Privacy Policy

1. Controller & contact

The data controller is [FILL IN NAME / COMPANY], Company ID: [FILL IN], registered seat [FILL IN ADDRESS] (the “Controller”).

Contact for data protection matters: [FILL IN E-MAIL]. The Controller has not appointed a Data Protection Officer (DPO), as it is not legally required.

2. What data we process

Game data: chosen name, faction, lineage (who bit whom), in-game stats (MOC, Krev, Heat), activity. A bite link is anonymous by default.

Account data (optional): an e-mail, if you provide one to secure and recover your account.

Payment data: handled solely by Stripe. We never see or store your full card number — only a transaction reference, amount and what was bought.

Technical data: IP address, device/browser type, and browser local storage (player id, chosen language) needed for the app to work.

3. Purposes & legal basis (Art. 6 GDPR)

Providing the Service / performing the contract — Art. 6(1)(b): account creation and management, game mechanics, payments.

Legitimate interest — Art. 6(1)(f): security, fraud and abuse prevention, basic analytics and improvement, aggregated (non-identifying) statistics.

Legal obligation — Art. 6(1)(c): accounting and tax records for payments.

Consent — Art. 6(1)(a): only if you opt in to e-mails or allow optional cookies. Consent can be withdrawn at any time.

4. Cookies & local storage

We use necessary local storage and cookies for the app to function (session, player id, language) — these do not require consent under § 89 of Act 127/2005.

Optional (analytics/marketing) cookies are used only with your consent, which you can withdraw any time in your browser settings.

5. Recipients & processors

We disclose data only to processors acting on our instructions: Supabase (database & hosting), Netlify (hosting & CDN), Stripe (payments), and an e-mail provider for account recovery.

Your public name and public game activity are intentionally visible to other Players — that is the essence of the game.

6. International transfers

Some processors (e.g. Supabase, Netlify, Stripe) may process data on servers outside the EU, notably in the USA. Such transfers are safeguarded by EU Standard Contractual Clauses (SCC) and/or the EU-US Data Privacy Framework, or an adequacy decision.

7. Retention

Game and account data are kept while your account exists. After deletion we remove or anonymise personal data, except data we must keep by law.

Accounting and tax records of payments are kept for the legally required period (generally 10 years under Czech accounting and VAT law).

8. Your rights

You have the right to: access (Art. 15), rectification (Art. 16), erasure / “right to be forgotten” (Art. 17), restriction (Art. 18), portability (Art. 20), objection to processing based on legitimate interest (Art. 21), and withdrawal of consent.

We do not carry out automated decision-making or profiling with legal effects under Art. 22 GDPR.

Exercise your rights by e-mail at [FILL IN E-MAIL]; we respond within one month at the latest. You can also delete your account anytime in Settings.

9. Children

The Service is intended for persons over 18. We do not knowingly process data of persons under 18. If we discover otherwise, we delete the data.

10. Security

We use encryption in transit (HTTPS), access controls and appropriate technical and organisational measures. No system is perfectly secure, but we take measures proportionate to the risks.

11. Supervisory authority

You have the right to lodge a complaint with a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.

12. Changes

We may update this policy. Material changes will be announced in the Service or by e-mail. The current version is always available on this page.