1. Who is responsible for your data
The controller of the personal data described here is Dawid Zbiński, ul. gen. Władysława Sikorskiego 15/15, 34-400 Nowy Targ, Poland, NIP 7352921429, REGON 528114982 ("we", "us").
You can reach us about anything in this policy at dawid@zbinski.dev.
We have not appointed a data protection officer. The nature and scale of our processing do not require one.
We process personal data under Regulation (EU) 2016/679 (the "GDPR") and Polish data protection law.
2. What this policy covers
This policy covers three things:
- the website at https://tiland.app;
- the game Tiland for Android and iOS (the "app");
- the game server the app plays through, at game-api.tiland.app (together with the app, the "Service").
It does not cover the App Store or Google Play. Apple and Google run those under their own policies (section 5).
Tiland has no sign-up. There is no e-mail, password or phone number. On first launch the app asks our server for a guest account, and that account is all the server knows you by.
3. The website
The website is a set of static pages. It sets no cookies. It stores nothing in your browser. It runs no analytics. It makes no request to anyone else: fonts and images come from tiland.app itself.
Our web server keeps an access log. Each line holds your IP address, your browser's identification string (user agent), the address requested, the time, the response status and the referring page.
We keep this log to keep the website secure and to find the cause of failures. This is our legitimate interest in running a secure and reliable service (Article 6(1)(f) GDPR). The log is kept for up to 30 days.
4. The app and the game server
4.1 What we process, why, and for how long
| Data | Details | Why we process it and on what basis | How long we keep it |
|---|---|---|---|
| Guest account | A random account identifier. A one-way hash (SHA-256) of a secret that only your device holds; the secret itself is never stored. The name you last sat under. When the account was created and last seen. | To recognise your app when it reconnects, so your seats stay yours. Necessary to provide the Service (Article 6(1)(b) GDPR). | An account that never took a seat: 24 hours after it was last seen. Any other account: 90 days after it was last seen, once it holds no seat. An account keeps its seats until their rooms are deleted (below). |
| Display name | The name you choose in the app's settings. The app lets you type 16 characters; the server accepts up to 24. On first launch the app draws one for you, such as "Player42". | To show the other players who is at the table. Necessary to provide the Service (Article 6(1)(b)). | Stored on your guest account, on each seat you take, and in each game's record. It goes with the account and with each room, as the rows above and below say. |
| Rooms and games | The six-digit room code. Each seat: name, colour, seat number, account, whether it is connected, and when it left or was abandoned. The island and its seed. The full state of the game, including every player's hand and held court cards. A log of every game event, such as dice rolls, harvests, builds, trades and cards played. | To run the game on the server, and to put you back in your seat after a dropped connection, a closed app or a server restart. Necessary to provide the Service (Article 6(1)(b)). | Deleted with the room. A lobby that is more than 10 minutes old goes about 2 minutes after its last player leaves. A finished game goes 10 minutes after the last player disconnects. Any room nobody is connected to goes 1 hour after the last player left. |
| Online queue | The name you queue under, while you wait for a table. The turn clocks of a running game. | To form a table and to keep the game moving. Necessary to provide the Service (Article 6(1)(b)). | Never written down. Held in the server's memory while you wait or play. |
| Keyed hash of your network address | When a new guest account is created, a keyed hash (HMAC-SHA256 under a secret key held by the server) of your IP address. An IPv6 address is cut to its first 64 bits before hashing. The address itself is never stored. | To limit how many guest accounts one network address can create: at most 20 in 24 hours. Our legitimate interest in protecting the Service from abuse (Article 6(1)(f)). | 24 hours. It is stored apart from the account, and we never match the two. |
| Rate-limit counters | Your IP address (for IPv6, its first 64 bits), in the server's memory only, as the key of two counters: new guest accounts and wrong room codes (10 a minute). A separate counter limits the messages of each connection; it is kept with the connection, not with your address. | To stop floods and the guessing of room codes. Our legitimate interest in protecting the Service (Article 6(1)(f)). | Never written down. A counter stops counting against you within about a minute. The server forgets it when it restarts, or earlier when it needs the room. |
| Server logs | The game server's own log: a request identifier, the method, the route, the status and the duration of each request. Some lines also carry a connection identifier, a room code, a seat identifier or an error message. It never records your IP address or what you send. The web server in front of the game server keeps the same access log as the website (section 3). | To keep the Service secure and stable and to find the cause of failures. Our legitimate interest in running a secure and reliable service (Article 6(1)(f)). | Up to 30 days. |
| Store data | What Apple and Google give us about sales (such as order number, date, country or region and the amount paid) and, if you allow it on your phone, crash reports. Reviews you post on the store, under the name the store shows. Source: Apple or Google. | Accounting and tax duties (Article 6(1)(c)); answering reviews and fixing faults (Article 6(1)(f), our interest in a working game and in talking to players). | Sales records: 5 years from the end of the year of the sale (Polish tax law). Crash reports: as the store console keeps them. Reviews: while the store shows them. |
| Correspondence | E-mails you send us: your address, your name if you give it, and the content. This includes complaints, requests about your data and notices about illegal content. | To answer you and handle your request. Where needed, to establish, exercise or defend legal claims (Article 6(1)(b), (c) and (f)). | As long as the matter needs, then for the limitation period of possible claims: up to six years under Polish law. |
Deletion is automatic. The server checks every five minutes, so each period above can run up to five minutes longer.
A guest account holds no e-mail, phone number, real name, device identifier, advertising identifier, location or contacts. The app reads none of these.
4.2 What you must provide
To play, the app needs a guest account and a display name, and the server needs your network address to register the account. Without them there is no seat to sit in. Nothing else is required.
Please do not use your real full name or anything sensitive as your display name. Other players read it (section 6).
4.3 On your device
The app keeps three small files in its private storage:
- settings.cfg: your display name and the Sound, Music and Haptics switches;
- accounts.cfg: your guest account's identifier and its secret, one entry per game server;
- session.cfg: the game server's address, the code of your last room and the name you sat under, so the home screen can offer that seat back.
These files stay on your device. The secret is stored in plain text inside the app's private storage.
On Android, the app's data is excluded from backups and removed when you uninstall the app. On iOS, the files live in the app's own container. They are not shown in the Files app. As with other apps, iOS normally includes that container in a backup of your phone, and restores it with the backup.
The app uses the clipboard in two ways only. Copy puts a room code on it. Paste reads it only when you tap Paste, and fills in the keypad. Nothing is sent until you tap to join.
The app contains no advertising, analytics or crash-reporting code, and no third-party service that collects data. It talks to one server: ours.
5. Buying the app: Apple and Google
You buy Tiland once, from the App Store or from Google Play. Apple or Google handles the purchase, the payment, receipts, taxes, refunds, the download and updates. Each does this as an independent controller under its own privacy policy:
We never receive your payment card details. Our game server does not check purchases and knows nothing about who bought the app.
What the stores pass on to us about sales, crash reports and reviews is in the "Store data" row of section 4.1.
6. Who can see what
Tiland seats people at a shared table. This is who sees what:
- In a lobby, everyone at the table sees each seat's display name and colour, and whether it is connected.
- In a game, everyone at the table sees each seat's name, colour and whether it is connected, away or abandoned. They also see its public score, how many resource cards and court cards it holds, its knights played, road length, harbour points and whether it played a Treasury. Every building, road, trade offer and game event is shown to the whole table.
- Nobody sees your hand. Other players see only how many cards you hold. The full score, with hidden victory points, is shown when the game ends.
- Anyone with a room code can join that room's lobby while it has an empty seat.
- Display names are chosen freely and are not filtered. Other players can see whatever name you choose.
There is no chat. The display name is the only text one player writes that another reads.
7. Recipients
We do not sell or rent personal data. We share it only with the providers below, which process it on our behalf, and with public authorities when the law requires it.
| Provider | What they do for us | Where the data is |
|---|---|---|
| netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany | Hosts the servers that run the website, the game server, its database and its logs. | Nuremberg, Germany |
| MXroute LLC, Hallsville, Texas, United States | Hosts the mailbox behind dawid@zbinski.dev, through which we receive and answer your e-mails. | United States |
We use no other providers. Apple and Google are not our recipients; they act for themselves (section 5).
8. International transfers
The website, the game server, its database and its logs are in Germany, in the European Union.
MXroute LLC hosts our e-mail in the United States. E-mail you send to dawid@zbinski.dev is therefore stored there. The transfer is based on the Standard Contractual Clauses adopted by the European Commission. If you would rather your correspondence stayed in the EU, tell us and we will agree another way to talk.
We transfer personal data nowhere else outside the European Economic Area.
9. Security
- The app reaches the game server only over an encrypted connection (wss://). The website is served over HTTPS.
- The app sends its secret only in the first message of each connection, and never shows or logs it.
- The server stores only a hash of each secret and compares it in constant time.
- Your network address is never stored in clear, and the game server's own log never records it.
- The database and the game server are not reachable from the internet except through the game server's public interface.
- Access to our servers is limited to the operator and protected by key-based authentication.
No system is perfectly secure. If a personal data breach is likely to put you at risk, we will notify the supervisory authority and, where required, the people affected, as the GDPR requires.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate data: you can change your display name in the app's settings, and the new name is used at the next table you sit at;
- erasure of your data (see below);
- restriction of processing: while we check data you say is inaccurate or an objection you made, where the processing is unlawful but you prefer restriction to erasure, or where we no longer need the data but you need it for a legal claim;
- data portability for the data you gave us, in a machine-readable format;
- object to processing based on our legitimate interests, on grounds relating to your situation;
- lodge a complaint with a supervisory authority (section 14).
We do not rely on consent for anything in this policy, so there is no consent to withdraw.
How to ask. E-mail dawid@zbinski.dev. A guest account has no e-mail address, so we must find it another way. Tell us your display name, roughly when you last played, and the code of your last room if you still have it. A room code stops helping once its room is deleted (section 4.1). If we cannot tell your account apart from others with confidence, we will say so. We then cannot act on that account (Article 11 GDPR), and it expires on its own schedule.
We answer within one month. For complex or numerous requests we may extend this by two more months and will tell you if we do. Exercising your rights costs you nothing.
Deleting your account
The app has no delete button yet. You have three ways:
- Delete the app. Its secret goes with it, and nobody, including us, can use the account again. On iOS, a phone backup may still hold the secret (section 4.3).
- Wait. The server deletes the account on the schedule in section 4.1.
- Write to us as described above, and we delete the account and confirm.
A game's record belongs to the whole table. We do not delete a running game that other players are still in. If your account still holds a seat there, we delete the account once that room is gone.
11. Children
The Service is not directed at children. You must be at least 16 years old to use it, as the Terms of Service say. The app has no age check. We do not knowingly process the data of anyone under 16. If you believe a child has used the Service, contact us and we will delete their data.
12. Automated decision-making
We make no decision about you based solely on automated processing, and we do not profile you.
The game's own rules act automatically: for example, a seat that lets its clock run out loses the turn. These are rules of the game, the same for every player, and not decisions about you as a person.
13. Changes to this policy
We may update this policy when the Service, our providers or the law change. We publish the new version at https://tiland.app/privacy with a new effective date. We announce material changes at least 14 days before they take effect, on the website and in the app's release notes on the store.
14. Contact and complaints
For anything about your personal data, write to dawid@zbinski.dev or to Dawid Zbiński, ul. gen. Władysława Sikorskiego 15/15, 34-400 Nowy Targ, Poland.
If you believe we process your data unlawfully, you may complain to a supervisory authority. You can do so in the EU country where you live, work, or where the alleged breach took place. The authority responsible for us is the President of the Personal Data Protection Office of Poland (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl.