Delete account and data

7. Retention period

Game data remains stored until the user deletes it. Backup copies of the database are made in two places: daily on the same server, kept there on a rolling basis for 14 days, and daily as an artifact of an automated run in our private repository at GitHub (GitHub Inc., part of the Microsoft group), kept there for 30 days and then automatically deleted. This second copy exists so that a failure of the server does not also take all backups with it. It contains the same data as the application, including display names, account identifiers, uploaded profile pictures and the fingerprint of the email address mentioned above, and is accessible only to the operators. GitHub processes this data as a processor under Art. 28 GDPR; this involves a transfer to the USA, safeguarded by the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards on request at the address given above. Your sign-in session expires by itself after 90 days at the latest; when you sign out it is deleted immediately. Your account is held by us and remains until you delete it (see section 8).

8. Your rights

You have the rights of access, rectification, erasure, restriction, data portability and objection (Arts. 15 to 21 GDPR). You do not need to fill in a form or give reasons: an email to korbi@vulpessagax.com is enough, one sentence will do. We reply within one month.

Your account is held by us. Two things need to be distinguished here:

• Your game data (progress, times, points) you delete yourself in the game: tap your name at the top right, then Delete game data. Your account remains, and you can keep playing. That is also where you change your display name.
• Your entire account you also delete yourself: in the settings under Delete account for good. This removes your display name, sign-in method, profile picture, progress, trophies, invitations, feedback, reports and blocks, leaderboard and duel entries as well as the fingerprint of your address mentioned above. This cannot be undone. From backup copies the data disappears after the periods stated in section 7; if anything goes wrong, a message to korbi@vulpessagax.com is enough.

You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA, the Bavarian Data Protection Authority), Ansbach.

Right to object. Some processing we carry out because we have a legitimate interest in it: secure operation, counting on which platform (browser, iOS or Android) you play with your account, and counting how often a puzzle is started (Art. 6(1)(f) GDPR). You can object to this at any time. An informal message to korbi@vulpessagax.com is enough, you do not have to give reasons; we will confirm your objection and stop processing the data concerned. In fairness, regarding event counting we should add: nothing is stored there that points to you, so there is also nothing we could attribute to you and remove. We are happy to explain this in detail on request.