Privacy policy

In short

• We keep as little as the service needs, and nothing for advertising, profiles or AI training.
• You can delete any photo, deck or your whole account at any time; it is gone at once.
• We keep no backup of your photos. Keep your originals: this is no archive.
• Only you see your photos, and the people in the games you host, while they last.

Who is responsible

Working Software [legal form to be completed]
[address to be completed]
Managing director: [to be completed]

E-mail: privacy@example.com

Your account

We store:

• your e-mail address, to send you sign-in links and the few mails about your account; without it there is no account;
• the name you give us (a nickname is fine): it is shown to the people in the games you host, and we use it in mails to you;
• the language of the pages and mails;
• when the account was opened and confirmed (the day of the confirmation is also the day you said you are 18 or older and accepted the terms), the day you last signed in (a date, nothing finer; for the inactivity rule below), and the day of an inactivity warning;
• if you have a paid plan one day: the plan and its limits.

There is no password. A sign-in link works once and for 15 minutes; we store only its hash, with the address it went to, and delete it within the hour after it expired. A link that confirms a new address works 1 day. A sign-in on a device is a random token that we store with the day it began and whether the device stays signed in: "Stay signed in on this device" keeps it 60 days after its last use, "Only this time" until the browser closes, 24 hours at most. Your account page lists your signed-in devices and signs you out everywhere.

An account that is never confirmed is deleted after 24 hours, with its address, also when somebody else typed your address. During the closed beta we keep a list of invited addresses; an entry goes when the account is confirmed, or after 90 days.

Accounts nobody uses

A free account that nobody signed in to for 24 months is deleted with everything in it. 30 days before, we write to its address with the day; signing in once keeps it. Paid accounts are not deleted for inactivity; after a paid plan ends, the months count from that day.

Your photos

On your device, the page reads the date and the position from each JPEG's hidden data (EXIF) and makes the photo smaller, to at most 3000 pixels. It then sends us the smaller picture, the day it was taken (never the time), the position, the day of the file and its name. A file the browser can't read (HEIC on many browsers) is sent as it is, and our server reads its date and position.

On our server, a separate service of ours, without access to the internet, turns the photo into a new image from its pixels alone, so no hidden data survives (no EXIF, position, camera, comment), and makes a small preview.

We keep:

• the picture and its preview, its size in pixels and in bytes;
• the day it was taken, and whether that day came from the camera, the file or the upload;
• the name of the place (town, region, country), which our server looks up from the position in a list of places (GeoNames) that we keep ourselves;
• a checksum (SHA-256) of the uploaded file, only to notice the same photo uploaded twice into your account;
• the suggested cutout: two positions and an orientation.

The automatic cutout: to suggest how each photo is cut out for a card and whether the card is upright or sideways, our server looks for faces and for what stands out in the photo. Faces are only located, never recognised or compared with others, and nothing about them is kept: we store only the suggested frame. This happens on our own server, without any outside service.

We do not keep the original file, its hidden data, the position (we use it once, for the place's name), the time of day or the file's name (used only to say which photo could not be added). Apart from finding the cutout, we don't analyse what is in your photos: no recognition of faces or people, no tagging, no AI training, no scanning of content.

The sample deck

Every account gets a sample deck with historical photos from Wikimedia Commons, to try everything with. It is an ordinary deck of your account: you can change it, play it or delete it, and once deleted it doesn't come back. Its photos are copied into your account's storage but count neither toward your plan's decks nor toward its storage. Who took each photo and under which licence is on its credits page (for example /credits/history).

Decks and cards

A deck's name, its language and its settings (layout, home country, the mark on the backs), and for each card what you set: the date, the place, the title, the orientation, how the photo fills the card, the cutout, whether it is left out. The card images drawn from them are stored, and the ones an edit made old are removed. A table you upload is read and not kept.

Playing

Players need no account. The name a player types is shown to everybody in the game and on the TV; a nickname is fine. Players without a phone are typed in by somebody who is there. Names, seats and the game's state are kept only in the server's memory while the game lasts: a game ends 10 minutes after the last player left, after 60 minutes without activity, or when its host ends it, and then nothing of it is left. We store no finished games.

Your browser keeps a random token for your seat in the session cookie. It remembers your name for the next game only if you tick "Remember my name on this device".

Anybody who has a game's code can join it or show it on a screen while it runs: share the code only with the people you play with. The host sees how many screens show the game and can remove players. The card images are sent to the players' browsers with the instruction not to keep them; our server keeps a card's image in memory for up to 60 minutes.

Who sees your photos

• You.
• The people in a game you host, and the screens that show it, while the game lasts.
• Our staff only to handle a report or a fault, and as far as needed; the administrators of the servers could technically see them.
• Our hosting provider stores them for us, under a contract (see "Who processes data for us").

Nobody else. Photos are never public, never sold, never used for advertising or to train AI. We can't stop somebody in a game from taking a photo of the screen.

If you are in a photo

Photos show people, often family and friends, children too. Whoever uploads a photo is responsible for being allowed to (see the terms). For you, as somebody in a photo: the photo and what is stored with it (the day, the place's name, a title) come from the account holder; we process it to provide the service to them (Art. 6 (1)(f) GDPR, their and our legitimate interest in a private game among people who know each other), as long as they keep it. We can't find photos by name or face. If you don't want to be in a deck, ask the person who uploaded it, or tell us through the report form (with the game's code while the game runs, or whose deck it is); parents may do so for their children. We can't inform everybody in a photo personally (Art. 14 (5)(b) GDPR); this section is that information.

Technical data

Every request carries your IP address. We use it only in counters in the server's memory that limit abuse, each for its window: sign-in requests (15 minutes), mails to one address (24 hours), new games (an hour), wrong game codes (10 minutes), reports (an hour). The counters are gone when the window is over. IPv6 addresses are counted by their first half.

Our servers don't log IP addresses: the ingress writes no access log, and the app logs a request's method, path, status and duration, but not the paths with sign-in links or game codes, and never an e-mail address. The log is kept 14 days. We don't use analytics, tracking, advertising or anybody else's content: every page, font and script comes from our own server.

E-mails

We send: the sign-in link, the link that confirms a new account or a new address, the inactivity warning, and, if you report something, a confirmation of receipt. We also write when we must (a change of the terms, the end of the service, a decision about your content) or to answer you. Plain text, no images, no tracked links, no advertising; at most 10 a day to one address. Our mail service is [mail service to be completed] ([country to be completed]).

What your browser stores

Only what the service needs, or what you choose. No consent is needed for that (§ 25 (2) TDDDG), and there is no cookie banner. The information pages leave nothing if you are not signed in.

You can remove all of it in your browser's settings ("site data"). Signing out asks the browser to drop what it cached of this site; deleting your account asks it to drop its storage too.

Deleting

A card, a deck or your account (on your account page; only your address is asked for) is deleted at once: the rows in our database right away, the files as soon as our storage takes the order, which is retried until it did (a second pass 15 minutes later catches an image that was being drawn at that moment). Games with the deck end.

Deleting can't reach: photos of the screen others took, exports you downloaded, and our database backups, which age out within 7 days. If we ever had to restore one, our server deletes again what you deleted: it keeps a list of deletions in our storage, with internal numbers only, no names or addresses, for as long as backups do and two days more.

Backups

Photos and card images are never backed up. A deleted photo is gone, and if our storage failed, photos would be lost: keep your originals. The database (accounts, decks, cards; never images) is backed up for 7 days.

Getting a copy

"Download everything" on your account page gives you a ZIP with your account's data (as text and as JSON), a table for each deck and your photos as we store them. It is put together while you download it and not kept.

Who processes data for us

• Hosting (servers, database, storage): [hosting provider to be completed], [country to be completed].
• Mail: [mail service to be completed], [country to be completed].

Both work under contracts (Art. 28 GDPR). No data leaves the EU. Authorities get data only where the law obliges us.

Legal bases

• Your account, photos, decks, games, mails and the export: to provide the service you signed up for (Art. 6 (1)(b) GDPR).
• Players' names, people in photos, and the counters and logs that protect the service: our and the account holders' legitimate interests in a working, safe service among people who know each other (Art. 6 (1)(f) GDPR).
• Reports and our answers to them: our legal duties under the Digital Services Act (Art. 6 (1)(c) GDPR).

The e-mail address is needed for an account, a name to play; photos are up to you. No decision about you is made automatically, and we build no profiles.

Your rights

• Access (Art. 15): your account page shows what we store; the export gives you all of it; or ask us.
• Correction (Art. 16): change it in the editor and on your account page, or ask us.
• Erasure (Art. 17): delete it yourself, at once, or ask us.
• Restriction (Art. 18) and portability (Art. 20): ask us; the export is machine-readable.
• Complaint (Art. 77): to a data protection authority, for us [supervisory authority to be completed].

Write to privacy@example.com; we answer within a month, free of charge.

Age

Accounts are for adults (18 or older). Children play along without an account; their name is kept only while the game lasts. If we learn that an account belongs to a minor, we delete it.

Reports

What you send through the report form goes by mail to us; nothing of it is stored on our servers. We keep reports, our decision and the statement of reasons for 12 months after the decision, then delete them. The account holder concerned learns our reasons, normally without your name.

Changes

When this page changes, its date above changes too; we tell account holders by mail about changes that matter to them.