Last updated: October 2026
This policy explains which personal data we process when you use "Wizard Party" (wizardparty.fun), for what purposes, on which legal basis, for how long, and which rights you have under the General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
In short: You can play without an account and without giving us your name, email or real identity. To run, secure and improve the game, our game server records what happens in each game (moves, chat, settings, connection and device details) under a random player ID. Optional analytics on performance and errors in your browser only run with your consent. Player accounts are optional. We never sell data and never use advertising trackers.
Felix Huisinga
Mannstaedtstr. 16
65187 Wiesbaden
Germany
Email: developer@rabitem.de
We are not required to appoint a data protection officer (§ 38 BDSG). Please send all privacy requests to the address above.
When you open the website, our hosting provider Vercel automatically processes the data your browser sends: IP address, date and time, requested URL, referrer, browser and operating system (user agent). This is technically necessary to deliver the website and to detect attacks. Logs are kept by Vercel only for a short period and are not combined with other data.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website).
Real-time gameplay runs over a secure WebSocket connection to our game server on Cloudflare Workers (Durable Objects). Cloudflare processes your IP address and connection data to establish the connection. The game state of a room is held on the game server while the room is in use.
Legal basis: Art. 6(1)(b) GDPR (providing the game you requested).
All fonts are hosted on our own servers. Your browser does not connect to Google or other font providers.
On your first visit we create a random player ID (e.g. player-1700000000000-abc1234) and store it in your browser's local storage together with your chosen player name, settings, sounds, recent rooms and local statistics. The player ID lets you reconnect to a running game. It contains no information about you.
Your chosen player name is temporarily reserved on our servers (Upstash Redis) so that two players cannot use the same name at the same time; the reservation expires automatically after 5–30 minutes of inactivity. Anonymous, aggregated counters (e.g. total games played) are stored without any reference to you.
Legal basis: § 25(2) No. 2 TDDDG (storage strictly necessary for the service you requested) and Art. 6(1)(b) GDPR.
Our game server records events of every game in our database, linked to the room, the game and your random player ID (and, if you are signed in, nothing more than that ID). We do not store IP addresses in these records.
| Data | Examples | Kept for |
|---|---|---|
| Game events | Game start and end, dealt cards, trump, bids, played cards, tricks, scores, pauses, timeouts, rematches, lobby joins/leaves and reconnect grace periods | 13 months |
| Settings | Room and rule settings, sound preferences (names only, never your audio files), muting other players | 13 months |
| Chat and emotes | Chat message text, emotes sent | Message text: 30 days, then deleted (the fact that a message was sent is kept) |
| Rejected actions | Invalid or not permitted moves with error code | 90 days |
| Connection and device data | Browser and version, operating system, device type, language, country (derived by Cloudflare, not the IP address), Cloudflare data center, connection duration | 90 days (full user agent string), afterwards only browser, OS and device type |
Purposes: operating and debugging the game (reconstructing exactly what happened when something goes wrong), detecting cheating, abuse and harmful chat content, securing the service, and improving game balance and compatibility with browsers and devices based on aggregated statistics.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in a stable, fair and secure game. The records are pseudonymous, contain no IP addresses and are deleted on a fixed schedule. You can object at any time (section 12).
You can create an account to keep your progress across devices. Without an account nothing in this section applies to you.
Your profile at /u/<username> is public by default and shows username, tagline, avatar, level, statistics, achievements, tournament trophies (award, placement, field size, date; the tournament's name only for public tournaments), pinned games and, only if you enable it, your recent games. Email addresses and internal IDs are never shown. You can make the profile private in your account settings at any time.
Only signed-in players use these features. While the site is open, your browser reports every 25–60 seconds that you are online and whether you are in the menus, a lobby or a game (with the room code; to confirm you really sit at that table, our game server checks your browser's game session ID, which is not stored). This status is kept for about two minutes and shown only to your friends; as "Invisible" you appear offline. Friends see the room code only while you wait in a lobby, so they can join. Signed-in players play under their username; players at the same table can see the account behind a seat so they can add each other. Search shows public profiles by name and any account by its exact name. Inbox notifications are deleted after 30 days, declined friend requests after 3 days. If a friend invites you, or someone sends you a friend request, while you are offline, we email you (via Resend, see 6.4); to an address you have not verified yet only a few times a day. Each kind can be turned off separately under Profile → Communication or with the unsubscribe link in the email.
Legal basis: Art. 6(1)(b) GDPR (the friend features you use); invite emails: Art. 6(1)(f) GDPR (letting your friends reach you), with a one-click opt-out at any time (Art. 21 GDPR).
Verification, password-reset, two-factor, deletion-confirmation and game invite emails are sent via Resend (Resend, Inc., USA). When you set a password, we check it against known data breaches using the "Have I Been Pwned" range API: only the first 5 characters of the password's SHA-1 hash leave our server, never the password. If you sign in with Google, Discord or GitHub, we receive your name, email, profile picture URL and provider ID from that provider.
Sessions expire after 60 days of inactivity or immediately when you sign out. Everything else is kept until you delete your account. In your account under "Data" you can download all your data (Art. 15, 20 GDPR) and delete your account (Art. 17 GDPR); deletion removes all account records and uploaded files.
Legal basis: Art. 6(1)(b) GDPR (account contract); public profile and breach check: Art. 6(1)(f) GDPR (protecting your account, letting players show their progress; you control visibility).
Signed-in players can host and enter tournaments. Everyone who can open a tournament page (anyone for public tournaments, only holders of the invite link for private ones) sees the names of its entrants, the tables, standings and awards. To seat you at your table, our server issues a signed, short-lived seat pass that your browser keeps in session storage until the tab is closed; our game server checks it and reports the result of the match (placement, score, bids and tricks per round, whether you showed up) back to our server. Players see entrants by username; tournament pages and seat passes also carry the random internal ID of each entrant's account (it reveals nothing else about you), so results can be matched to accounts. If you delete your account, tournaments you host that have not started are cancelled, your name is removed from every tournament you hosted, and your entries, results and awards are deleted; tournaments already running continue without you. Your data export includes your entries and every stored result.
Legal basis: Art. 6(1)(b) GDPR (the tournament you host or enter).
Only if you choose "Accept analytics" in the privacy banner do we read information from your browser and device and send it to us. Without consent, none of this happens and the game works exactly the same.
These records carry a random ID per browser tab and, to connect them with the game records, your player ID and room. Your IP address is used only briefly to block abuse of the endpoint and is not stored; we store the country derived by our host. Kept for 90 days.
Vercel Inc. provides aggregated visitor and performance statistics without cookies and without cross-site tracking. See the Vercel Analytics privacy policy.
Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR (consent). Your consent is valid for 12 months and can be withdrawn at any time with effect for the future, as easily as you gave it:
We do not use advertising or cross-site tracking cookies.
| Name | Purpose | Duration | Type |
|---|---|---|---|
| wizard-party-player-id, -username, -settings, -session, -recent-rooms, -player-stats and further wizard-party-* keys (local storage) | Player ID, name, settings, sounds, statistics, tutorial state | Until you clear your browser data | Necessary |
| wizard-party-cookie-consent (local storage) | Remembers your privacy choice, its version and date | 12 months | Necessary |
| better-auth.session_token / session_data (cookie) | Keeps you signed in (accounts only) | 60 days / 5 minutes | Necessary |
| better-auth.two_factor, trust_device, dont_remember, last_used_login_method, OAuth state cookies | Two-factor sign-in, trusted device, sign-in method hint | 10 minutes to 30 days | Necessary |
| wizard-party-account-* (local storage) | Uploading results and syncing settings for signed-in players | Until sign-out or clearing browser data | Necessary |
| Session/tab ID for analytics (session storage) | Groups the analytics events of one browser tab | Until the tab is closed | Analytics (consent) |
| wizard-party-tournament-ticket:<table> (session storage) | Seat pass for your tournament table (signed-in players only) | Until it expires (at most 2 hours) or the tab is closed | Necessary |
Legal basis for necessary storage: § 25(2) No. 2 TDDDG; for analytics: § 25(1) TDDDG (consent).
We use the following service providers, bound by data processing agreements (Art. 28 GDPR):
Sign-in providers (Google, Discord, GitHub) and Have I Been Pwned are independent controllers and only involved if you use the respective feature.
Our database and server functions run in Frankfurt, Germany. The providers above are US companies, and some data is processed in the USA (e.g. uploaded custom sounds in Vercel Blob, global edge delivery). Transfers are based on the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR) where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) included in the providers' data processing agreements.
| Data | Deleted after |
|---|---|
| Chat message text | 30 days |
| Inbox notifications (friend requests, game invites) | 30 days |
| Online status | About 2 minutes after your last heartbeat |
| Full user agent in game records, rejected actions | 90 days |
| Analytics data (section 7) | 90 days |
| Game records (section 5) | 13 months |
| Name reservation, rate-limit counters | Minutes (automatic expiry) |
| Account data (section 6) | When you delete your account; sessions after 60 days of inactivity |
| Local and session storage | When you clear your browser data or close the tab |
Deletion runs automatically every day. Statutory retention obligations remain unaffected.
You have the right to:
Right to object (Art. 21 GDPR): Where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.
Signed-in players can export and delete their data themselves in their account. For everything else, email developer@rabitem.de. Because guest records are only linked to a random player ID, please include it so we can find your data:
No player ID is stored in this browser.
You are not obliged to provide personal data. Without the technically necessary data (section 3–5) the game cannot be played; analytics and accounts are optional. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
Wizard Party is a family-friendly card game. Players under 16 may only consent to analytics or create an account with the consent of a parent or guardian (Art. 8 GDPR, § 25 TDDDG). Please do not use your real name as player name or username. If you believe a child has provided personal data without permission, contact us and we will delete it.
We protect your data with technical and organisational measures (Art. 32 GDPR), including:
We update this policy when our services or the law change. If a change affects what you consented to, we will ask for your consent again.