Privacy Policy

This translation is provided for convenience. In the event of any discrepancies, the German version shall prevail.

This Privacy Policy applies to the use of SpielDock via the spieldock.com website and the web app.

Below, we explain which personal data is collected when using SpielDock, for what purposes and on what legal basis it is processed, and what rights you have as a user.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is the person named in the Legal Notice (Imprint).

2. Data Protection Contact

Questions regarding data protection and requests to exercise your rights may be sent to the contact address stated in the Legal Notice (Imprint).

3. Data Protection Officer

No data protection officer has been appointed, as the statutory requirements for such an appointment are not met.

4. Data We Process

When you register and use an account, we process in particular:

username, display name and email address;
your password is stored securely and is not available to us in plain text;
internal user ID, roles, and creation and modification timestamps;
status of acceptance of the Terms of Use and the version accepted during registration;
login information and session data.

This data is required to create your account, authenticate you and provide the functions of SpielDock.

4.2 Profile, Collection and Interaction Data

Depending on the features you use, we process:

publicly visible username and display name;
games in your collection and wishlist, as well as other list statuses;
ratings, rating comments and timestamps;
follow relationships with other accounts;
activity, progress and achievement data relating to gamification features.

Your public profile may display your username, display name, collection statistics, and games from your collection and wishlist that are intended to be public. Depending on the relevant view, ratings, comments, activities and social relationships may be visible to registered or unregistered users.

On the “About SpielDock” page, we publicly display aggregated totals for registered members, ratings and collection entries. These statistics do not contain information about individual accounts.

In the “Friends” section, we suggest active profiles to registered users. The ranking takes into account shared published games from ownership lists and shared follow contacts. The username, display name and number of shared games or contacts are displayed. Accounts that you already follow or have blocked are not included in these suggestions.

4.3 Game Sessions

If you record game sessions, we may process, for example:

the game played, date, start time and end time;
optionally, location and notes;
names or user accounts of other players;
player results and winner status.

Please only enter information about other people if you are authorised to do so. Where possible, use nicknames and avoid unnecessary personal or sensitive information.

4.4 Digital Game Passes

When using a digital game pass, the following information may be processed:

assigned game and collection status;
purchase date, seller, purchase price and currency;
condition and serial number;
optional notes.

Do not enter data in free-text fields that is not necessary for the relevant purpose.

4.5 Hosting and Server Log Files

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

When the website is accessed, Hetzner processes technically necessary data in server log files. This may include the IP address, date and time of access, page accessed, amount of data transferred, browser type and operating system.

Processing is carried out for the technical provision, security and stability of the website on the basis of Art. 6(1)(f) GDPR.

Server log files are deleted after no more than 14 days.

4.6 Technical Access and Security Data

When accessing SpielDock, technically necessary data is generated. This may include:

IP address;
time of access and page accessed;
browser type and operating system;
language settings.

Login and registration attempts are limited in order to prevent misuse. Temporary counters generated for this purpose are deleted after no more than one hour.

In addition, the web server, an upstream proxy and the hosting provider may maintain access and error logs. These are deleted after no more than 14 days.

4.7 Data Entered by Other People

Other registered users may record your name or nickname, your participation and your result in a game session.

In this case, the data originates from the person who created or edited the game session.

If you would like such information to be corrected or deleted, you can contact us using the data protection contact details stated above.

4.8 Special Categories of Personal Data

SpielDock is not intended for the processing of special categories of personal data within the meaning of Art. 9 GDPR.

In particular, please do not enter health data or information concerning ethnic origin, political opinions, religion, trade union membership, sexual orientation or sex life in free-text fields.

4.9 Avatars from UI Avatars

We use the external service UI Avatars (ui-avatars.com) to display user avatars.

The username is transmitted to the service as a URL parameter in order to generate a personalised avatar image.

The provider may process, in particular, your IP address, username and technical information relating to the request.

The service is integrated for the purpose of displaying the web app on the basis of Art. 6(1)(f) GDPR.

4.10 Email Delivery via Mailjet

For sending emails, such as registration confirmations, password resets and notifications, we use Mailjet, a service provided by Sinch Sweden AB, 111 20 Stockholm, Sweden.

When an email is sent, your email address, name, subject and message content are transmitted to Mailjet.

Processing is based on Art. 6(1)(b) GDPR (performance of a contract) and is carried out solely for the purpose of sending messages requested by you or intended for you.

Email addresses are not disclosed to third parties or used for marketing purposes unless you have expressly consented to this.

4.11 Game Data from BoardGameGeek

For selected games, we obtain the public game image, average rating and other publicly available game information, such as title, description, year of publication, number of players, playing time, recommended age, difficulty, designers and publishers, via the BoardGameGeek API.

Requests are made exclusively from our server. The public BoardGameGeek game ID and technical connection data of our server are transmitted.

Visitors’ IP addresses and account data are not transmitted to BoardGameGeek when a game is displayed.

We store the BoardGameGeek game ID, imported game information, downloaded and generated image variants, average rating and the time of the last synchronisation.

Only when you deliberately open a BoardGameGeek link does your browser establish a connection to BoardGameGeek.

5. Purposes and Legal Bases

We process personal data for the following purposes:

Purpose	Data	Legal basis
Registration, login and account management	Account, login and profile data	Art. 6(1)(b) GDPR – performance of a contract
Evidence of conclusion of the contract and accepted Terms version	Acceptance status, Terms version and registration time	Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR – evidence and defence against legal claims
Provision of collections, ratings, comments, game sessions, digital passes and gamification	Collection, rating, comment, session, pass and activity data	Art. 6(1)(b) GDPR
Display of profiles, collection information, ratings, comments and social relationships	Username, display name, profile, collection, rating, comment and interaction data	Art. 6(1)(b) GDPR; where necessary Art. 6(1)(f) GDPR
Suggestions for finding other members	Public profile data, shared published games and follow contacts	Art. 6(1)(b) GDPR
IT security and detection of misuse, fraud and attacks	IP address and anti-abuse measures	Art. 6(1)(f) GDPR – legitimate interest in secure operation
Measuring reach of individual game pages without directly readable visitor identification	Anonymised usage data and game ID	Art. 6(1)(f) GDPR – legitimate interest in data-minimised usage statistics
Compliance with legal obligations and establishment or defence of claims	Required account, communication and log data	Art. 6(1)(c) or (f) GDPR
Email delivery	Email address, name, subject and message content	Art. 6(1)(b) GDPR – performance of a contract
Optional features expressly requiring consent	Data specified in the consent	Art. 6(1)(a) GDPR

Where processing is based on legitimate interests, these interests include protecting SpielDock and its users against misuse, analysing errors, and ensuring reliable and economical operation of the service.

We take into account the interests and rights of affected individuals and limit both the amount of data processed and the retention period.

You may withdraw consent at any time with effect for the future. Processing carried out on the basis of your consent before its withdrawal remains lawful.

6. Requirement to Provide Data

A username, email address, password and acceptance of the applicable linked Terms of Use are required to create and use an account.

Without this information or acceptance, we cannot provide an account.

Information such as collection status, ratings, comments, game sessions, digital game passes and optional profile information is only required if you wish to use the respective feature.

7. Visibility and Recipients

Depending on the feature, your username, display name, public profile, collection information, ratings, comments, activities and social relationships may be visible to other people.

Before submitting a comment, please check whether it is appropriate for the intended visibility.

Internally, access is restricted to persons who require it for operation, support, security or administration.

Data may also be transmitted to the following categories of recipients:

hosting, infrastructure and database providers;
IT service providers acting as processors;
BoardGameGeek as a source of public game data for server-side requests;
authorities, courts or other bodies where required by law or necessary for the enforcement of legal rights.

8. Transfers to Third Countries

Personal data is generally processed only within the European Union or European Economic Area.

An exception is the use of UI Avatars (Section 4.9). When an avatar image is retrieved via UI Avatars, the IP address may be transmitted to servers in the United States. The integration is based on Art. 6(1)(f) GDPR.

Email delivery via Mailjet (Section 4.10) is handled through servers operated by Sinch Sweden AB in the EU.

When BoardGameGeek is accessed server-side (Section 4.11), technical connection data from our server may be processed outside the EU. Visitors’ IP addresses and account data are not transmitted for this purpose.

If you use the external support services described in Section 17, data may be processed by Ko-fi in the United Kingdom.

Amazon may also use affiliated companies and service providers outside the European Economic Area.

Information on the applicable transfer mechanisms and safeguards can be found in the providers’ privacy policies linked below.

9. Retention and Deletion

We generally retain personal data only for as long as necessary for the relevant purpose or as required by statutory retention obligations.

Account data: generally for the duration of the account.
Evidence of acceptance of the Terms: for the duration of the account and, where required, until the relevant statutory or legal-claims period expires.
Collection, community, game session, pass and gamification data: for the duration of use or until the relevant content or account is deleted.
Ratings and comments: for as long as your account exists.
Technical security and session data: no more than one hour.
Authentication sessions: until expiry, normally 30 days.
Server and error logs: 14 days.
Backups: created daily and automatically deleted after 14 days.
Support and communication data: generally deleted following final processing, normally no later than three years after the end of the calendar year of the last contact. Transaction data subject to statutory accounting retention requirements may be retained for up to eight years.
Data required for legal obligations or legal claims: until expiry of the applicable statutory period or proceedings.

10. Account Deletion

You may request deletion of your account using the data protection contact details specified in Section 2.

Before deletion, we may request appropriate proof that the account belongs to you.

Ratings and comments may remain in anonymised form after account deletion where there is a legitimate interest in retaining them.

11. Cookies, Local Storage and Authentication

After successful login, a technically necessary cookie is set for session management. It keeps you logged in and expires after no more than 30 days.

The frontend stores the following information locally in your browser:

Login information: your account’s display name and avatar URL as an immediately visible placeholder until the complete profile is loaded.
Language: preferred language setting, e.g. “en”.
Theme: selected appearance and light/dark mode.
Recently viewed games: up to 50 titles in a local list until full game information is loaded.
Card view: preferred game-card view: list, compact or grid.

Technically necessary information for synchronisation between multiple open browser tabs is also stored.

A CSRF token is used for security purposes to protect forms against unauthorised submissions.

This information remains stored locally in the browser and is not transmitted to third parties.

Local storage is cleared when you log out, delete your browser data or the server determines that the session is invalid.

12. Security

We take appropriate technical and organisational measures to protect personal data against loss, manipulation and unauthorised access. These include:

storing passwords in hashed form so they cannot be read by us;
restricting certain functions to authorised persons;
limiting repeated login and registration attempts;
validating input and implementing safeguards for data access;
restricting functions according to authorised roles.

Data transmitted between your browser and our server is protected using an encrypted HTTPS connection.

13. Automated Decision-Making and Profiling

No solely automated decision-making producing legal or similarly significant effects within the meaning of Art. 22 GDPR takes place.

Progress values and achievements within gamification features are used solely to provide game-related features.

14. Your Rights

Subject to the statutory requirements, you have in particular the following rights:

access to your processed data under Art. 15 GDPR;
rectification of inaccurate data under Art. 16 GDPR;
erasure under Art. 17 GDPR;
restriction of processing under Art. 18 GDPR;
data portability under Art. 20 GDPR;
objection to processing based on Art. 6(1)(e) or (f) GDPR under Art. 21 GDPR;
withdrawal of consent with effect for the future under Art. 7(3) GDPR;
lodging a complaint with a data protection supervisory authority under Art. 77 GDPR.

To exercise your rights, simply contact us using the details specified in Section 2.

To protect your data, we may request appropriate proof of identity.

15. Objection to Processing Based on Legitimate Interests

You have the right, on grounds relating to your particular situation, to object at any time to processing based on our legitimate interests under Art. 6(1)(f) GDPR.

We will review your objection and discontinue the relevant processing unless compelling legitimate grounds override your interests or the data is required for the establishment, exercise or defence of legal claims.

16. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

You can generally contact the supervisory authority responsible for your place of residence, place of work or our place of establishment.

The supervisory authority responsible for the controller is:

Sächsischer Datenschutz- und Transparenzbeauftragter (SDTB)
Bernhard-von-Lindenau-Platz 1
01067 Dresden
Germany
www.saechsdsb.de
Email: post@sdsbx.sachsen.de

An overview of German data protection supervisory authorities is provided by the German Federal Commissioner for Data Protection and Freedom of Information.

17. External Content and Links

SpielDock may contain links to external websites. When you click such a link, you leave our platform. The respective website operator is responsible for data processing on those websites.

Via Ko-fi and our Amazon wishlist, you can voluntarily support SpielDock.

A connection to the respective provider is only established when you open the relevant external link.

Depending on the service and information you provide, we may receive information such as your name, email address, message, support amount and associated transaction information.

We process such information to assign and manage your support and communicate with you on the basis of Art. 6(1)(b) GDPR where necessary to process the support, and otherwise on the basis of Art. 6(1)(f) GDPR.

Payment data may additionally be processed by payment service providers such as PayPal or Stripe.

On our homepage, you can play a product tour via YouTube. No connection to YouTube is established before you activate the play button.

Once you play the video, the YouTube player is loaded and information including your IP address and technical usage data may be transmitted to YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Further information can be found in the respective providers’ privacy policies.

SpielDock maintains profiles on the following platforms:

Instagram (Meta Platforms Ireland Limited)
Threads (Meta Platforms Ireland Limited)
TikTok (TikTok Technology Limited and TikTok Information Technologies UK Limited)
YouTube (Google Ireland Limited)
Bluesky (Bluesky Social, PBC)
Telegram (Telegram Messenger Inc.)
Discord (Discord Netherlands B.V.)

When you visit our profiles, the platform operators independently collect and process information such as IP addresses, usage behaviour and interaction data.

We do not have full control over the scope or further processing carried out by these platforms.

If you contact us via social networks, we process the information you transmit in order to respond to your request.

When accessing our TikTok, Telegram or Discord presence, you leave our website. The respective platform then processes account, profile, communication, interaction and technical usage data according to its own privacy policy.

19. Minors

SpielDock is not knowingly directed at minors.

Users should not enter personal data relating to children in free-text fields or game sessions unless they have sufficient authorisation to do so.

20. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy if our platform, service providers or applicable legal requirements change.

The current version is always available via the “Privacy” link in the footer of our website.

We will inform you in good time of any material changes.

21. Legal Basis and Further Information

The information obligations arise in particular from Art. 13 GDPR and, where data is not collected directly from the data subject, Art. 14 GDPR.

The full text of the Regulation is available from EUR-Lex.

General information on these information obligations is also provided by the German Federal Commissioner for Data Protection and Freedom of Information.

Last updated: 1 October 2026