Privacy Policy

Controller

Josef Gallab (Einzelunternehmen)
Oberhofenweg 21b
6380 St. Johann in Tirol, Österreich
Email: anigosha@wellbooked.at

What data we process

Account: email address and password (stored encrypted, unreadable to us).

Guest account: if you play without an email (“Play now”), we create an account without an email address that can only be reached through the sign-in token on your device. Like any account, it holds your player name and game data. If you add an email address later, it becomes a regular account with the same ID.

Profile: your chosen player name, language and an avatar from the app’s built-in selection (no own picture, no upload).

Game data: experience points, level, daily streak, Elo rating, rounds played and answers given, duels with other players.

Reports: if you report a question, we store which question, the reason and your account.

Reporting and blocking players: if you report another player, we store your account, the reported player, their name at that moment and the reason, so we can review the report (legitimate interest in a safe game environment, Art. 6(1)(f) GDPR). If you block someone, we store whom you blocked so you no longer meet in duels and leaderboards. Both are deleted together with your account.

Purchase diagnostics (mobile apps only): at start-up and with every purchase attempt we store a short technical diagnosis of the purchase system against your account — which steps took how long and whether an error occurred. It contains no payment data and serves only to find faults with the “remove ads” purchase without you having to type anything out for us (legitimate interest, Art. 6(1)(f) GDPR). It is deleted together with the account.

We deliberately do NOT collect your real name, address, date of birth or location.

Purpose and legal basis

Account and game data are processed to perform our contract with you (Art. 6(1)(b) GDPR) — the game cannot work without them.

Personalised advertising is processed solely based on your consent (Art. 6(1)(a) GDPR). You give it on first launch and can withdraw it at any time in the settings.

Troubleshooting and abuse prevention rest on our legitimate interest in a working, fair game (Art. 6(1)(f) GDPR).

Player name and leaderboards

Your player name, Elo rating and experience points are visible to other players — in duels, in the daily leaderboard and in the global leaderboard.

Choose a player name that does not identify you if that matters to you. Your email address is never visible to other players.

Recipients

Supabase Inc. (processor, a US company; your data is stored in the EU region Frankfurt): account, profile and game data.

Cloudflare Inc. (USA): delivery of the web app and the public legal pages; server logs including IP addresses arise for technical reasons.

GitHub, Inc. (USA), a Microsoft Corporation company: delivery of these legal texts via GitHub Pages (almaz6380.github.io). Technically necessary server logs (IP address, time, requested page, user agent) are generated. The legal basis is our legitimate interest in secure delivery (Art. 6(1)(f) GDPR), safeguarded by EU standard contractual clauses. We do not analyse these logs ourselves.

Cloudflare Web Analytics: audience measurement for the web app (pages viewed, approximate country, device type, referring site). It sets no cookies, stores nothing on your device and creates no persistent identifier; individuals cannot be recognised or tracked across visits. IP addresses are processed only briefly and not stored. The legal basis is our legitimate interest in a working and comprehensible website (Art. 6(1)(f) GDPR). The mobile apps are not affected.

Google AdMob: advertising in the mobile apps. Google may process device identifiers. Without your consent, only non-personalised ads are served.

Google Firebase Cloud Messaging: delivery of notifications, if you have turned them on.

Resend (processor, USA): sending the e-mails for registration, password reset and address change. Resend receives your e-mail address and the content of the respective mail.

RevenueCat (processor, USA): handling and restoration of the “remove ads” purchase, if you make it.

Transfers to third countries (notably the USA) may occur with Google, Resend, RevenueCat and Cloudflare Inc.; with Supabase Inc. the data is stored in the EU, but access by the US company cannot be ruled out. They rely on the adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission’s standard contractual clauses.

Notifications

Notifications are voluntary and off by default. You turn them on yourself under Profile → Notifications; the legal basis is your consent (Art. 6(1)(a) GDPR).

If you turn them on, we store a device identifier (the push token), your device platform and your language setting. None of this reveals your name or your location. We use it solely to tell you about your own duels — never for advertising.

Delivery is handled by Google Firebase Cloud Messaging, and on Apple devices additionally by Apple’s push service. The content of the message (for example “Your turn”) is passed to those services.

You can withdraw your consent at any time, either in the app under Profile → Notifications or in your device settings. On withdrawal and on sign-out we delete the device identifier immediately. If a device stops being reachable, we remove its identifier on our own initiative.

Advertising and your consent

The mobile apps show advertising. Before the first ad we ask via Google’s consent dialog (UMP) whether you want personalised advertising.

You can change this decision at any time in the app settings. If you decline, you will still see ads, but without personalisation.

On iOS we additionally ask via Apple’s App Tracking Transparency dialog.

Optional videos: in a few places you can choose to watch an advertising video and receive a game aid in return (a second 50:50 joker in a round, or saving a streak after a missed day). These videos are also served by Google AdMob, on the same basis as above: personalised only with your consent, otherwise without personalisation. Whether you watched a video to the end is known only to the app on your device; we store nothing about it, only the game aid itself.

In-app purchases

The app offers a one-off “remove ads” purchase. The transaction itself is handled by Apple or Google — we never receive payment details such as card numbers and cannot access them.

We use RevenueCat to manage the purchase. We transmit your user identifier and the store’s purchase receipt; RevenueCat additionally processes technical details about your device and app version. The identifier used is deliberately your in-app account ID, not your email address.

The purpose is performance of the purchase contract (Art. 6(1)(b) GDPR) — without this transfer, ad-free mode could neither be unlocked nor restored on a new device.

If you delete your account, the link between the purchase and your identifier ceases. The receipt itself remains with Apple or Google under their retention periods and privacy policies.

Retention

We store your data for as long as your account exists.

A guest account without an email address that has not been used for 90 days is deleted automatically together with its game data — anyone who deletes the app without securing the account can no longer reach it anyway.

If you delete your account in the app, account, profile and game data are erased immediately and completely. This includes all duels you took part in — they also disappear from your opponent’s history.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with future effect.

You can delete your account directly in the app: Profile → Delete account.

For anything else, write to anigosha@wellbooked.at.

You also have the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).

Children

You can only create an account if you are at least 16 years old; you confirm this when registering. This is above the ages from which you can consent to processing yourself in Austria (14, § 4(4) DSG) and Germany (16, Art. 8 GDPR) — for example to personalised advertising. We do not knowingly collect data from younger people.

If we learn that an account belongs to someone younger, we delete it. Parents and guardians may contact us at any time.

Changes

Last updated: 09.10.2026. Whenever a new kind of processing is added, we update this policy and point it out in the app.