12 months after the review
Request counters	1 day after their last use
Retry records	24 hours
Data export files	The file 7 days, the request record 30 days
Proof that an account was deleted	24 months, holding a one-way fingerprint of the account id instead of the id
Web guest session	Kept alive for a day after your last visit, then deleted 30 days later
Web guest plays	3 months
Devices, push tokens, notification settings (when switched on)	With the account; a device unused for 12 months is deleted
Your age range and your choices	With the account
Product statistics (when switched on)	13 months. When your account is erased, the link to you is removed
Drafts	On your phone only, until you delete them or the app
Backups of the database	[BACKUP WINDOW: the backup retention of the Supabase plan used at launch]

Who helps us

We use a few service providers who store or process data on our behalf, under written data processing agreements. They may use it only to provide their service to us.

Provider	What for	Where	Status
Supabase	Database, sign-in, file storage for the videos, server functions	Frankfurt, Germany (EU)	In use
[EMAIL SENDER: the email service that sends the sign-in codes from Goltrik's own domain]	Sending the 6-digit sign-in code to your email address	[EMAIL SENDER LOCATION]	At launch (today Supabase's own test sender, which reaches only our team)
Cloudflare R2	Storing and delivering the trick videos	[R2 LOCATION: EU jurisdiction bucket to be chosen]	When switched on
Cloudflare Turnstile	The bot check on goltrik.com	Global network	When switched on
[WEB HOST]	Serving the goltrik.com pages	[WEB HOST LOCATION]	At launch
Sentry	Crash reports, only with your consent	EU (Frankfurt)	When switched on
PostHog	Product statistics, sent from our server only	EU (Frankfurt)	When switched on
Expo, with Apple Push and Firebase Cloud Messaging	Delivering notifications	USA	When switched on
RevenueCat	Checking store purchases	USA	Only if purchases come

Apple and Google also process data when you sign in with them, download the app or (later) buy something. They do that as independent controllers under their own privacy policies.

Where a provider is based outside the EU, the transfer is covered by the EU-US Data Privacy Framework where the provider is certified, and by the European Commission's standard contractual clauses in its data processing agreement.

We do not sell your data and do not share it with anyone for advertising.

Deleting your account

In the app: You, then Settings, then Account, then Delete my account.

Signed-in account. Right away, you are signed out and the drafts on your phone are deleted. Your account is erased from our server 7 days later. Until then nothing changes on the server and your published tricks stay up. If you change your mind, sign in again within the 7 days and the deletion is cancelled; the app tells you it was. After the 7 days it is final.
Guest account. There is nothing to sign back into, so there is no waiting period: the account is erased from our server within minutes.

Without the app: write to [PRIVACY EMAIL] from the email address of your Apple or Google sign-in, or tell us your handle and we will ask you to confirm from the app. [WEB DELETION: a web deletion page is planned; until it exists, this email route is the web link the Google Play listing points to]

What is erased: your account, your email address, your nickname, your name, city and sex; the tricks you published, their videos and every play of them; your plays, ratings and rating history, Daily Five results and weekly board scores; your blocks; restrictions and fair-play flags about you; your devices, push tokens, notification settings and choices record; your data exports.

What is kept, with your name taken off: reports you sent and statements of reasons about you, for the rest of their 12 months; product statistics, for the rest of their 13 months. We keep a record that the deletion happened, holding only a one-way fingerprint of your account id, for 24 months.

Backups of the database are not edited; they expire on their own within [BACKUP WINDOW]. If a backup is ever restored, we erase your account again before the service resumes.

Your rights, and how to use them

Your right	How to use it
See your data and get a copy (Arts. 15 and 20)	Ask at [PRIVACY EMAIL]. We send one file with your profile (your email, nickname, name, city, sex and age range), tricks, plays, ratings, Daily Five results, weekly board scores, blocks, the reports you sent, statements and restrictions about you, your devices and settings. [EXPORT BUTTON: the server builds this file already; the button in You, Settings, Account is planned]
Correct your data (Art. 16)	In the app: You, then your profile, changes your nickname, name, city and sex. Anything else: ask at [PRIVACY EMAIL] [PROFILE SCREEN: confirm the screen exists at launch]
Delete your data (Art. 17)	In the app, or by email: see Deleting your account
Restrict use (Art. 18)	Ask at [PRIVACY EMAIL]
Object to uses based on legitimate interest (Art. 21)	Ask at [PRIVACY EMAIL]. For fair-play statistics, objecting means leaving ranked play, since a ladder cannot be fair without them
Withdraw consent (Art. 7(3))	Switch the setting off in the app (crash reports, reminders), or delete your answer to the sex question in your profile. It does not affect what happened before
Not be subject to decisions made only by a machine (Art. 22)	A person reviews every fair-play flag and report before any action against an account
Complain to a regulator (Art. 77)	You can complain to the data protection authority where you live or work, or to ours: [SUPERVISORY AUTHORITY: the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Wiesbaden, while the operator is established in Hesse]

Inside the game you also control: blocking (after a trick, More on the result sheet, then Block; your list is in You, Settings, Blocked) and reporting (after a trick, More, then Report this trick).

Children and teens

Goltrik is for people aged 13 and over. When you first open the app, we ask for your age (or read the age range your phone's app store provides) and we keep only the age band, never your birth date or an ID document. If we learn that an account belongs to someone under 13, we delete it.

Players under 18 are not asked about sex. For players under 16, the name and the city are optional like for everyone; whether we may keep them without a parent's consent is a question for our legal review [UNDER 16: see the reviewer's question 8], and until it is answered the app [UNDER 16 DECISION: asks them / does not ask them of players under 16].

For players aged 13 to 17 the protective settings are the default, and in this version they apply to everyone:

no ads, and no advertising or analytics code in the app;
nothing to buy, and so no prompts to buy;
no messages, no bios and no free text between players: others see only a nickname chosen from our word lists, never a name;
no photos, videos or sounds uploaded from your phone;
your tricks are never featured on Goltrik's own social channels without a separate opt-in, which is not offered to anyone under 18.

What we do not do

We do not show ads, and we do not track you for advertising, on the app or the web.
We do not sell your data, rent it or share it with data brokers.
We do not read your contacts, your photo library, your location, your camera or your microphone. Your city is one you pick from a list. The app asks for one permission only when you use it: to save a trick's video to your Photos when you tap Save to Photos. It never reads your library.
We do not let players send each other free text. Nicknames are chosen from our word lists; the name you may type is seen only by us.
We do not use cookies on goltrik.com.
We do not put third-party analytics, advertising or attribution code in the app.
We do not ban or restrict anyone by machine alone.
We do not put your data through artificial intelligence models.

How we protect it

Every table in the database is locked by default and opened only for what the game needs (row-level security). The app holds no secret keys. Videos are delivered through links that expire after 10 minutes. IP addresses are never stored, only keyed fingerprints of the network. Data is encrypted on the way to and from our servers. The security page says how to report a weakness to us.

Changes to this notice

We keep this notice under version control with the app. If we change what we collect or why, we update it before the change ships and tell you in the app; where the law requires your consent, we ask again. Earlier versions are available on request.

This version: [EFFECTIVE DATE].

Notes for the reviewer (removed before publication)

These notes are for the lawyer reviewing the draft. Every factual claim above was taken from the code on branch goltrik/phase-1 on 2026-10-18, and the accounts round's on 2026-10-26 (v0.3: the email sign-up, the nickname, the profile, the weekly board); the sources are listed so each can be checked.

Where each fact comes from

Data in Frankfurt: Supabase project goltrik-staging, Frankfurt (supabase/README.md, Status). Production will be a Frankfurt project too (plan 3.7, 3.9).
Guest account and default handle "player" + the first 6 hex characters of the account id: supabase/config.toml (anonymous sign-in), supabase/migrations/20260828150000_profile_on_signup.sql; a moderator rename resets to the same form (moderate, 20261009160000_v2_safety_privacy_functions.sql). Anonymous sign-ins are currently switched off on staging (a dashboard decision; supabase/README.md, "What is still stubbed").
Email sign-up by a 6-digit code, no password (ADR 022 decision 2): Supabase Auth's email code (/auth/v1/otp, /auth/v1/verify), the app's apps/play/src/net/otp.ts; Apple and Google later. Today the codes go out through Supabase's built-in sender, which delivers only to the project's team members' addresses and about two an hour; a sender on Goltrik's domain is a launch prerequisite.
The profile (v0.3, 20261026110000_accounts_and_the_weekly_board.sql): profiles.private_name (1 to 40 letters, no column grant to any client: other players cannot read it), profiles.city_id (a cities row, the GeoNames cities15000 list, 20261026100000_the_city_list.sql; other players see the city only on the weekly board), profiles.sex (female, male, another, prefer_not; a database check allows it only with the 18+ band, a trigger deletes it when the band moves below 18), profiles.onboarded_at. Written only through set_profile, read by the player through my_profile.
The nickname from closed word lists (handle_words, tools/handle-words.mjs, 362 adjectives x 330 nouns, a deny list); the free handle column write was revoked the same day.
The weekly board: week_scores (one row per player per Berlin week: ranked plays found and played, when the points were reached, the city), pruned after last week by week_board_job; week_board shows nickname, city, found, played and points of onboarded, non-anonymous, unsanctioned players, less the viewer's blocks.
The export (export_user_data) carries the email, name, city, sex, onboarding time and the weekly scores; erase_user deletes the weekly rows and the profile row with its fields.
Handle rules (before v0.3; nicknames now come from the lists): profiles.handle 2–24 characters (20260827120000_init.sql); case- and form-insensitive uniqueness and the reserved/blocked list (20261009100000_harden_before_cutover.sql, 20261009120000_v2_guests_daily_safety.sql reserved_handles; ADR 011).
What a play records: trick_plays and attempts columns (20261009110000_v2_engine_and_tricks.sql).
Ratings: player_ratings, rating_ledger (same file).
Daily Five board shows signed-in players only: daily_board (20261017100000_the_daily_five_lane.sql; README "The Daily Five").
A trick is a move recording rendered by the server; no client upload: tricks.recording (4 KB cap), ADR 013, ADR 015; services/render.
Drafts on the device only: apps/play/src/state/drafts.tsx (expo-file-system, the app's documents folder); deleted on account deletion: apps/play/src/strings.ts safety.now.
Reports: nine closed reasons, no free text since 2026-10-17 (report_content(p_kind, p_ref, p_reason), 20261017110000_the_safety_follow_ups.sql; reports.details always null).
Moderation: moderation_actions with statement (DSA Art. 17), readable by the affected player via RLS; user_sanctions; integrity_flags "evidence, never a verdict" (20261009130000_v2_privacy_ops.sql).
Web guests: guest_sessions (token sha256, HMAC of the /24 or /48 with GUEST_IP_SALT, HMAC of the user agent, Turnstile result, first code), guest_attempts, guest_plays (20261009120000…, 20261012110000_guest_attempts_and_session_bucket.sql); hashing in supabase/functions/web-play/index.ts; quarterly salt rotation is the stated policy (supabase/README.md, environment variables). Session expiry one day after last open: guest_open. Token in sessionStorage: apps/web/src/net.ts, apps/web/src/config.ts. No cookies: apps/web/src/store.ts; the CSP in apps/web/src/index.html and t/index.html allows only the site and the backend.
Notify-me email kept in localStorage and never sent: apps/web/src/getapp.ts, apps/web/src/store.ts. This is a product gap (the form promises a notification nobody can send); either wire it to a mailing processor (a new processor and consent) or remove it before launch.
Rate limits and retry records: rate_limits (1 day), idempotency_keys (24 h): prune_ttl() in 20261009170000_v2_jobs_and_queues.sql.
Retention periods: every table's retention: comment, applied by prune_ttl(), drop_old_partitions (13 months for trick_plays and events, 3 for guest_plays) and cleanup_anonymous_users() (12 months, weekly), all in 20261009170000_v2_jobs_and_queues.sql.
Deletion: request_account_deletion (grace deletion_grace_days = 7; guest accounts due at once), the return by sign-in (deletion_return via my_standing, 20261017110000_the_safety_follow_ups.sql), the account worker every 10 minutes (v2-account-worker), erase_user (its delete / anonymise / retain lists, 20261011180000_reservations_released_on_erase_and_lapse.sql). The in-app wording mirrors apps/play/src/strings.ts safety.erased and safety.kept.
Export: request_data_export and export_user_data exist server-side (20261009160000_v2_safety_privacy_functions.sql); the app has no export screen yet.
Events: closed list of names and the refused keys (moves, handle, email, ip, answer, side …) in record_event (20261009140000_v2_play_functions.sql). The app does not send events yet; the PostHog forwarder is not built.
No analytics or crash SDK in the app: apps/play/package.json dependencies (no Sentry, PostHog, Firebase or attribution package).
Permissions: apps/play/app.json (photo-library write only, read permissions blocked on Android).
Media links expire after 600 s: MEDIA_URL_TTL_S (README, environment variables), ADR 015.

Not yet built, but described above as at launch (each must exist before this notice is published, or the text must change): the platform age signals (the age screen itself is built); the email sender on Goltrik's domain; the export button; the profile screens (being built beside this round); the crash-report SDK (the consent toggle is built, nothing is sent); device registration and push; the web deletion page. The plan puts all of them in phase 4 (docs/GOLTRIK-APP-PLAN.md, roadmap).

Questions for the reviewer

Is Art. 6(1)(b) sound for minors aged 13–15 in Germany, where the core service rests on contract, or does a parent's consent to the contract matter under national civil law (§§ 106 ff. BGB)? Research 06 §3.1 flags this.
Is the keyed, quarterly-rotated network fingerprint personal data in your view (we assume yes, and treat it so)?
Is the 12-month retention of reports and statements of reasons right for DSA purposes, and should the reporter's id be dropped earlier than erasure?
Is the Daily Five board (handle, found, time, visible to all players) acceptable for 13–17-year-olds by default, or should teens be opt-in?
The Supabase Auth service keeps its own audit log of sign-ins, which may include IP addresses [AUTH LOG RETENTION: confirm with Supabase]. Does it need its own line?
A DPIA is planned before launch (research 06 §3.4, row 8). Should this notice reference it?
Is an English-only notice acceptable for German users, or is a German version needed at launch?
Under 16 (Art. 8 GDPR, Germany's age 16). The name (for support) and the city (for the city board) are optional and asked after sign-up. For players aged 13 to 15, can we rest them on Art. 6(1)(b) and (f) as above, or does asking for them make them consent-based data that needs a parent's consent under Art. 8? Should the app not ask them of under-16s at all? The founder's decision (ADR 022) asks sex of adults only for this reason.
Sex with "another". Is the answer "another" data about gender identity that needs Art. 9 care (it is optional, never shown, used only in aggregate)? Is Art. 6(1)(a) by answering an optional question a valid consent, or does it need a separate tick?
The city on a public board. A nickname with a city, visible to all signed-in players, for 13 to 17-year-olds: acceptable by default, or should the city be hidden from the everyone tab for minors?
The email address. Is keeping it for the life of the account (to sign in) and writing about the account under Art. 6(1)(b) enough, with marketing kept out entirely?