Privacy policy

Last updated 9 October 2026.

Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

[Operator name and postal address not yet configured — set OPERATOR_NAME and OPERATOR_ADDRESS.]

What we store, and why

A session cookie (tg_session), set when you first press Play — never on a page view. It keeps your guest progress, or keeps you signed in, for up to 180 days. It holds a random token; we store only a hash of it. The cookie is strictly necessary for the game you asked to play, so it needs no consent (§ 25 (2) no. 2 TDDDG).
Your game data: saved games, scores, when each game was played and the board it was played on, so we can check results and run leaderboards. Legal basis: providing the service you use (Art. 6 (1) (b) GDPR).
If you sign in: the provider (Google, Facebook or Microsoft), the account id it gives us, your email address and your profile picture. We never receive your password. Legal basis: Art. 6 (1) (b) GDPR.
Server logs: when your browser requests a page, our web server records your IP address, the time, the address requested and your browser's user agent. We use them only to keep the site running and secure, and they are deleted in the normal rotation of the server's logs, within days. Legal basis: our legitimate interest in a secure, working site (Art. 6 (1) (f) GDPR).
Limits against abuse: to stop scripts creating accounts or games in bulk, the server counts requests per IP address in memory for at most an hour. These counts are never written to disk. Scores are checked automatically and one that cannot have come from play is not counted; this has no effect on you beyond the leaderboard. Legal basis: Art. 6 (1) (f) GDPR.

What is public

Your display name and your scores on leaderboards. Your display name is generated for you and is not your real name unless you change it to one. Guests never appear on leaderboards.

Where it is kept, and who else sees it

The site and its database run on servers we rent in Germany from Hetzner Online GmbH, who process the data only on our instructions (Art. 28 GDPR). The site loads no third-party scripts, fonts or trackers. If you choose to sign in, your browser is sent to the provider you picked, and that provider's own privacy policy applies to what happens there; Google, Facebook and Microsoft may process data outside the EU. We do not sell your data or pass it to anyone else.

What we do not do

We do not show advertising. If we add it, this page will say which partner, what it collects and how you choose — before it starts, and only with your consent where the law requires it.
We do not use analytics or tracking cookies.
We do not send email.

How long we keep it

Guest data with no games is removed 7 days after the last visit, and any guest data 90 days after the last visit. When a guest signs in to an account that already had games, the guest's copy of those games is kept for 30 days and then removed. An account's data is kept until you ask us to delete it.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable form, and to object to processing based on legitimate interest (Art. 15–21 GDPR). Write to contact@trexgamestudio.com; for an account, write from the email address linked to it so we can find it.

You also have the right to complain to a data protection supervisory authority, in particular the one where you live or the one responsible for us.

Age

The site is meant for people aged 13 and over.