Privacy Policy
Effective: October 15, 2026
1. Data Controller
Reindeer Entertainment OÜ
Sepapaja 6, Tallinn 15551, Estonia
Registration number: 16202332
Email: privacy@reindeer.red
2. Scope of This Policy
This privacy policy applies to the processing of personal data in connection with the use of the GreenCloth Games platform (hereinafter: the “Service”). The Service includes the greencloth.games website, the associated progressive web applications (PWA), the game server, and all related subdomains.
3. Personal Data Processed
3.1 Registration and Sign-In (OAuth)
The Service uses third-party OAuth2 providers for sign-in. Upon sign-in, we receive the following data from the chosen platform:
| Data | Discord | ||
|---|---|---|---|
| Platform ID | ✓ | ✓ | ✓ |
| Name | ✓ | ✓ | ✓ |
| Email address | ✓ | ✓ | ✓ |
| Profile picture (avatar) | ✓ | ✓ | ✓ |
Legal basis: consent of the data subject (GDPR Article 6(1)(a)) — sign-in is voluntary, and the user authorizes the transfer of data on the platform.
3.2 Cookies
The Service uses strictly necessary cookies only:
-
JWT session cookie: an authentication token required to maintain the sign-in session. The token contains the following data:
- internal user identifier (user ID)
- username received from the OAuth platform
- profile picture URL (avatar)
- role labels (roles) — e.g., admin, dev, player
The token cannot be used for tracking; it serves solely for session authentication.
We do not use third-party cookies, advertising cookies, or tracking cookies.
Legal basis: legitimate interest (GDPR Article 6(1)(f)) — the cookie is necessary for the basic operation of the Service.
3.3 Telemetry and Error Reporting
The Service operates a proprietary telemetry system for detecting errors and monitoring performance. The collected data does not contain any personal identifier (no userId).
Automatically collected data:
- Error reports: JavaScript errors (filename, line number, stack trace), unhandled promises, console errors
- Performance metrics (Web Vitals): page load time (LCP), interactivity (INP), visual stability (CLS)
- Page views: visited route and referrer
- Device information (once per session): screen size, browser type, platform, language, touch support, connection type
- Session identifier: randomly generated, new per session, not linked to any person
- Website measurement (greencloth.games, jatekasztal.hu, deinspieltisch.de and the user guide): one page view per page load and clicks on links to our apps or our Discord, with the page’s campaign (
utm_*) parameters. Nothing is stored in your browser for this (no cookie or local storage), and it is switched off entirely when your browser sends Do Not Track or Global Privacy Control.
Retention periods:
| Data type | Retention period |
|---|---|
| Logs | 7 days |
| Metrics | 30 days |
| Device data | 90 days |
Legal basis: legitimate interest (GDPR Article 6(1)(f)) — ensuring the stability and quality of the Service.
3.4 Payment Data
Payments are handled by Stripe. We do not store card or other payment instrument data: these are handled exclusively by Stripe in accordance with its own privacy policy, available at https://stripe.com/privacy.
- Purchases by private individuals in the EU and by customers outside the EU go through Stripe Managed Payments, where a Stripe company is the seller (merchant of record). For that sale Stripe processes your name, e-mail address, billing address and payment data as an independent controller, under its own privacy policy.
- Purchases by EU businesses are made from us, with Stripe as the payment processor.
For each purchase we keep: the Stripe customer, payment and subscription identifiers, the plan, the billing period, the amount and currency, the payment status, the country you chose and whether you bought as a private individual or a business. For a business we also keep the company name and VAT number shown on the invoice. When you consent to the immediate start of a paid plan (and lose the right of withdrawal), we keep the time of the consent and the version of its wording.
Legal basis: performance of a contract (GDPR Article 6(1)(b)), and compliance with legal obligations for bookkeeping and tax (GDPR Article 6(1)(c)).
3.5 Donations
A donation can be made signed in or without an account. A signed-in donation is linked to your account (amount, currency, time, Stripe payment identifier), and you receive a thank-you message in the Account app. For a donation without an account we keep the same payment record without any link to a person; Stripe asks for your e-mail address to send the receipt.
To protect the donation page from card testing, we use the IP address of a request made without an account for 10 minutes to limit the number of attempts. It is kept only in the server’s memory and is not stored.
Legal basis: compliance with bookkeeping obligations (GDPR Article 6(1)(c)); for the IP-based limit, legitimate interest (GDPR Article 6(1)(f)) in preventing fraud.
3.6 Contact Form
Through the contact form (in the Account app, usable without signing in) we store your name (optional), your e-mail address, the topic you chose and your message, and, if you are signed in, the identifier of your account. We use this data only to answer you, and delete it after 12 months. To protect the form from abuse we use the IP address of the request for one hour to limit the number of messages; it is kept only in the server’s memory and is not stored. The form sets no cookies and loads no third-party services.
Legal basis: legitimate interest (GDPR Article 6(1)(f)) in answering your request and in protecting the form from abuse.
4. Purposes of Data Processing
| Purpose | Data processed |
|---|---|
| Creating and managing user accounts | OAuth data (ID, name, email, avatar) |
| Maintaining sign-in sessions | JWT cookie |
| Ensuring Service stability | Telemetry data (anonymous) |
| Processing payments and issuing invoices | Purchase data (Section 3.4) |
| Receiving donations | Donation data (Section 3.5) |
| Answering requests sent through the contact form | Name, e-mail address, topic, message (Section 3.6) |
5. Data Sharing with Third Parties
We do not sell, rent, or share personal data with third parties for marketing purposes.
Data is shared only in the following cases:
| Third party | Purpose | Data shared |
|---|---|---|
| Discord, Google, Facebook | Authentication (OAuth2) | We receive the platform’s own data |
| Stripe | Payment processing; as seller (merchant of record) for purchases through Managed Payments | Account name and internal identifier, chosen country, buyer type, plan and price; the details you enter on the checkout page go to Stripe directly |
6. Location of Data Storage
All data is stored on servers located within the European Union. We do not transfer personal data outside the EU, except where the third-party provider’s (Discord, Google, Facebook, Stripe) own data processing policies describe such transfers.
7. Data Retention
- OAuth account data: retained until the user account is deleted. A deletion requested in the Account app can be withdrawn for 14 days; after that the account and its data are deleted.
- Telemetry data: retained for the periods specified in Section 3.3, after which it is automatically deleted.
- Payment and donation data: retained for the period required by statutory bookkeeping obligations, also after the account is deleted.
- Contact form messages: deleted automatically 12 months after they arrive.
8. Rights of the Data Subject
Under the GDPR, the user is entitled to the following rights:
- Right of access — to request information about the data processed
- Right to rectification — to correct inaccurate data
- Right to erasure (“right to be forgotten”) — to request deletion of personal data
- Right to restriction of processing — to suspend data processing
- Right to data portability — to receive data in a machine-readable format
- Right to object — to object to processing based on legitimate interest
Some of these you can do yourself in the Account app: on the My data page you can download your data in a machine-readable (JSON) file and request the deletion of your account. For anything else, please write to privacy@reindeer.red. We will fulfill your request within 30 days.
9. Filing a Complaint
If you believe your data is being processed unlawfully, you may file a complaint with:
- Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tatari 39, 10134 Tallinn, Estonia
https://www.aki.ee - Or the data protection authority of the EU member state where you reside (in Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság — https://www.naih.hu).
10. Changes to This Policy
We reserve the right to amend this policy. The amended version will be published on the Service’s website. In case of material changes, users will be notified within the Service.
11. Contact
For privacy-related questions, please contact us:
Reindeer Entertainment OÜ
Email: privacy@reindeer.red