Privacy Policy

Version 2026-08-08

This explains what AtlasRivals does with your personal data, in plain language. If anything here is unclear, email us and we will explain it.

Who is responsible

The controller of your data is Code7 d.o.o., Zagorska ulica 105, 42220 Novi Marof, Croatia, reachable at [email protected]. We have not appointed a Data Protection Officer, and we are not required to under Article 37 GDPR.

What we collect, and why

  • Your name, email address and profile picture, from Google when you sign in. We use them to create and run your account and to show you to friends. Legal basis: performing our contract with you (Art. 6(1)(b)).
  • A record that you confirmed you are 16 or over, and which version of the Terms you accepted, with the date. We keep this because the law requires us to be able to show it (Art. 6(1)(c), with Art. 8). We do not collect your date of birth.
  • The rounds you play — which mode, when you started and finished, how many you got right and the score. This is the game: without it there is no streak, no personal best and no daily challenge. Legal basis: performing our contract with you (Art. 6(1)(b)).
  • Who you have duelled. We do not keep a friends list; your leaderboard is worked out from the duels themselves. Legal basis: performing our contract with you (Art. 6(1)(b)).
  • Your sign-in session, which records the browser it was created from, when it was created and when it expires, and keeps you signed in for 7 days. Legal basis: performing our contract with you (Art. 6(1)(b)) — without it you would have to sign in again on every page. We do not record the IP address you signed in from.
  • Your IP address, briefly and only while the request is happening, to stop anyone hammering the sign-in endpoints automatically. It is used to count requests and then discarded — it is not written to the database and not kept in any log we control. Legal basis: our legitimate interest in keeping the service standing up (Art. 6(1)(f)).

We do not run advertising, we do not profile you, and we make no automated decisions that have legal or similarly significant effects on you.

Cookies

AtlasRivals sets two cookies, both our own. Neither is used for advertising or analytics, which is why you are not asked to accept a cookie banner.

  • A session cookie that keeps you signed in for 7 days. It is HttpOnly, SameSite=Lax and, in production, Secure.
  • A short-lived sign-in cookie (about 10 minutes) that protects the redirect to and from Google.

Who else sees your data

Other players, when you duel them. Sending someone a challenge link shows them your name and your score, and anyone who answers it appears on your leaderboard with theirs. That is the point of a duel, but it is worth being plain about: a challenge link works for whoever holds it, so send it to people you meant to send it to. Nobody sees the answers you gave, only how many you got right.

Deleting your account removes you and your scores. Rounds other people played against you stay theirs — we do not delete another person’s history to complete yours.

These companies process data on our behalf:

  • Hetzner Online GmbH (Germany) hosts our servers and database.
  • Cloudflare routes and protects traffic to the site. This can involve transfers to the United States, covered by the EU–US Data Privacy Framework and standard contractual clauses; email us for a copy.
  • Google handles the sign-in step, and is a separate controller for what happens inside your Google account.

We do not sell your data, and we do not share it for advertising.

How long we keep it

Your account data and your play history are kept until you delete your account, which erases both immediately. Sessions expire 7 days after they were last used; expired ones are deleted by a nightly cleanup, which takes the browser information with them. Signing out deletes the session immediately.

Your rights

You can access, correct, delete, restrict or object to our use of your data, and take your data elsewhere. Two of these are buttons on your account page:

  • Download my data gives you everything we hold, as a JSON file.
  • Delete my account erases your account immediately.

For anything else, email us; we answer within one month. Signing out ends your session and deletes its record straight away.

You may also complain to the Croatian data protection authority, AZOP, Selska cesta 136, 10000 Zagreb (azop.hr).

Is any of this required?

You need an account to play, and an account needs a name and email address. You do not need an account to read this site.

Changes

If we change this policy in a way that matters, we will ask you to accept the new version the next time you play.