Privacy

Contents

1. Controller
2. What we process – and why
3. Playing together
4. Leaderboard and name filter
5. Player profile and friends
6. Anonymous totals
7. Purchases (skins)
8. What stays on your device
9. Connection data, email
10. Service providers
11. Your rights
12. Changes

1. Controller

The controller responsible for processing personal data in the Pick It! app, its web version and these pages is:

Patrick Barme
An den Röthen 20
61381 Friedrichsdorf
Germany

Email: kontakt@carnival-chaos.com
Phone: +49 151 68125499

2. What we process – and why

Pick It! has no user accounts with email or password. We never ask for an email address or your real name. If you want to compare with friends, you can create a player profile voluntarily (section 5). There are no ads, no tracking, no analytics tools and no chat, and we neither share nor sell data. How much the game is played we only count as an anonymous total (section 6).

3. Playing together

When you open or join a room, the following is sent to our server at Netlify:

• the name you type yourself (16 characters at most). Everyone in the room sees it. A nickname is enough – better not use your real name.
• a random player ID created on your device that recognizes you within a room. It is not tied to any person, device identifier or Apple Account.
• your entries and points in the current game and the version of the game on your device (so everyone in the room plays the same version).
• for each entry, which reels you held when re-spinning. From this the server recalculates your hand and awards the points itself – so the leaderboard can’t be filled with made-up results.

An invite link contains only the room key, nothing about you.

The server deletes rooms and game data by itself after 48 hours at the latest.

4. Leaderboard and name filter

For each game mode, the leaderboard keeps the ten highest scores with the name that was entered. Older entries drop out as soon as they are beaten.

Inappropriate names: A filter rejects swear words, phone numbers, email addresses and links as names. Anyone who still sees an inappropriate name on the leaderboard can report it; the name is then replaced by “Player” right away, the points stay. We store nothing about the person reporting. The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in protecting players from offensive names.

5. Player profile and friends

Under “Friends” you can voluntarily create a player profile. Our server at Netlify then stores:

• the player name you choose (16 characters at most). Only your friends see it – and, as before, the others in a room you play in. It passes the same filter as the leaderboard and can be changed at any time.
• a random ID and the hash of a secret your app uses to identify itself. Neither is tied to an email address, device identifier or Apple Account.
• a six-character friend code you can share, and your friends list. A friendship always applies to both sides.
• your scores: per game mode the number of finished games, their sum (for the average) and the ten best scores with date. Your friends see the best one in the ranking among friends.

So that the profile survives reinstalling, the iOS app also stores the ID and secret in the iCloud Keychain of your Apple Account. Apple manages it; we have no access to it.

You can report an inappropriate name of a friend; it is replaced by “Player” right away. Under “Friends” → “Delete profile” you immediately remove the profile, friend code and scores from the server – and yourself from your friends’ lists. The legal basis is Art. 6(1)(b) GDPR.

6. Anonymous totals

Our server counts per day how many rooms were opened, how many games were started and finished, how many seats were taken in them, and whether a room was opened in the iOS app, the Android app or the browser. Only these totals are stored – no name, no player ID, no room key, no IP address. They allow no conclusions about a person or a device, not even whether two rooms were opened by the same person.

We use them to know how much the game is played and to plan the server accordingly. The legal basis is Art. 6(1)(f) GDPR.

7. Purchases (skins)

You can buy additional skins in the app. The seller is Apple; the purchase runs entirely through the App Store. We receive no payment data, no Apple Account and no billing address.

The app asks Apple directly on your device which skins you own. This information is not sent to our server and is never linked to your player name. Apple’s privacy policy applies to the purchase itself; Apple handles payment and refunds: reportaproblem.apple.com.

8. What stays on your device

The selected skin, the sound switch, your player ID, the room you are currently in and – if you have one – the ID and secret of your player profile are kept in the app’s or your browser’s storage. They only leave your device as described above. We don’t set cookies.

The app also counts on your device how many games you have played, so it doesn’t ask for a rating too early. The rating prompt itself comes from Apple; we don’t learn whether or how you rate.

9. Connection data, email

With every request – to the app, the web version and these pages – technically necessary data arises: IP address, date and time, requested address, browser or operating system. Our hosts process it to deliver the content and to protect against attacks. We don’t analyze it. The legal basis is Art. 6(1)(f) GDPR.

Email: If you write to us, we use your address and message only to reply and delete them once the matter is settled. Mail to our address is forwarded by Cloudflare to our mailbox at Google (Gmail).

10. Service providers

• Netlify, Inc. (San Francisco, USA) runs the server for the app and web version – rooms, game data, leaderboard, player profiles – as a processor.
• Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) delivers these pages and forwards email to us – also as a processor.
• Google provides the mailbox where email to us arrives (Gmail).
• Apple runs the App Store and handles purchases – under its own responsibility.

Netlify, Cloudflare and Google are or belong to US companies, so access from the USA cannot be entirely ruled out. Transfers are based on the EU-US Data Privacy Framework (Art. 45 GDPR) or on the European Commission’s standard contractual clauses (Art. 46 GDPR).

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21) – in particular to processing based on our legitimate interest. Write to us at kontakt@carnival-chaos.com.

Since there are no accounts with email, we don’t know who you are. For a leaderboard entry we therefore need the name, the points and roughly the day; rooms disappear by themselves after 48 hours anyway. You can view, rename and delete your player profile yourself in the app; to request information about it, tell us your friend code.

You can also complain to a data protection supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

12. Changes

If the game changes, we update this policy. The version on this page always applies.

Last updated: November 1, 2026. This is a translation; the German version is authoritative.