Data controller
The controller is Sergi Pinós (NIF 46355419T), owner of Crazy Olympics (XMAS Software), a natural person. No postal address is published. Contact for any privacy matter: info@xmassoftware.com.
We process your data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). No data protection officer is appointed.
Data we process
- Account: nickname, email address, language, sign-up date, date and version of the terms and policy you accepted, confirmation that you are at least 14, role, verification and sanction status, and failed sign-in attempts. For your password we only store a strong hash.
- Runs: each attempt (event, mode, date, computed score, status valid, suspect or rejected and reason) and the raw events your browser sends so the server can compute the score and detect cheating (the moment of each click and the keys pressed in the typing event, only during the run). Practice runs are not stored.
- Game and profile: medal table, best results, overall ranking, achievements, unlocked and equipped cosmetics and titles.
- Social: friendships, requests, blocks, messages between friends, quick messages in rooms, reports (those you send and those made about you, with their outcome) and appeals.
- Rooms: name, settings, members, requests and invitations, results of each round, standings or bracket, and, in live rooms, the replay of the rounds (players’ events).
- Notices: your account’s notice inbox and your preferences per type (game and web).
- Security: sessions (we store fingerprints of the tokens and their expiry, not the tokens) and the administration log.
- IP address: used on each request to limit abuse, sent to Cloudflare Turnstile when validating forms and present in the technical logs of the API and the game server, which are deleted after 48 hours.
We ask for no sensitive or payment data. Email addresses are stored encrypted in the database.
What others see: anyone, even without an account, can see your nickname, points, medals, results and titles on the rankings and your public profile. Your friends also see your achievements. In rooms, members see your nickname and your room results; spectators and anyone watching a replay see your nickname and your game events.
In your browser, the website stores the theme you chose and a flag saying you signed in, with no account data, and the game stores your settings (language, sound) in the site storage. There are no advertising or tracking cookies: see the cookie policy.
Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage your account, verify your email and recover your password | Performance of the terms of use, art. 6(1)(b) |
| Online game features (scoring, rankings, medal table, rooms, friends, notices, cosmetics) | Performance of the terms of use, art. 6(1)(b) |
| Security, abuse prevention (Turnstile, per-IP and per-account limits), moderation, reports, appeals and result validation | Legitimate interest, art. 6(1)(f) |
| Aggregated, cookieless visit analytics | Legitimate interest, art. 6(1)(f) |
| Complying with legal requests | Legal obligation, art. 6(1)(c), where applicable |
Email is only used to verify your account and recover your password: we send no newsletters, advertising or social notices by email. Results are validated automatically with anti-cheat rules and a person reviews suspect ones before they are excluded or rejected; there is no commercial profiling. We do not sell data.
Minimum age
You must be at least 14 to register, the age from which you can consent to the processing of your data under article 7 of Spanish Organic Law 3/2018 (LOPDGDD). Registration asks you to tick a box confirming it; it is your own declaration and we do not verify it with documents. If we find an account of someone under 14, we delete it.
Retention
| Data | Period |
|---|---|
| Account and profile data, and the active game data (results, medals, achievements, cosmetics, friendships, blocks) | While the account exists |
| Unverified accounts | 7 days from registration |
| Messages between friends | 12 months from each message, or until either account is deleted |
| Cancelled rooms | 7 days after they are cancelled |
| Finished rooms (room standings) | 365 days after they finish |
| Live-round replays | 7 days |
| Notice inbox | 90 days from each notice |
| Sessions | Up to 1 day after they expire |
| Resolved reports and appeals | 180 days after resolution |
| Administration log | 1 year |
| Technical logs of the API and the game server (including the IP) | 48 hours |
| Database backups | Expire after 8 days at most |
| Rights requests and messages to info@ | Up to 3 months after they are resolved; a record without personal data (date, right and outcome), 3 years |
Deleting your account erases all your personal data. Your results disappear from the rankings and, in rooms and replays shared with other players, you appear as “Deleted player”. If a backup had to be restored, accounts deleted since then are deleted again.
Data processors
We do not share your data with third parties unless legally required. These providers process it on our behalf:
| Provider | Service | Location |
|---|---|---|
| Contabo GmbH | Server hosting for the API, the game server, the database and local backups | European Union |
| Cloudflare, Inc. | Website and API hosting and network (CDN, DNS, firewall), R2 storage for backups, anti-abuse protection (Turnstile), cookieless analytics (Web Analytics) and contact email forwarding (Email Routing) | Global network; may process data outside the EU |
| Resend | Sending the verification and password recovery emails (receives your email, nickname and the link) | United States |
Messages you write to info@xmassoftware.com go through Cloudflare’s forwarding and reach the owner’s mailbox, hosted with another email provider that processes them as part of its service.
International transfers
Cloudflare and Resend may process data in the United States. These transfers rely on the EU-US Data Privacy Framework where the provider participates and, in any case, on the European Commission’s standard contractual clauses, with additional measures where appropriate.
Your rights
Under the GDPR (articles 15 to 22) and the LOPDGDD, you can exercise at any time and free of charge your rights of access, rectification, erasure, objection, restriction of processing and portability.
- From My account → My data: export all your data as a JSON file (access and portability), correct your nickname (rectification) or close your account by deleting it (erasure). Deletion is immediate and irreversible.
- From My account → Preferences: choose which notices you get in the game and on the web.
- By email, for any right (also without an account or if you cannot sign in): write to info@xmassoftware.com with the subject “Data protection”, stating the right you exercise, your nickname and, if you can, writing from the account’s address. We reply within one month at most.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).
How we handle your requests
- Identification: we check the message comes from the account’s email. If you cannot write from it, we will ask for something only you would know (for example, your nickname and approximate sign-up date). We never ask for identity documents.
- Access and portability: we send you the same JSON file you get from My data.
- Rectification: we correct your nickname or email and confirm it at the new address.
- Erasure: we delete the account with the same scope as the delete button.
- Objection and restriction: we suspend the account, keeping the data without using it, or delete it if you prefer.
- If we cannot do what you ask, we explain why and remind you that you can complain to the AEPD.
Security
We use encrypted connections (HTTPS and secure WebSocket), strongly hashed passwords, emails encrypted in the database, the session in an HttpOnly cookie the website’s JavaScript cannot read, server-side score validation, usage limits, encrypted backups and restricted, logged administration access.
Changes to this policy
If we change this policy we will show it here with a new date and, for relevant changes, ask you to accept it when you sign in again.
Contact: info@xmassoftware.com