Privacy Policy

Who is responsible

DigiatPPSolutions s.r.o., Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic, decides how your personal data is used on Aidventures (the "controller" in the words of the GDPR). For anything about your data, write to us at that address.

What we collect

• Account: your email address, the leaderboard name you pick, and your password. The password is stored only as a salted, one-way hash, so nobody here can read it.
• Game: the runs you start, the choices you make and when, your scores, the endings you find and the lives you use.
• Membership: whether you are a member, until when, and the customer and subscription numbers Stripe gives us. Your card details go straight to Stripe. We never receive them.
• Agreement: which version of the terms you accepted, and when.
• Technical: your IP address and basic browser details appear in server logs. To stop abuse we keep short-lived counters tied to a scrambled form of your IP address or email (a hash), never to the address itself. We also keep a random token for each browser you have signed in with.
• Messages: whatever you write to us.

We don't ask for your real name, your date of birth, your address or your phone number.

What we don't do

• No advertising and no ad networks.
• No analytics or tracking scripts, and nothing loaded from other companies' servers on our pages.
• No selling or renting of personal data, and no sharing it for other people's marketing.
• No profiling and no automated decisions that affect you legally.

Cookies

We set three cookies, and only when you sign in. Two keep you signed in: one for about an hour at a time, one that renews it for up to 30 days. The third marks, for up to a year, that this browser has signed in to your account before, so that you can still get in if a stranger tries to lock you out by guessing your password. None of them can be read by scripts.

They exist only to sign you in and to protect your account, so the law doesn't require us to ask for consent, and that is why you see no cookie banner.

When you pay, you do so on a page run by Stripe, which sets its own cookies there to prevent fraud.

Why we use your data

• To give you what you signed up for: your account, the game, your membership and the leaderboard. Legal basis: our contract with you.
• To keep the service safe and fair: limiting sign-in attempts, stopping fake accounts and cheating, finding faults. Legal basis: our legitimate interest in a service that works and isn't abused.
• To keep the records the law demands, such as tax and accounting records of payments. Legal basis: legal obligation.
• To tell you about changes to the service, the price or these documents. Legal basis: our contract with you. We don't send marketing email.

What other players see

Your leaderboard name, your score, how many endings you have found and your rank are public. Nothing else is. Pick a name that doesn't identify you if you want to stay anonymous.

Who else handles your data

We use a small number of companies to run Aidventures. They work on our instructions and under a contract that protects your data:

• Stripe sells the membership to you on our behalf (it is the merchant of record): it takes the payment, charges and pays the VAT or sales tax, sends the receipt and keeps the payment records. Location: Ireland and the United States.
• Supabase hosts the database with accounts and game progress, and runs sign-in: it keeps your email address and the hash of your password, and sends the emails that confirm an address or reset a password. Location: Germany (Frankfurt).
• Render runs the website and delivers the videos, behind Cloudflare's network. Location: Germany (Frankfurt).

Where one of them handles data outside the European Economic Area, the transfer is covered by a European Commission adequacy decision (such as the EU-US Data Privacy Framework) or by the Commission's standard contractual clauses.

We hand data to authorities only when the law obliges us to.

How long we keep it

• Account, game and membership data: until you delete your account. Deleting removes it from our database at once.
• Server logs: up to 30 days.
• Abuse counters: at most one day.
• Sign-in on a browser: 30 days without a visit, or until you sign out. The mark on a browser you have signed in with: one year, or until you change your password or delete your account.
• Payment records: as long as tax and accounting law requires, usually up to 10 years. These are kept by Stripe and in our accounts, and hold no card numbers.
• Messages you send us: up to 2 years after the matter is closed.

Your rights

You can, at any time and at no cost:

• See and download your data: Download my data on your account page.
• Delete your account and everything in it: Delete account on the same page.
• Have wrong data corrected, or ask us to limit or stop a use of your data: write to us.
• Complain to the data protection authority of the country where you live or work.

We answer within one month. If you live in a US state with its own privacy law, you have the rights to know, correct and delete described above, and we do not sell or share your personal information as those laws define it.

How we protect it

Connections to the site and to the database are encrypted. Passwords are hashed with scrypt. Only our own server can reach the database. Sign-ins, sign-ups and payments are rate limited. If a breach ever put your data at risk, we would tell you and the authority without delay.

Children

Aidventures is for people who are 18 or older. We don't knowingly collect data from anyone younger. If you believe a child has made an account, tell us and we will delete it.

Changes to this policy

When we change this policy we update the date at the top. For a change that matters we email you at least 30 days before.