Privacy policy

Who is responsible

Ismael Martin Ramirez, owner of disunyer.com. Contact: [email protected].

What data we process

If you play as a guest: only the name you type, for as long as your connection and your game last. It is not stored in any database.

In your browser (local storage, not on our server; it is deleted when you clear the site data): a random browser identifier (so you cannot take two seats at once), the token of your seat in the current game, your session token if you have an account, the last guest name you used and your settings (language, sound and hiding emotes or hearts). The browser also keeps a copy of the offline page and of the icon. We do not use cookies.

If you create an account:

• Your username and your avatar, which are public.
• Your password, stored only as a bcrypt hash: we never know it.
• Your email, only if you choose to add it (it is optional) and once you confirm it with the link we send you. Until then, and to recover your password, we store the hash of that link and the address it was sent to; it expires after one hour at most and is deleted when used.
• A hash of the IP address you created it from (computed with a secret key; we do not store the IP itself), only to limit the number of accounts per connection.
• A session token for each browser you log in from (10 at most), stored as a hash, so you do not have to type your password every time. It is deleted when you log out.
• Your results (position, players, points, mode and date of each game), your Coins and their history, the items you get and wear, and your achievements and their progress.

What others can see: your name, avatar and style in games, your row in the leaderboard and your profile (whether you are online, your statistics, how many achievements you have and your recent games). Your Coins are not shown.

Moderation: if an administrator bans a player, we store their name, the reason, the duration and, if the administrator decides so, the hash of their IP. Administrators' actions are kept in a log with the affected player's name.

Statistics: for each finished game we store the mode, the number of humans and bots, the rounds, the duration and the date, with no names or personal data.

Technical data: to prevent abuse, the server counts in memory, per IP, open connections, login attempts, emails requested and room codes tried. Those counts expire on their own (after one hour at most) and are lost when the server restarts. Server logs do not include cards, player names, email addresses or IP addresses.

Why we use it and legal basis

• To provide the service you ask for (your account, session, games, Coins and the leaderboard): it is necessary for that (art. 6(1)(b) GDPR).
• If you have an email, to send you the links to confirm it and to recover your password, and security notices about your account (when your password or email changes): it is part of the service you ask for (art. 6(1)(b) GDPR). We will never send you advertising.
• To keep the game safe and prevent abuse and cheating (per-IP limits, bans and their log): legitimate interest (art. 6(1)(f) GDPR).

Who else processes the data

• OVHcloud hosts the game server and its database. The server is in Canada, a country the European Commission recognises as providing an adequate level of data protection.
• Brevo (Sendinblue SAS, France) sends the account emails: it receives your address and the content of each email.
• Cloudflare delivers the website and protects it from attacks. To do so it receives your IP address and your requests, and may also process them outside the EU, with GDPR safeguards (EU-US Data Privacy Framework and standard contractual clauses).

All three act as processors: they only process the data to provide their service to us.

What we do NOT do

Your email is optional and only used for your account; we do not ask for your phone number, we do not use third-party advertising or analytics, we do not sell or share data, and there is no free-text chat (only emotes). Coins cannot be bought with money.

How long we keep it

• For as long as your account exists. When you delete it, your user, your email, your IP hash, your sessions, results, Coins, items and achievements are deleted, and your name becomes available again.
• Bans and the moderation log are kept even if the account is deleted, so that a ban cannot be bypassed.
• Games in progress live only in memory and disappear when the room closes or the server restarts.
• Database backups are kept for 30 days at most; after that, deleted data is gone from them too.

Your rights

You can delete your account, and add or change your email and your password, from the game itself (Settings, the gear in the lobby; it asks for your password). To exercise your rights of access, rectification, erasure, objection, restriction or portability, write to [email protected]. To check that the account is yours, we will write to its email or, if it has none, we may ask you to confirm it from within the game. You can also complain to the Spanish Data Protection Agency (aepd.es) or to your local authority.

Age

Disunyer is only for people aged 18 or over. If you are under 18, do not use it or create an account. If we learn that an account belongs to a minor, we will delete it.

Security and changes

All traffic is encrypted (HTTPS). Passwords, session tokens, email links and IP addresses are only stored as hashes. If we change this policy, we will publish the new version at this same address with its date.