Privacy policy

1. Controller

Maël Picornell
c/o POSTFLEX PFX-384-194
Emsdettener Straße 10
48268 Greven
Germany

Please do not send parcels or packages to this address.

Email: kontakt.volksvertreter@protonmail.com
Phone: +49 1772997016

2. Website hosting through Cloudflare

This website is provided as a static website through Cloudflare. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

When the website is accessed, technically necessary connection data is processed, in particular IP address, date and time of access, requested file, amount of data transferred, browser and operating system information, and server log data. Processing is necessary to deliver the website securely, reliably and quickly.

The legal basis is Art. 6 para. 1 lit. f GDPR. The legitimate interest lies in the secure and reliable provision of this website. Further information is available in Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

Connection data is stored for as long as it is required to provide the website securely, resolve technical issues or prevent misuse. Transfers to the USA are based on the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply where necessary. More information: https://www.cloudflare.com/cloudflare-customer-dpa/

3. No cookies, no tracking, no external fonts

This website itself does not use cookies, its own tracking, web analytics, advertising trackers, tracking pixels or externally loaded fonts, and it does not store anything in your browser.

If analytics features, contact forms, newsletters, embedded videos or external content are added later, this privacy policy must be updated first.

4. Contact by email

If you contact me by email, the data you provide is processed in order to answer your request. This usually includes your email address, the content of your message and the technical metadata of the email.

We use Proton Mail provided by Proton AG, Switzerland, to receive, store and send emails. Proton stores the data on servers in Switzerland, Germany or Norway; backups are retained for up to 30 days. Transfers of data to Switzerland are covered by an adequacy decision of the European Commission. Proton Mail privacy policy

The legal basis is Art. 6 para. 1 lit. f GDPR. For precontractual or contractual matters, Art. 6 para. 1 lit. b GDPR may apply. Emails are deleted once they are no longer required for processing and no legal retention obligations prevent deletion.

5. Gameplay statistics

From version 1.3.0 onwards, the app does not collect or transmit gameplay statistics through TelemetryDeck.

Older app versions may transmit gameplay and usage data to TelemetryDeck GmbH, Augsburg, to improve game balance and technical stability. Depending on the version, this includes information about game progress, gameplay decisions and usage, as well as technical app and device information. Transmission can be disabled in the app settings.

This app’s TelemetryDeck project was deleted through the provider’s dashboard on 13 September 2026. We are currently clarifying with TelemetryDeck whether any data remains in backups or technical logs and, if so, for how long. Confirmation of complete deletion has not yet been received.

More information: TelemetryDeck's privacy policy

6. In-app purchases

The app offers optional in-app purchases through the relevant app store. Payments are processed by Apple or Google. Payment data such as credit card numbers, bank details or app store account information is not transferred to the provider of this app.

The app uses RevenueCat (RevenueCat, Inc., USA) to verify purchases, manage purchase status, unlock purchased content and restore purchases. RevenueCat is already integrated when you open the main menu to check existing unlocks, even if you do not make a purchase. Technical purchase data may be processed, such as product ID, purchase status, transaction or receipt information, store purchase token, app-specific user identifier, platform, app version and country or region. RevenueCat processes this data as a service provider on behalf of the app provider.

Further information: https://www.revenuecat.com/privacy/

Purchases are processed and restored to fulfil the contract (Art. 6(1)(b) GDPR). Checking existing unlocks when you open the main menu serves our legitimate interest in reliably providing purchased content (Art. 6(1)(f) GDPR).

RevenueCat does not automatically delete customer profiles and purchase histories due to inactivity, even if no purchases have been made. You can request deletion by email, providing your support ID. Further use of the app may create a new profile, as RevenueCat is already integrated when you open the main menu. This does not delete transaction data held by Apple or Google; restoring purchases may transmit purchase data to RevenueCat again.

Processing may take place in the USA. The transfer is safeguarded by EU Standard Contractual Clauses. More information: https://www.revenuecat.com/dpa

7. Suggestions and feedback in the app

If you submit a law suggestion, event suggestion or feedback as a full version user in the app, the content you voluntarily enter is transmitted to Supabase and stored there. The provider is Supabase Pte. Ltd. (Singapore); the data may also be processed outside the EU, particularly in the USA.

We store the selected app language, the time of receipt and a random submission identifier as accompanying data. Error and performance reports also include the app version and build number. For deleting new submissions, we additionally store a verification hash of a random deletion key. No IP-derived hash is stored. As with any internet connection, the sender IP is technically received by the server. The API and database logs of our Supabase project are retained for one day under the current plan.

You can initiate deletion from the suggestions overview; older submissions require a deletion request. Submissions are deleted after processing is complete, or otherwise after 90 days in the next hourly cleanup run. Deletion from the suggestions database does not automatically include the hosting provider's technical logs or backups.

The purpose is exclusively review and possible further development of Demagogue. Submitted suggestions and feedback are not displayed publicly. The legal basis is your consent given by actively submitting (Art. 6 para. 1 lit. a GDPR).

Further information: https://supabase.com/privacy

Transfers to third countries are safeguarded by EU Standard Contractual Clauses. More information: https://supabase.com/legal/customer-resources/data-processing-addendum

8. Duel mode (optional)

Duel mode is an optional online feature. When you retrieve an invitation, the match code you enter is transmitted to Supabase. When you create, join and play a duel, the game configuration, technical version information and game statistics are also processed. These include the starting seed, difficulty, enabled expansions, term limit, deadline, victory conditions and lobbyist setting, as well as scores, aggregated game values, bonus and sabotage effects, decisions as static catalog IDs, and your party color and symbol. Your role in the duel and a randomly generated secret access token are stored to identify your role and verify access permissions. The provider is Supabase Pte. Ltd. (Singapore); the data may also be processed outside the EU, particularly in the USA. No names or contact details are transmitted. Your opponent's display name remains exclusively on your device. If push notifications are enabled, the match code and role are linked to the delivery address of your app installation; the duel data is therefore not anonymous throughout. Details are provided in the notifications section. As with any internet connection, the sender's IP address is technically received by the server. The API and database logs of our Supabase project are retained for one day under the current plan.

The purpose is to run the duel, in particular to exchange game states and determine the result. The legal basis is the performance of the feature you actively use (Art. 6(1)(b) GDPR). Invitations that are not accepted expire after 7 days and are deleted 14 days after their creation. Duels that have been joined follow the configured deadline; ongoing duels are ended no later than after 90 days without a change to the stored duel state. Other ended duels are deleted 30 days after the last change to the stored duel state. Cleanup runs hourly. More information: https://supabase.com/privacy

Until the server-side change to duel mode on 13 September 2026, we stored a pseudonymous identifier derived from the IP address and browser information (User-Agent), together with request counters for each action and time window, to protect against abuse and overload. As part of this change, these identifiers and counters were removed from the active database; this does not automatically include the hosting provider's backups.

Since the change, we store a request counter with an expiry time for each duel, participant role and action. Counters apply for five minutes and are deleted after expiry during the next hourly cleanup, unless they are replaced by a new counting window beforehand. For this purpose, we do not store any identifier derived from an IP address or browser information.

The legal basis for both methods is our legitimate interest in keeping duel mode secure and available (Art. 6(1)(f) GDPR).

Transfers to third countries are safeguarded by EU Standard Contractual Clauses. More information: https://supabase.com/legal/customer-resources/data-processing-addendum

9. Duel notifications (optional)

If you turn on notifications in duel mode, Google creates a delivery address for this device and hands it to the app. Google also processes a Firebase installation ID for this purpose, which identifies this app installation. Google also processes technical device, app and diagnostic data, such as information about the device, operating system, app version and performance of the integrated software, to provide the services and improve their quality. On iPhone and iPad, delivery also uses Apple's Apple Push Notification service (APNs). That address is transmitted to Supabase and stored there, together with the duel's game code, your role in it, the platform, the language set in the app and whether this is a test build or a store build. When an event occurs, the server sends the title and text of the message along with the game code, the current legislative term and an identifier for the event to your device via the Firebase Cloud Messaging service. The providers are Google Ireland Limited and Google LLC (USA); the data may be processed in the USA. No names, contact details, saved games or advertising identifiers are transmitted. As with any internet connection, the sender IP is technically received by the servers involved.

The deletion request to Google is made only from version 1.3.0 onwards. In version 1.2.3, the app only tries to unregister the address on our server.

As long as you have never enabled notifications, the app does not start the Firebase push service or request a delivery address through it. You can switch them off again at any time in the app settings. The app then tries to delete the delivery address from our server and asks Google to delete it as well. If this fails, for example without an internet connection, the address may remain stored for the time being. Unregistering the address on our server is retried during a later check. A failed deletion request to Google is not retried automatically; the address may remain stored there. The separate Firebase installation ID remains stored by Google until its deletion is explicitly requested. The app currently does not make this request when notifications are turned off. Following a deletion request, Google removes the data from its live and backup systems within 180 days. Further notifications may be sent until the address is successfully unregistered or automatically deleted from our server. From the next app launch, the service is no longer started while notifications are turned off.

Turning notifications off only in the device settings blocks their display but does not delete the stored address. After a duel ends, its delivery address is removed during automatic cleanup once no notifications for it remain to be processed. Addresses that have not been confirmed for 45 days are also removed automatically. The periods stated above apply to the duel data itself. The legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future.

More information: https://firebase.google.com/support/privacy

Transfers to certified Google companies in the USA are covered by the EU-US Data Privacy Framework. Other necessary transfers to third countries are safeguarded by EU Standard Contractual Clauses. More information: https://firebase.google.com/terms/data-processing-terms

10. Backup of achievements and career (optional)

The game can back up your unlocked achievements and your career statistics so that they survive a reinstall: on iPhone and iPad to your personal iCloud, on Android through your device backup at Google. Profile backup is enabled by default. On iPhone and iPad, you can turn off syncing with iCloud in the app settings. On Android, this switch stops updates to the profile file intended for backup. An existing profile file may still be backed up by the device backup. You manage the device backup in the Android settings. The in-app switch does not delete backups that have already been stored. Achievements and career can be reset there; on Android, the Google backup will reflect the reset state with the next system backup. Only achievement IDs, progress counters, your career figures, a randomly generated identifier for this installation so that several devices can be combined, plus the name of the game edition, the app version and the time of the last backup are stored. Save games, names, contact details and advertising identifiers are not part of this profile backup. Separately, the general device backup on iPhone and iPad may also contain save games. It is managed through the device settings.

The data stays in your own account in each case: at Apple in the key-value store of your Apple ID, at Google in your device backup. The backup data is not transmitted to the developer, and the developer has no access to it. Apple and Google process it under your agreement with them. The legal basis is the performance of the function you are using (Art. 6(1)(b) GDPR).

Further information from the providers: https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy

11. Advertising

Whether the app shows ads depends on the installed app version:
Google Play: Up to and including version 1.1.0 the app showed ads; from version 1.1.1 onwards it is ad-free.
Apple App Store: Up to and including version 1.0.4 the app showed ads; from version 1.1.1 onwards it is ad-free.

In the ad-free versions (1.1.1 and later), no ad networks, advertising identifiers, or ad-related tracking are used.

In the older versions that still show ads, ads were served via Google AdMob (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Only non-personalized ads were shown. In this context, in particular the IP address, approximate location, and device and app information as well as interactions with ads were processed. Consent was obtained through Google's consent management (User Messaging Platform, UMP). No cross-app or cross-device tracking for advertising purposes took place. The legal basis was your consent (Art. 6 para. 1 lit. a GDPR) and Art. 6 para. 1 lit. f GDPR.

Further information on data processing by Google: https://policies.google.com/privacy

12. Your rights

Subject to the statutory conditions, you have the right of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with effect for the future; processing before withdrawal remains lawful.

Right to object: Where we process data on the basis of legitimate interests, you may object on grounds relating to your particular situation.

To exercise your rights, you can contact us at kontakt.volksvertreter@protonmail.com. You also have the right to lodge a complaint with a data protection supervisory authority.

13. Changes

This privacy policy may be updated when necessary, for example when new website or app features are added. The current version is available on this website.