Legal information

Imprint

Information pursuant to Section 5 of the German Digital Services Act (DDG).

Privacy policy

Controller and contact

The controller for DITTOINKS is the service provider named in the imprint. Use the contact address there for privacy requests and account deletion.

Hosting and access data

Netlify hosts this website. When you access it, the hosting provider necessarily processes technical request data such as your IP address, time of access, requested URL, browser and device information, and HTTP status. This is needed to deliver the site, maintain security and diagnose faults (Article 6(1)(f) GDPR). The exact content and retention of provider access logs depend on the active Netlify configuration: [ANGABE ERFORDERLICH: verify log data and retention in production].

Account, authentication and email

Registration uses your email address, password and chosen display name. Supabase Auth processes credentials, email confirmation and password reset requests and maintains your login session. Passwords are handled by the authentication service; they are not stored as readable game data. Supabase sends transactional account emails through the configured email delivery service. The project uses a Supabase/Brevo email setup: [ANGABE ERFORDERLICH: verify the active production mail provider]. Processing is necessary to create and operate the account (Article 6(1)(b) GDPR).

Game, community and marketplace data

Supabase stores your account ID and display name, cards and ownership, albums, companions, game progress, virtual Coins and account transactions, commands and activity records. Community features process friend requests, friendships and battle data; the runner and battle features store scores and results. The in-game marketplace processes listings, prices in Coins, and seller and buyer account IDs. Display names and relevant game or listing details may be visible to other signed-in members where those features require it. These data are processed to provide the game and its member features (Article 6(1)(b) GDPR); security and abuse prevention rely on Article 6(1)(f) GDPR. There are currently no paid purchases or payment data in the website flow.

Cookies and browser storage

Supabase SSR uses session cookies to keep you signed in and protect account access. The game also uses account-specific sessionStorage for a pending command and its request ID, so an interrupted action can be retried without a duplicate reward. This is cleared after the command is resolved or when the browser session ends. A small cleanup reads localStorage and sessionStorage only to remove obsolete prototype saves. These uses are necessary for the account and requested game functions (Section 25(2) TDDDG). No analytics, advertising or other optional tracking technology is currently integrated. No consent banner is therefore used.

The site serves its bundled fonts and game assets from its own origin; no browser-side external font or asset CDN is integrated.

Recipients, international transfers and storage period

Netlify receives hosting and request data; Supabase receives authentication, database and private asset data. The configured transactional email provider receives the email data needed to deliver account messages. These providers may use infrastructure or subprocessors outside the EU/EEA. [ANGABE ERFORDERLICH: verify processing regions, third-country transfers and applicable safeguards in provider agreements.] Account and game data are kept while the account is active and deleted or anonymized following a valid deletion request, unless legal duties or justified claims require longer retention. Transaction and security records are kept only for the period needed for those purposes or applicable legal obligations. Provider log and backup retention follow the providers’ configured periods.

Your rights and deletion

Subject to the legal requirements, you may request access, rectification, erasure, restriction, portability and object to processing based on legitimate interests (Articles 15–21 GDPR). You may also complain to a competent data protection supervisory authority (Article 77 GDPR). To request account deletion or deletion of personal data, contact the controller using the imprint contact details. Account deletion is handled by the operator; there is currently no self-service deletion button. We may need to verify that the request comes from the account holder.

Terms of use

Account and use

DITTOINKS is an account-based card collection game. You need a valid email address and must keep your login credentials confidential. You are responsible for activity through your account unless it results from circumstances outside your control. Use the game only lawfully; do not manipulate game state, exploit bugs, interfere with the service or other members, or use another person’s account without permission.

Game progress and virtual items

Cards, companions, Coins and other game items exist only within DITTOINKS. Coins are virtual game currency, not money; they cannot be redeemed for cash. Game rules, rewards and available content may change for gameplay, technical or security reasons. We will respect mandatory rights and give appropriate notice where a change materially affects account use.

Marketplace

The marketplace lets signed-in members list and exchange in-game cards for virtual Coins. A listing reserves the specific card while active. A completed in-game exchange transfers that card and the stated Coins between accounts. There are no paid purchases, payment methods or cash withdrawals on this website at present. Do not list cards or initiate exchanges through automation or manipulation.

Availability, restrictions and account closure

We may maintain, update or temporarily interrupt the service. Continuous availability is not guaranteed. We may restrict an account where necessary to address misuse, security threats or legal requirements, taking the circumstances into account. You may stop using the service and request account deletion through the imprint contact. Deletion can remove access to cards, Coins and progress; legally required records may remain for their required period.

Liability

Liability for intent, gross negligence, injury to life, body or health, and liability that cannot legally be excluded remains unrestricted. For slightly negligent breaches of essential contractual duties, liability is limited to foreseeable damage typical of this kind of service. Mandatory statutory rights remain unaffected.

Companion characters and artwork belong to their respective rights holders. DITTOINKS does not grant rights to third-party characters or artwork beyond use within the service.