// Legal
Privacy Policy
As of: 26 April 2026 · applies to pitchpixel-game.com and the online leaderboard of Pitch & Pixel
1. Data Controller
Robert Kolloch · netgrade.de · Email: robert.kolloch@netgrade.de
2. Hosting
The application and online leaderboard are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (server location: Germany). A data processing agreement (Art. 28 GDPR) is in place with Hetzner.
3. What Data Is Processed?
The online leaderboard is opt-in: data is only transmitted when you actively consent. Only the following is transmitted:
- a display name of your choice (max. 80 characters, anonymous option available),
- game results: achieved score, difficulty, play duration, end year, cash balance, staff/awards/acquisition counters, reputation, achievement IDs, optionally your chosen company name,
- a pseudonymous player UUID and submit token (randomly generated, stored locally in your browser),
- your IP address is processed briefly for abuse prevention (rate limiting) and deleted after 14 days at the latest.
No personal identifying data is required, no tracking cookies are set, and no third-party analytics tools are integrated.
4. Purposes and Legal Basis
- Displaying global leaderboards — Legal basis: Art. 6(1)(a) GDPR (consent).
- Abuse prevention / rate limiting — Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
5. Retention Period
- Score entries are stored until you request deletion (see §7).
- Server logs with IP address: max. 14 days.
- Local data remains in your browser until you clear it.
6. Recipients
Data is stored exclusively on own servers (Hetzner, Germany). No third-party sharing. No transfer outside the EU/EEA.
7. Your Rights (GDPR)
- Access (Art. 15) — via
/api/leaderboard/me or by email,
- Rectification (Art. 16),
- Erasure / "Right to be Forgotten" (Art. 17) — via "Delete Account" in-game (
DELETE /api/leaderboard/me) or by email,
- Restriction of processing (Art. 18),
- Data portability (Art. 20),
- Withdrawal of consent at any time with future effect (Art. 7(3)),
- Complaint to a supervisory authority (Art. 77).
8. Cookies / Local Storage
No cookies are set. The following technically necessary keys are stored in local storage (only after opt-in):
pitch-pixel:online:identity — pseudonymous UUID + submit token + display name,pitch-pixel:online:enabled — your opt-in status,pitch-pixel:online:retryQueue — retry queue for connection errors,pitch-pixel:online:lastMode — last selected display mode.
9. Security
All transmission is encrypted via HTTPS (TLS). Score entries are validated server-side for plausibility.
10. Changes to This Policy
We will update this privacy policy when processing changes. The current version is always available at this URL.