Privacy policy

1. Controller

Maël Picornell
c/o POSTFLEX PFX-384-194
Emsdettener Straße 10
48268 Greven
Germany

Please do not send parcels or packages to this address.

Email: kontakt.volksvertreter@protonmail.com

2. Website hosting through Cloudflare

This website is provided as a static website through Cloudflare. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

When the website is accessed, technically necessary connection data is processed, in particular IP address, date and time of access, requested file, amount of data transferred, browser and operating system information, and server log data. Processing is necessary to deliver the website securely, reliably and quickly.

The legal basis is Art. 6 para. 1 lit. f GDPR. The legitimate interest lies in the secure and reliable provision of this website. Further information is available in Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

Connection data is stored for as long as it is required to provide the website securely, resolve technical issues or prevent misuse. Transfers to the USA are based on the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply where necessary. More information: https://www.cloudflare.com/cloudflare-customer-dpa/

3. No cookies, no tracking, no external fonts

This website itself does not use cookies, its own tracking, web analytics, advertising trackers, tracking pixels or externally loaded fonts, and it does not store anything in your browser.

4. Duel invitation links

When you open a duel invitation link, the invitation code is part of the address you access. It is processed like any accessed address as part of hosting (section 2). The page reads the code only in your browser to take you into the app with this invitation; it does not query any other server for this. The code contains no information about you. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in taking invitations straight into the app.

5. Contact by email

If you contact me by email, the data you provide is processed in order to answer your request. This usually includes your email address, the content of your message and the technical metadata of the email.

We use Proton Mail provided by Proton AG, Switzerland, to receive, store and send emails. Proton stores the data on servers in Switzerland, Germany or Norway; backups are retained for up to 30 days. Transfers of data to Switzerland are covered by an adequacy decision of the European Commission. Proton Mail privacy policy

The legal basis is Art. 6 para. 1 lit. f GDPR. For precontractual or contractual matters, Art. 6 para. 1 lit. b GDPR may apply. Emails are deleted once they are no longer required for processing and no legal retention obligations prevent deletion.

6. Your rights

Subject to the statutory conditions, you have the right of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with effect for the future; processing before withdrawal remains lawful.

Right to object: Where we process data on the basis of legitimate interests, you may object on grounds relating to your particular situation.

To exercise your rights, you can contact us at kontakt.volksvertreter@protonmail.com. You also have the right to lodge a complaint with a data protection supervisory authority.

7. Changes

This privacy policy may be updated when necessary, for example when new website or app features are added. The current version is available on this website.

1. Controller

Maël Picornell
c/o POSTFLEX PFX-384-194
Emsdettener Straße 10
48268 Greven
Germany

Please do not send packages or parcels to this address.

Email: kontakt.volksvertreter@protonmail.com

2. In-App Purchases

The app offers optional in-app purchases through the respective app store. Payments are processed by Apple or Google. Payment data such as credit card numbers, bank details, or app store account information is not transmitted to the provider of this app.

When the app starts and whenever you return to it, the app checks with Apple or Google whether your store account has a purchase. Store purchase data such as product ID, purchase status, and transaction information is checked on your device. The result and the most recently loaded price are stored only on your device. The app uses no server of its own and no other service provider for this; purchase data is not transmitted to the provider of this app. The privacy policies of Apple (https://www.apple.com/legal/privacy/) or Google (https://policies.google.com/privacy) apply.

Purchases are processed and restored to fulfil the contract (Art. 6(1)(b) GDPR). Checking existing purchases at startup serves our legitimate interest in reliably providing purchased content (Art. 6(1)(f) GDPR).

3. Suggestions

If you submit a draft law, event suggestion, or feedback as a full-version user, the content you voluntarily enter is sent to Supabase and stored there. The provider is Supabase Pte. Ltd. (Singapore); the data may also be processed outside the EU, particularly in the USA. We store the selected app language, the time of receipt and a random submission identifier as accompanying data. Error and performance reports also include the app version and build number. For deleting new submissions, we additionally store a verification hash of a random deletion key. As with any internet connection, the sender IP is technically received by the server. The API and database logs of our Supabase project are retained for no more than seven days.

You can initiate deletion from the suggestions overview; older submissions require a deletion request. Submissions are deleted after processing is complete, or otherwise after 90 days in the next hourly cleanup run. Deletion from the suggestions database does not automatically include the hosting provider's technical logs or backups.

The sole purpose is review and possible further development of Demagogue. Submitted suggestions and feedback are not displayed publicly. The legal basis is our legitimate interest in reviewing voluntarily submitted suggestions and further developing the game (Art. 6(1)(f) GDPR). More information: https://supabase.com/privacy

Transfers to third countries are safeguarded by EU Standard Contractual Clauses.
https://supabase.com/legal/customer-resources/data-processing-addendum

4. Duel Mode (optional)

Duel mode is an optional online feature. When you retrieve an invitation, the match code you enter is transmitted to Supabase. When you create, join and play a duel, the game configuration, technical version information and game statistics are also processed. These include the starting seed, difficulty, enabled expansions, term limit, deadline, victory conditions and lobbyist setting, as well as scores, aggregated game values, bonus and sabotage effects, decisions as static catalog IDs, your party color and symbol and, with the Chancellery expansion active, the appearance and attribute of your chancellor candidate as catalog IDs. The candidate's name is not transmitted. Your role in the duel and a randomly generated secret access token are stored to identify your role and verify access permissions. The provider is Supabase Pte. Ltd. (Singapore); the data may also be processed outside the EU, particularly in the USA. No names or contact details are transmitted. Your opponent's display name remains exclusively on your device. If push notifications are enabled, the match code and role are linked to the delivery address of your app installation; the duel data is therefore not anonymous throughout. Details are provided in the notifications section. As with any internet connection, the sender's IP address is technically received by the server. The API and database logs of our Supabase project are retained for no more than seven days.

The purpose is to run the duel, in particular to exchange game states and determine the result. The legal basis is the performance of the feature you actively use (Art. 6(1)(b) GDPR). Invitations that are not accepted expire after 7 days and are deleted 14 days after their creation. Duels that have been joined follow the configured deadline; ongoing duels are ended no later than after 90 days without a change to the stored duel state. Other ended duels are deleted 30 days after the last change to the stored duel state. Cleanup runs hourly. More information: https://supabase.com/privacy

We store a request counter with an expiry time for each duel, participant role and action. Counters apply for five minutes and are deleted after expiry during the next hourly cleanup, unless they are replaced by a new counting window beforehand.

The legal basis is our legitimate interest in keeping duel mode secure and available (Art. 6(1)(f) GDPR).

To prepare notifications for delivery and avoid duplicate notifications, the server stores technical records of duel events. These records are only created for duel roles with notifications turned on and are deleted with the duel. The legal basis is our legitimate interest in reliable delivery without duplicate notifications (Art. 6(1)(f) GDPR).

Transfers to third countries are safeguarded by EU Standard Contractual Clauses.
https://supabase.com/legal/customer-resources/data-processing-addendum

5. Duel notifications (optional)

If you turn on notifications in duel mode, Google creates a delivery address for this device and hands it to the app. Google also processes a Firebase installation ID for this purpose, which identifies this app installation. Google also processes technical device, app and diagnostic data, such as information about the device, operating system, app version and performance of the integrated software, to provide the services and improve their quality. On iPhone and iPad, delivery also uses Apple's Apple Push Notification service (APNs). The providers are Google Ireland Limited and Google LLC (USA); the data may be processed in the USA. No names, contact details, saved games or advertising identifiers are transmitted. As with any internet connection, the sender's IP address is technically received by the servers involved.

If you enable duel notifications, Supabase stores the delivery address together with the match code, duel role, platform, app language and whether you are using a test or store build. New registrations also include a pseudonymous identifier for your duel role and a verification value for the deregistration key. For delivery, Firebase Cloud Messaging receives the delivery address, the title and text of the notification, the event type, technical identifiers used to route it and, depending on the app version, the match code and legislative term. Delivery is based on your consent (Art. 6(1)(a) GDPR). You can still play duels with notifications turned off.

As long as you have never enabled notifications, the app does not start the Firebase push service or request a delivery address through it. You can withdraw your consent at any time in the app settings, with effect for the future. The app then initiates deregistration with Supabase and requests deletion of the delivery address and Firebase installation ID from Google. If you revoke permission in the device settings, the app initiates deregistration once it detects that change. The app stores the delivery address and deregistration key on your device for this purpose. It keeps pending requests for later attempts. Deregistration takes effect once it has reached our server; until then, further notifications may arrive. Supabase removes delivery addresses after a duel ends once no notifications remain pending, or after 45 days without confirmation. Google removes data associated with the installation ID from its live and backup systems within 180 days of the deletion call.

After you withdraw consent, Supabase temporarily stores a verification value for the deregistration key so that a delayed request cannot reactivate the same registration. This value is deleted in the next hourly cleanup after 24 hours have elapsed. The legal basis is our obligation to give lasting effect to your withdrawal (Art. 6(1)(c) GDPR in conjunction with Art. 7(3) GDPR).

The periods stated above apply to the duel data itself. More information: https://firebase.google.com/support/privacy

Transfers to certified Google companies in the USA are covered by the EU-US Data Privacy Framework. Other necessary transfers to third countries are safeguarded by EU Standard Contractual Clauses.
https://firebase.google.com/terms/data-processing-terms

6. Backup of achievements and career (optional)

The game can back up your unlocked achievements and your career statistics so that they survive a reinstall: on iPhone and iPad to your personal iCloud, on Android through your device backup at Google. Profile backup is enabled by default. On iPhone and iPad, you can turn off syncing with iCloud in the app settings. On Android, this switch stops updates to the profile file intended for backup. An existing profile file may still be backed up by the device backup. You manage the device backup in the Android settings. The in-app switch does not delete backups that have already been stored. Achievements and career can be reset there; on Android, the Google backup will reflect the reset state with the next system backup. Only achievement IDs, progress counters, your career figures, a randomly generated identifier for this installation so that several devices can be combined, plus the name of the game edition, the app version and the time of the last backup are stored. Save games, names, contact details and advertising identifiers are not part of this profile backup. Separately, the general device backup on iPhone and iPad may also contain save games. It is managed through the device settings.

The data stays in your own account in each case: at Apple in the key-value store of your Apple ID, at Google in your device backup. The backup data is not transmitted to the developer, and the developer has no access to it. Apple and Google process it under your agreement with them. The legal basis is the performance of the function you are using (Art. 6(1)(b) GDPR).

More information from the providers: https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy

7. No advertising and no advertising trackers

This app shows no advertising. It uses no advertising networks, no advertising IDs, no advertising trackers, cookies, tracking pixels, fingerprinting, or comparable technologies.

8. Your Rights

Subject to the statutory conditions, you have the right of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with effect for the future; processing before withdrawal remains lawful.

Right to object: Where we process data on the basis of legitimate interests, you may object on grounds relating to your particular situation.

To exercise your rights, you can contact us at kontakt.volksvertreter@protonmail.com. You also have the right to lodge a complaint with a data protection supervisory authority.

9. Changes

This privacy policy may be updated when necessary, for example when new app features are added. The current version is always available in the app.