Privacy Policy

1. Controller

2. Visiting the site

The site is hosted by Vercel Inc. When you open a page, Vercel processes the technically necessary connection data (IP address, time, requested address, browser identification) in order to deliver the page and fend off attacks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is secure, reliable operation.

Fonts are served from our own server. We embed no Google Fonts and no advertising networks. To measure reach we use Vercel Web Analytics, served from this same domain: it records page views without cookies and without building a profile that follows you across sites. The only cookies we set are for signing in (see section 6), which is why there is no cookie banner.

3. Visitor counting

We count page views and how many distinct visitors we get per day. To do so, your IP address and browser identification are combined into an irreversible hash (HMAC-SHA-256 with a secret key), and only that hash is stored. The IP address itself is never written down, and the hash cannot be turned back into a person. We can therefore neither tell who opened a page nor follow anyone over time. The legal basis is Art. 6 (1) (f) GDPR (interest in measuring reach without identifying anyone). Daily figures are deleted after 120 days at the latest.

4. Playing without an account

The games run entirely in your browser. Settings and personal best scores are stored locally in your browser (localStorage) and are not transmitted to us. You can clear them at any time through your browser settings.

Skin renders are loaded directly from Valve Corporation's servers (steamstatic.com). Valve therefore receives your IP address and browser identification, which is outside our control. Valve is based in the USA. The legal basis is Art. 6 (1) (f) GDPR — without these images there is no game. See Valve's privacy policy for details.

5. User account

You can create an account to appear on the leaderboard. We then process:

Username — publicly visible on the leaderboard
E-mail address — for signing in, not public
Password — stored only as a hash; we never see it
Your results — score, accuracy, difficulty, timestamp

The legal basis is Art. 6 (1) (b) GDPR (performance of the user relationship). The data is kept as long as the account exists. Account and data are deleted on request by e-mail; deleting the account also removes the associated results.

E-mail addresses are currently not verified. The address is therefore not checked for accuracy and cannot be used to recover a forgotten password.

6. Sign-in cookies

Once you are signed in we set two strictly necessary cookies (cs2_at, cs2_rt) that identify your session. They are HttpOnly, so scripts in your browser cannot read them, and they expire after 30 days at the latest; signing out deletes them. As they are strictly necessary for the service you requested, no consent is required (§ 25 (2) no. 2 TDDDG).

7. E-mails about news

When registering you may optionally tick a box allowing us to send you occasional e-mails about new games and updates. The box is not pre-ticked, and registration works regardless — your consent is never a condition of using the site.

The legal basis is Art. 6 (1) (a) GDPR. As evidence we store the time, the exact wording you agreed to, and a hash of your IP address (Art. 7 (1) GDPR). You can withdraw your consent at any time with effect for the future — using the switch in your account settings or informally by e-mail. Withdrawal does not affect the lawfulness of processing carried out until then.

8. Processors

We use the following service providers, each under a data processing agreement pursuant to Art. 28 GDPR:

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA — hosting and delivery of the site. Transfers to the USA are based on the European Commission's Standard Contractual Clauses.
Supabase, Inc., 970 Toa Payoh North, Singapore — database and account management. Our data is stored in the Frankfurt am Main (EU) region; for administration Supabase relies on Standard Contractual Clauses.

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), as well as the right to object to processing based on legitimate interests (Art. 21 GDPR). Simply write to regenkomet0@gmail.com.

You may also lodge a complaint with a data protection supervisory authority, for example the one responsible for your place of residence (Art. 77 GDPR).

10. Changes

If the service changes, we will update this policy. The version published here at the time applies.

Last updated: 23 August 2026