Privacy policy

Last updated 29 October 2026 (email accounts and password recovery).

Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

Email: contact@trexgamestudio.com

What we store, and why

• A session cookie (tg_session), set when you first press Play — never on a page view. It keeps your guest progress, or keeps you signed in, for up to 180 days. It holds a random token; we store only a hash of it. The cookie is strictly necessary for the game you asked to play, so it needs no consent (§ 25 (2) no. 2 TDDDG).
• Your game data: saved games, scores, when each game was played and the board it was played on, so we can check results and run leaderboards. Legal basis: providing the service you use (Art. 6 (1) (b) GDPR).
• If you sign in through another service: the provider (Google, Telegram, Facebook or Microsoft), the account id it gives us, your email address and your profile picture. Telegram gives us your Telegram user id and picture only — no email and never your phone number; it also sends your name and username, which we do not keep. We never receive your password for those services. Legal basis: Art. 6 (1) (b) GDPR.
• If you create an email account: your email address is a private, case-insensitive login name. We do not verify ownership of that address or link it automatically to another sign-in. Your password is sent over the secure connection and stored only as a salted scrypt hash, never as readable text. A random recovery code is shown once; we keep only its hash. Using it replaces your password and recovery code and ends previous sessions. These credentials stay with the account until deletion. We also keep hashed email rate-limit keys in memory for up to 15 minutes to limit password guessing. Legal basis: providing and securing your account (Art. 6 (1) (b) and (f) GDPR).
• If you play inside Telegram (our Mini App, opened from @TrexGameStudioBot): Telegram passes us, signed, your Telegram user id, name, username, language and picture. We keep the id and the picture and sign you in with them, so your games and scores follow you between Telegram and this website; the rest is not stored. Inside Telegram the session cookie is set when the app opens, and no Google ads are shown. Legal basis: Art. 6 (1) (b) GDPR. If you open a game from a Telegram game message in a chat, we also keep which message that was, for up to a week after you last opened it there, and tell Telegram your score in that game after each round, so it can keep the chat's high-score table; everyone in that chat can see it. Those pages set no cookies: your sign-in there is a token that lasts a day, kept only in that browser tab.
• Server logs: when your browser requests a page, our web server records your IP address, the time, the address requested and your browser's user agent. We use them only to keep the site running and secure, and they are deleted in the normal rotation of the server's logs, within days. Legal basis: our legitimate interest in a secure, working site (Art. 6 (1) (f) GDPR).
• Limits against abuse: to stop scripts creating accounts or games in bulk, the server counts requests per IP address in memory for at most an hour. These counts are never written to disk. Scores are checked automatically and one that cannot have come from play is not counted; this has no effect on you beyond the leaderboard. Legal basis: Art. 6 (1) (f) GDPR.

Performance diagnostics

We measure page loading, responsiveness and layout stability to keep the website usable. Reports contain timing values, a broad page category, a mobile/desktop category and, where available, a fixed interface area that moved. They contain no account identifiers, page text, full addresses or query strings. A random identifier distinguishes updates to one measurement on one page load; it is not reused to track you across visits. Reports are sent to our own server without cookies, and older measurements are removed after 28 days during routine maintenance. We respect Do Not Track and Global Privacy Control, and do not collect these diagnostics on pages opened from Telegram game messages. The purpose and legal basis is our legitimate interest in a reliable website (Art. 6 (1) (f) GDPR).

What is public

Your display name and your scores on leaderboards. Your display name is generated for you and is not your real name unless you change it to one. Guests never appear on leaderboards.

Where it is kept, and who else sees it

The site and its database run on servers we rent in Germany from Hetzner Online GmbH, who process the data only on our instructions (Art. 28 GDPR). Apart from Google's advertising script when advertising is enabled, described below, and Telegram's Mini App script when you play inside Telegram, the site loads no third-party scripts, fonts or trackers, and the games themselves load none at all. If you choose to sign in, your browser is sent to the provider you picked, and that provider's own privacy policy applies to what happens there; Google, Telegram, Facebook and Microsoft may process data outside the EU. We do not sell your data.

Advertising (Google AdSense)

The site is free to play. Advertising is currently switched off while we seek approval from Google AdSense. The Google advertising script is not loaded while advertising is disabled.

Google AdSense is run by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When advertising is enabled, Google's script can receive your IP address, browser and device details and the page you are on, even before an ad is shown. We load the advertising script only on eligible website content pages; our account-verification metadata does not itself contact Google.

• Optional advertising storage and personalisation require your consent. Before these are enabled, visitors in the EU, the EEA, the UK and Switzerland must be offered Google's consent controls. Their legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). A non-personalised ad can still use cookies or similar storage; declining personalisation is not permission for optional advertising storage.
• Privacy settings at the foot of the page reopens Google's consent controls when they are available; otherwise it links to this section. Withdrawing consent does not affect processing that took place before withdrawal.
• Google may process data in the United States; Google LLC is certified under the EU–US Data Privacy Framework. How Google uses this data: policies.google.com/technologies/partner-sites. Its privacy policy: policies.google.com/privacy. Personalised ads can also be switched off for your Google account at myadcenter.google.com.
• Google's tag is excluded from Telegram pages and game bundles. The optional timed studio message used for game rewards is our own text, not a video or a paid advertisement; it sends no data to an external ad provider. Completing it is recorded with your game account so the server can grant the reward once and enforce the daily limits.

What we do not do

• We set no tracking cookies of our own and do not use third-party audience analytics.
• We do not send email.

How long we keep it

Guest data with no games is removed 7 days after the last visit, and any guest data 90 days after the last visit. When a guest signs in to an account that already had games, the guest's copy of those games is kept for 30 days and then removed. An account's data is kept until you ask us to delete it.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable form, and to object to processing based on legitimate interest (Art. 15–21 GDPR). Write to contact@trexgamestudio.com; for an account, write from the email address linked to it so we can find it. If you signed in with Telegram, which gives us no email address, message our support on Telegram instead (the contact is in @TrexGameStudioBot's bio and in our Telegram channel): your Telegram account tells us which account is yours.

You also have the right to complain to a data protection supervisory authority, in particular the one where you live or the one responsible for us.

Age

The site is meant for people aged 13 and over.