W. Schlegel's Snake
Last updated: 2026-04-02
Controller: W. Schlegel
Contact for privacy requests: privacy@wschlegel.com
DPO status: No DPO required
EU representative (if required by GDPR Art. 27): Not applicable
This policy explains what personal data is processed when you use Snake, why it is processed, the legal basis under GDPR Art. 6, how long it is stored, with whom it is shared, and your rights under the GDPR.
No advertising trackers or third-party analytics are used.
| Data | Where stored | Retention | Purpose |
|---|---|---|---|
| Player name | Server database (PostgreSQL) & your browser (localStorage) |
Indefinite | Shown publicly on the leaderboard |
| Score | Server database | Indefinite | Leaderboard ranking |
|
Gameplay stats
duration, move count, direction changes |
Server database | Indefinite | Anti-cheat validation |
| OAuth account identifiers and profile name | Server database and short-lived Redis session cache | Until account deletion (DB), up to 10 minutes (Redis) | Sign-in and account linking (Google, Discord, GitHub) |
Session cookiegame_session |
Your browser (cookie) | 10 minutes | Authenticates the WebSocket game connection; strictly necessary for the game to function |
| IP address | Server memory & Redis (temporary) | Up to 60 seconds | Rate limiting to prevent abuse (max 10 connections / 10 game starts per minute per IP) |
One cookie is set: game_session. It is a short-lived, cryptographically
signed token that proves your browser is allowed to open a game connection.
It expires after 10 minutes and is marked HttpOnly, Secure, and
SameSite=Lax.
This cookie is strictly necessary for the game to function. It is not used for advertising or cross-site tracking.
The game also stores your chosen player name and account display information in
localStorage for convenience. This is read only by this site and can be
removed at any time in your browser settings.
| Data | Legal basis |
|---|---|
| Player name & score | Consent You voluntarily enter a name and submit it to the public leaderboard. |
| Gameplay stats | Legitimate interest Required to verify score integrity and prevent abuse. |
| Session cookie & IP address | Legitimate interest Required to operate the service securely, authenticate sessions, and rate limit abuse. |
| OAuth identifiers and linked provider account | Performance of a service requested by you Required to sign in and link login providers. |
Legitimate interests pursued: service security, anti-abuse controls, integrity of leaderboard data, and stable account access.
Data is processed by the controller and by technical infrastructure providers used to host this service (for example, web server/reverse proxy, database, and cache infrastructure).
If you use OAuth login, your browser is redirected to the selected provider (Google, Discord, or GitHub), and we receive account information required for authentication.
Technical processors/recipients used for hosting and operations: [INSERT PROVIDER NAMES, PURPOSE, AND DATA CATEGORIES].
OAuth providers may process data outside the EEA. Where applicable, transfers are based on GDPR Chapter V safeguards used by the relevant provider (for example adequacy decisions or contractual safeguards).
Transfer safeguard details: Google (recipient: Google LLC, United States): Transfers to the U.S. are based on the EU-U.S. Data Privacy Framework (DPF) (including UK Extension and Swiss-U.S. DPF where applicable). If/where DPF is not applicable for a specific transfer, EU Standard Contractual Clauses (SCCs, Decision 2021/914) are used. Discord (recipient: Discord Inc., United States): Transfers to the U.S. are based on Discord’s participation in the EU-U.S. DPF (including UK Extension and Swiss-U.S. DPF). Discord also references SCCs/adequacy mechanisms where relevant. GitHub (recipient: GitHub, Inc., United States): Transfers to the U.S. are generally based on EU SCCs (Decision 2021/914), and GitHub also states compliance with the EU-U.S. DPF (including UK Extension and Swiss-U.S. DPF).
When you submit a score with a name, that name and score are visible to all visitors of the site. Do not use your real name or any personally identifying information as your player name if you do not want it to be public.
Session and temporary anti-abuse data are automatically deleted after short TTLs. Leaderboard and account-linking data are retained until you request deletion, unless legal obligations require otherwise.
Retention schedule details: Session cookie (game_session): 10 minutes from issuance, then expires automatically. OAuth state and OAuth identity cache in Redis: up to 10 minutes, then automatically deleted by TTL. Pending anonymous score claim records in Redis: up to 10 minutes, then automatically deleted by TTL, or deleted earlier immediately after successful claim. IP-based anti-abuse rate-limit keys in Redis/memory: up to 60 seconds, then automatically deleted by TTL. Temporary game-resume state in Redis: up to 60 seconds, then automatically deleted by TTL. Leaderboard score records in PostgreSQL: retained until user deletion request is verified and processed, or until account/entry moderation requires removal. OAuth account-link records (provider, provider_id, oauth_name) in PostgreSQL: retained while the account exists, deleted when the account is deleted or when a linked provider is removed on verified request. Username/account record in PostgreSQL: retained while account exists, deleted on verified erasure request unless retention is required for legal defense or compliance. Local browser storage values (player name, oauth provider display data): retained on device until user signs out, clears browser storage, or uses browser/site data deletion controls.
You can play without OAuth. However, if you do not provide OAuth account data, you cannot use linked account sign-in features. If you do not provide a player name, public leaderboard submission is not available.
No automated decision-making or profiling within the meaning of GDPR Art. 22 is carried out.
Under the GDPR you have the right to:
To exercise any of these rights, contact us using the details below. Requests are handled within 30 days.
You also have the right to lodge a complaint with your local EU/EEA data protection authority.
Lead/supervisory authority contact: Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, BlnBDI), website: https://www.datenschutz-berlin.de/, contact channel: online/contact form and postal contact via the authority’s official “Contact” page.
For privacy requests or questions about this policy: