Privacy policy

• No tracking: no analytics, no ads, no social media plugins and only cookies that are technically necessary.
• Games stay on your phone: what you count in the app at the kitchen table never leaves your device.
• Data only when you do something: when you sign up for the beta, ask for or sign in to an organizer account, play in a tournament or vote on the roadmap.
• Few service providers: the website runs on a rented server, the database and server functions at Convex, emails are sent and received by Resend. Requests from organizers and emails to our addresses arrive in our mailbox at Outlook.com (Microsoft). We do not sell any data.
• You have rights: access, correction, deletion and more. An email to Georg.Popp@outlook.com is all it takes.

The controller for the processing of data on this website and in the app is:

We are not required to appoint a data protection officer. If you have questions about privacy, write to us directly.

The website runs on a virtual server of our own that we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. The server is located in Falkenstein, Deutschland. The hosting company only provides the hardware and processes the data on our behalf.

When you open a page, your browser necessarily sends along:

• your IP address
• the date and time of the request
• the address you requested, for a link from one of our emails including the key in it
• your browser's identifier (user agent)
• the page you came from, if your browser sends it

The server needs this information to deliver the page and to run securely. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is a stable and secure operation. Where the server writes this information to log files, it stays there only briefly for troubleshooting and fending off attacks and is then deleted. We do not build profiles from it and do not combine it with other data.

The connection to the website is encrypted with HTTPS.

Our database and the functions behind it (for the beta sign-up, tournaments and votes, for example) run at Convex, Inc., San Francisco, USA. Everything described in the following sections is stored by Convex on our behalf.

When you open the website, your browser connects directly to Convex's servers, so that, for example, tournament standings update live and organizers stay signed in. In doing so, Convex processes your IP address and technical connection data. The app only connects to Convex when you take part in a tournament.

The legal basis is Art. 6 (1) (f) GDPR (our interest in a reliable and secure operation) and, for the individual data, the basis named in the respective section. On the transfer to the USA, see Transfers to the USA. More from Convex: Convex's privacy policy.

We send our emails through Resend, a service of Plus Five Five, Inc., San Francisco, USA: the beta's confirmation and welcome emails, the receipt for an organizer request, the notification to us and the invitation to an organizer account. For this, Resend processes your email address, the content of the email and delivery information.

If you write to an address on our domain (for example feedback@wizard-tournaments.com) or reply to one of our emails, Resend receives the email and our system forwards it to our mailbox at Outlook.com (Microsoft), with your address as the reply-to address. For this we only store the email's ID for 30 days so that nothing arrives twice. Resend keeps the email itself under its own rules; we delete the copy in our mailbox as soon as we no longer need it. The legal basis is Art. 6 (1) (f) GDPR (our interest in reading and answering your message), and Art. 6 (1) (b) GDPR for questions about a contract or a request.

So that no email gets lost unnoticed, our system asks Resend whether it was delivered. If an email was rejected or could not be delivered, we see this in the admin area and can send it again. We do not use open or click tracking.

The legal basis depends on the purpose of the email (see Beta sign-up, Requests from organizers and Organizer accounts). Sent emails, including their content and links, stay in our sending system for two weeks at most and are then deleted. Resend keeps delivery data under its own rules: Resend's privacy policy.

Convex, Resend and Microsoft (for our mailbox at Outlook.com) process data in the USA. Insofar as they are certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise we transfer data on the basis of the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR). Whether a company is certified is shown in the official Data Privacy Framework list.

Apple and Google process beta data under their own responsibility, also in the USA. They explain the legal bases for this in their privacy policies.

Which data

When you sign up for the beta, we store:

• your email address
• your platform (iPhone, Android or both) and the language of the website
• when you signed up and confirmed and when which email went out
• how far the setup has got, for example whether the TestFlight invitation went out and the identifier Apple uses for you as a tester
• whether our emails were delivered, and an error message if something went wrong

The links in our emails (to confirm and to leave) contain random keys. In our database we only store an irreversible checksum (SHA-256) of them, never the key itself. The link itself is in the email and therefore stays in our sending system for up to two weeks (see Sending emails). When you open it, the address including the key briefly ends up in the server's logs (see Hosting). The confirmation page removes the key from your browser's address bar right away.

To prevent abuse, at most one beta email every 5 minutes and at most three a day go to the same address. For this, we only store a checksum of the address together with a counter.

What for and on which legal basis

We send you the confirmation email, add you to the test group after you confirm, send you the welcome email with all the links and write to you about the beta now and then. If you sign up with an address that is already in, we send the welcome email again. The legal basis is your consent (Art. 6 (1) (a) GDPR).

We use double opt-in: the link in the confirmation email opens a page, and nothing happens until you click “Confirm sign-up” there. Merely opening the link confirms nothing, because some email programs open links on their own. We store the times of sign-up and confirmation as proof of your consent.

For how long

• Confirmed sign-ups are kept until you leave the beta. Then we delete them immediately, together with all links to leave.
• Unconfirmed sign-ups: the link in the confirmation email is valid for 7 days. 30 days after it expires, that is 37 days after the email, we delete the sign-up automatically.
• Sign-ups without a link: if no confirmation email ever went out, for example because sending failed, we delete the sign-up 37 days after it was made.
• The old waiting list: anyone who joined our old waiting list before the website's relaunch gets one confirmation email. After that, the same rules as above apply, counted from that email.
• Emails, including their content and links, stay in our sending system for two weeks at most and are then deleted.

Withdrawal

You can withdraw your consent at any time: through the “Leave the beta” link in every email from us or by email to Georg.Popp@outlook.com. Each of these links stays valid until you have left the beta; after the click, the page asks once more. We then delete your sign-up together with all links and remove you from our TestFlight group if our system added you there (see TestFlight and Google Play). The withdrawal applies to the future; what happened until then remains lawful.

The beta versions of the app are distributed by Apple and Google, not by us.

iPhone: After you confirm, we send your email address to Apple through the App Store Connect API and add you to our TestFlight test group. Apple then sends you the invitation. Through TestFlight we see whether you accepted the invitation and installed the app, and we receive crash reports and feedback that you send through TestFlight yourself. The legal basis is your consent (Art. 6 (1) (a) GDPR).

When you leave the beta, we remove you from our test group if our system added you there. Other TestFlight access, for example to other providers' apps, is not affected. If the removal does not work at Apple right away, our system keeps trying for about three days; during that time we only keep the identifier Apple uses for you as a tester. If it still does not work after that, we remove you by hand.

If we send you our public TestFlight link instead of an invitation, we send nothing to Apple. You then join through the link yourself and also end your participation yourself, in TestFlight.

Android: Here we send nothing to Google. You join our Google Group for testers with your Google account yourself and sign up as a tester on Google Play. We then see the members of the group with their email addresses as well as the crash reports and feedback Google Play provides to us. You leave the group and the test yourself, at Google.

What Apple and Google do with your data beyond that is their own responsibility: Apple's privacy policy, Google's privacy policy.

With the form on the organizers' page you can ask for access to the tournament tool. We store your name, your email address, your message, the language and the time and, if you provide them, your club or organization, your city and the expected number of players.

We receive the request with all your details by email and you receive a receipt, both through Resend. The receipt is a fixed text and contains nothing from the form. We only use the information to answer you and, where appropriate, to set up an account for you. The legal basis is Art. 6 (1) (b) GDPR (steps prior to use at your request) and Art. 6 (1) (f) GDPR (our interest in answering requests).

Recipient: the email with your request goes to our administrators' mailbox at Outlook.com, Microsoft's email service. Microsoft stores it there for us and also processes it in the USA (see Transfers to the USA and Microsoft's privacy statement).

For how long: we delete requests automatically 12 months after they came in, handled or not. If we no longer need a request or you ask us to, we delete it sooner. We delete the email in our mailbox as soon as we no longer need it. To prevent abuse, we limit the number of requests per address, again only through a checksum of the address.

Accounts are created by an administrator; there is no open sign-up. They only enter your name and your email address. We then send you an invitation through Resend with a link to choose your password yourself. We store the link only as a hash; it works for 7 days and only once. For an account we store your email address, your password only as a hash (it is kept by our sign-in system Convex Auth, nobody on our side knows it), your display name, the address of a logo if you add one, your sign-in sessions and the tournaments you create.

We need this data so that you can use the tournament tool (Art. 6 (1) (b) GDPR). It is kept as long as your account exists. Write to us if you would like us to delete your account: an administrator then deletes it with all its sign-in data, either together with your tournaments or by taking the tournaments over so their results are kept. To keep you signed in, the website sets two cookies after you sign in (see Cookies and local storage).

Your display name and your logo appear with your tournaments on the live display and in the player view.

For a tournament we store what the organizer enters (name, date, place, format), the players' names, the seating, bids, tricks, points and the standings. Players can also sign themselves up with a name of their choice, through the QR code or the tournament code.

This information is public: anyone who knows the six-digit tournament code sees the names, the seating and the standings on the live display and in the player view. That is what tournaments are for; the code usually hangs big on the wall. Tip: a first name or a nickname is plenty.

The organizer decides which names are entered and should let their players know. The legal basis is Art. 6 (1) (f) GDPR: the interest of organizers and players in holding a tournament and seeing the results together.

For keeping score at the table, we store with the table the random identifier of the phone that is currently keeping score. That way the system knows which device may enter results.

Tournaments stay stored so that everyone can look at the results later. If you want your name removed from a tournament, contact the organizer or us directly at Georg.Popp@outlook.com. We will then replace or delete it.

If an organizer added their logo as a link, the live display loads the image from the server it lives on. That server's operator sees your IP address in the process.

On the roadmap page you can vote for features without an account. With your first vote, your browser creates a random identifier and keeps it in local storage. We store this identifier together with the features you voted for; we do not store a name, email address or IP address with it.

That way each vote counts only once and you can take it back later (Art. 6 (1) (f) GDPR). If you clear your browser's local storage, the link to your votes is gone; the votes themselves still count.

For how long: the identifier and the votes are kept as long as the voting on the roadmap exists. Nothing about you as a person is part of them.

• Games at the table are stored by the app on your device only: the players' names, bids, tricks, points and your settings. None of it is sent to us.
• No account, no tracking: the app contains no analytics or advertising tools.
• Tournaments: when you join with a tournament code, the app connects to Convex. It sends the code, a random device identifier and the results of the table you keep score for, and loads the tournament's names, seating and standings. It remembers the last tournament on the device so it can keep counting without a connection.
• Links such as the legal notice and the privacy policy open in your browser.

Downloads, updates and crash reports go through Apple (App Store, TestFlight) and Google (Google Play). What they collect and pass on to us depends on their rules and your device's settings.

The website only stores what a feature you are using needs. There are no tracking or advertising cookies, and therefore no cookie banner. The legal basis is § 25 (2) no. 2 TDDDG; any further processing is based on Art. 6 (1) (f) GDPR.

You can delete cookies and local storage in your browser at any time. The pages keep working; only your settings are forgotten, and organizers sign in again.

We serve our font (Judson) from our own server. We do not embed content from Google Fonts, content delivery networks, social networks or video platforms. Links to other sites, such as Apple, Google or AMIGO, are plain links: only when you click one does your browser connect to the other provider. The one exception is organizers' logos on the live display (see Tournaments).

You have the right to:

• access your data (Art. 15 GDPR)
• have incorrect data corrected (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on our legitimate interest (Art. 21 GDPR)

You can withdraw consent at any time with effect for the future (Art. 7 (3) GDPR). For all of this, an email to Georg.Popp@outlook.com is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example where you live. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany. The addresses of all supervisory authorities in Germany are listed by the Federal Commissioner for Data Protection.

You do not have to give us any data. Without an email address, however, we cannot invite you to the beta, and without a name you will not appear in any tournament standings. We do not use automated decision-making or profiling.

When the website, the app or our service providers change, we update this policy. The version published here applies.