This is a courtesy translation. The legally binding version is the German privacy policy. Version: 2026-10-09
This page explains how personal data is processed when you use Putty Party.
Frederic Abraham, Pößnecker Straße 14, 12209 Berlin, Germany. Email: puttyparty@fabraham.dev
The application runs on Cloudflare (Cloudflare, Inc.) infrastructure (Cloudflare Workers, D1 database). When you visit, technically necessary data such as IP address, timestamp and the requested resource are processed to deliver the page and ensure security (Art. 6 (1)(f) GDPR). A data processing agreement is in place with Cloudflare.
Generated from this installation's actual configuration, so it always reflects what is in fact switched on here:
| Recipient | Purpose | Location |
|---|---|---|
| Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA | Application runtime, database, object storage (backups and uploaded images), delivery, access control for the operator console, bot mitigation, e-mail forwarding | EU |
| Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA | Transactional e-mail: address confirmation, invitations, password resets | Sending in the EU (Ireland), logs in the US |
| Sentry (Functional Software, Inc.) — EU-Region, Rechenzentrum Frankfurt | Error reporting, for fault diagnosis | EU |
The following services receive personal data as independent controllers (Art. 4(7) GDPR) — they do not process on our instructions:
| Recipient | Purpose | Location |
|---|---|---|
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland | Sign-in with a Google account — only where that sign-in method is chosen | EU / US |
| Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Irland | Payment processing and invoicing | EU / US |
Creating a game: game name, date and (optionally) location — all freely chosen.
Entering a score: the name you enter (a pseudonym is fine), an optional team/department, and your stroke count. The legal basis is performing the game / your own entry (Art. 6 (1)(b)/(f) GDPR). Please don't enter sensitive data.
Management link: organisers receive a secret link granting management of exactly one game.
Anyone who creates a game or starts a demo space without an account, or writes to us through the contact form, is asked in the form to agree to the spam check by Cloudflare Turnstile; without the tick the form cannot be sent. Turnstile is loaded only when the form is sent, not when a page is viewed or the form is opened. Cloudflare then processes technical device and usage data (e.g. IP address, browser characteristics and signals from the interaction with the page) and may store or read information on your device, to tell humans from bots. The provider is Cloudflare (see the recipients above). The legal basis is your consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG). It applies only to that one submission and is not stored by us; you can refuse it, or withdraw it for the future, by not ticking the box. A regular account can be created without Turnstile. Cloudflare gives further details in its Turnstile Privacy Addendum. No tracking cookies are set.
When you write to us through the contact form on the home page, we process your name, email address and message in order to answer your enquiry. The message is delivered to us by email through our email provider Resend (see the recipients above); we keep a copy in our email log. A Telegram bot additionally notifies us that an enquiry has arrived — that notification contains nothing from your message: no name, no address, no text. The legal basis is taking steps at your request prior to entering into a contract (Art. 6 (1)(b) GDPR) or our legitimate interest in answering enquiries (Art. 6 (1)(f) GDPR). The copy in the email log is deleted after 90 days; we delete the email in our inbox once the enquiry is settled, unless statutory retention duties apply.
We set only strictly necessary cookies: pp_lang to remember your language choice and, where accounts are enabled, session cookies for signing in. None of them are used for analytics or tracking, so no consent is required.
Fonts are served locally from this server; no data is transferred to third parties (e.g. Google Fonts).
There is no tracking and no advertising-related profiling of your behaviour.
Game and score data is kept until the responsible organiser resets, archives or deletes the game.
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a data protection authority. Contact puttyparty@fabraham.dev to exercise these rights.
This summarises the German section „Ergänzende Hinweise für Konten, Bezahl- und Team-Funktionen“, which is the authoritative wording. Where accounts are enabled we process name, e-mail address and a password hash to run your account (Art. 6(1)(b) GDPR), kept until the account is deleted. Signing in with Google happens at Google, which acts as an independent controller for the sign-in under its own privacy policy; we only receive your e-mail address, name and verification status. Payments are processed by Stripe on Stripe-hosted pages (Art. 6(1)(b)); invoice data is retained for eight years (§ 147 AO). Transactional e-mail is sent via Resend from the EU, with account and delivery logs stored in the US under the EU-US Data Privacy Framework (Art. 6(1)(b)); we keep our own copy of each such e-mail (recipient, subject, content) for 90 days to resolve delivery questions, and it is deleted with the account. Error reports go to Sentry with e-mail addresses and secret links stripped (Art. 6(1)(f)); the region is listed in the recipient table above.
Sessions add strictly necessary cookies (no analytics, no ads — so still no consent banner); session identifiers live in a globally replicated key-value store, with US transfers covered by the EU-US Data Privacy Framework. Access to customer data through our operator console is logged (identifiers only) for 365 days (Art. 6(1)(f)). Backups rotate after 35 days. Records of which terms version you accepted are kept for the statutory limitation periods. For games created without an account, we are the controller for the participant data entered; data subjects can contact us directly at puttyparty@fabraham.dev for access, rectification or erasure.
← Putty Party ·Imprint ·Privacy ·Terms ·Withdrawal ·DPA ·Cancel contracts here ·Report content