Privacy policy for Grand Skat

In short: we store only what the game needs to work. No ads, no trackers, no selling of data. The details are below.

Who is responsible. The data controller is Robert Świerkosz, ul. Wrocławska 30, 41-103 Siemianowice Śląskie, Poland (publisher NeuraGrowth, the game Grand Skat at grandskat.com, grandskat.de and weldowo.pl). For anything about your data, write to admin@neuragrowth.co.

What we store, why and for how long

• Account: nickname, email address and password. The password is stored only as an argon2id hash, so nobody knows it, including us. The email is used for password recovery and to reply to your reports; no newsletters, no ads. With the account we also store the date it was created and of your last activity, your language and game appearance. Legal basis: the contract for using the game (Art. 6(1)(b) GDPR). Kept until you delete your account.
• Game: results of hands and series, ranking, achievements, friends and hidden players, chosen avatar and frame, premium status (with the date and store of purchase). This powers the ranking, statistics and playing with friends. Legal basis: contract. Kept until you delete your account.
• What other players see: your nickname, avatar, frame and ranking results are visible to everyone, including guests. Friends also see whether you are online and at which table you play.
• Login: on the website a session cookie (httpOnly), in the app a token stored on your phone or computer. Valid for 30 days, used only to keep you logged in.
• Feedback you send (“Send feedback” in the game and the form on the website): the text, a contact address (if you are signed in and give no other, we attach your account email so we can reply), nickname, platform, app version, language and window size, and for a reported hand its course of play including the nicknames at the table. A player report also contains the reported person's nickname. We use it only to improve the game. Legal basis: our legitimate interest in fixing bugs (Art. 6(1)(f) GDPR). A copy reaches us by email. We delete the whole report after 12 months, in the database and in the mailbox.
• Server logs: IP address, time, requested address and browser type. They serve security (protection against attacks and abuse, rate limits). Legal basis: legitimate interest. Web server logs are kept for 14 days, application logs for 7 days.
• Database backups are made daily and kept for 14 days. A deleted account disappears from the backups within 14 days at the latest.
• Statistics are counted by us and only in aggregate (daily numbers of visits, registrations and hands), without analytics cookies and without identifiers.
• Signing up to test on Google Play (page testerzy.html): nickname and Google account address. We add the address to the tester list in the Google Play Console (Google Ireland Limited). Legal basis: your request to take part (contract). Deleted after the test ends or on request.
• Guests play without an account. All that remains is the server log entry and, if they send feedback themselves, its content.
• On your device the game keeps settings, language, offline statistics and the login token. This stays with you. The daily puzzle reminder (Android) is scheduled by the phone itself, without our server.

Providing data is voluntary. Without a nickname, email and password you cannot create an account, but you can still play as a guest. We make no automated decisions and do no profiling.

Processors we use (only as far as needed to run the game):

• OVH SAS (France): the game server in a data center in Frankfurt am Main (Germany).
• Resend, Inc. (USA): sending the password reset email and delivering feedback to us. Resend is certified under the EU-US Data Privacy Framework, and its data processing agreement also includes the European Commission's standard contractual clauses.
• Cloudflare, Inc. (USA): the Turnstile service checks, when you create an account (on the website and in the apps), that a human and not a bot is signing up (it sees your IP address and browser data), and Email Routing forwards mail sent to admin@neuragrowth.co to our mailbox. Cloudflare is certified under the EU-US Data Privacy Framework.
• Google Ireland Limited (Gmail): the publisher's mailbox, where mail to admin@neuragrowth.co and copies of feedback arrive; Google LLC (USA) is certified under the EU-US Data Privacy Framework.
• PixelPicked (pixelpicked.com): only on grandskat.com, the start screen shows a PixelPicked badge. Its image loads from their server, so your browser sends them your IP address and the address of our site, as with any image from another server. We pass them no other data, and clicking the badge takes you to their website, under their terms.
• Purchases: payment is handled by the store you buy from (Google Play, Microsoft Store, itch.io) under its own terms; we never see card details. On Android the purchase is confirmed by RevenueCat, Inc. (USA): it receives a purchase identifier (without nickname or email) and basic device data (system, app version, IP address), and our server asks it whether the purchase exists before marking the account as premium. The transfer to the USA is based on the European Commission's standard contractual clauses.

We do not share or sell data to anyone else. Fonts are served from our own server.

Your rights. You have the right to access, rectify and erase your data, to restrict processing, to data portability, and to object to processing based on legitimate interest. You can delete your account yourself: Profile → “Delete account forever” (we delete the account, results, ranking and friends), or by email to admin@neuragrowth.co. We reply within one month. You can also lodge a complaint with a data protection authority, for example in your country or with the Polish authority responsible for us (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl).

Children. We do not ask for or limit age. An account needs only a nickname, email and password, the table chat consists of ready-made phrases, so no personal details can be exchanged with strangers there, and purchases go through the stores with their own parental controls. A parent or guardian can ask us at any time to delete their child's account: admin@neuragrowth.co.

Cookies. We use only a session cookie that is strictly necessary for signing in, and the browser storage holds only game settings. There are no advertising or analytics cookies, so we do not ask for consent.

Changes. We will announce significant changes in the game. Last updated: 7 November 2026.