operates EMOJINE (the "Service"). This policy explains how personal data is processed.
1. Data Controller
The data controller responsible for your personal data is:
Contact:
2. Data We Collect
We collect the following categories of personal data:
Account Data: Email address, display name, role, and selected age band (if provided)
Authentication Data: Password hash, login/reset tokens, and Discord or Twitch account identifiers when linked
Subscription and Billing Data: Subscription tier and status; billing name, country, postal code, city, address, optional tax identifier and phone number; order references, transaction identifiers, amounts, recurring-payment tokens, and invoice status. We do not receive or store full card details
Game Data: Lobby membership, nicknames, rounds, prompts, emoji placements, guesses, scores, and connection/activity timestamps while a lobby remains active
Technical and Security Data: Session identifiers, IP address, requested path, and application/security events in server and reverse-proxy logs
3. How We Use Your Data
We use your personal data for:
Providing and maintaining the Service
Managing your account and subscriptions
Sending password reset and one-time login codes
Communicating important service updates
Preventing fraud and abuse
4. Legal Basis for Processing (GDPR)
We process your data based on:
Contract: To provide the Service you signed up for
Legitimate Interest: To prevent fraud and maintain security
Consent: For optional marketing communications (if applicable)
5. Data Sharing
We do not sell your personal data. We may share data with:
Payment and Invoicing Providers: OTP SimplePay processes payments and recurring tokens; Billingo receives billing data to issue invoices
OAuth Providers: Discord/Twitch receive confirmation when you use their login
Hosting Providers: Our infrastructure providers process data on our behalf
Legal Requirements: If required by law or to protect our rights
6. Data Retention
Account Data: Retained while the account exists, subject to records we must retain by law
Game Data: Lobby data is stored in the application database and automatically removed after the configured inactivity period
Authentication Tokens: Reset links expire after one hour and one-time login codes after ten minutes; used and expired records are retained only as operationally necessary
Technical Logs: Retained according to the production logging and backup retention configuration
Payment and Invoice Records: Database records and the restricted recovery journal are retained for accounting, fraud prevention, reconciliation, and applicable legal retention periods
7. Your Rights (GDPR)
Under GDPR, you have the right to:
Access: Request a copy of your personal data
Rectification: Correct inaccurate data
Erasure: Request deletion of data that we are not legally required to retain
Portability: Receive your data in a machine-readable format
Object: Object to processing based on legitimate interest
Withdraw Consent: Where processing is based on consent
To exercise these rights, use the privacy contact listed below or the account deletion feature in your settings.
8. Cookies
We use essential cookies only:
Session Cookie: Required for login, CSRF protection, and game/session continuity; a logged-in session may remain valid for up to 30 days of inactivity
We do not use tracking cookies or third-party analytics.
9. Children's Privacy
The Service asks for an age band before payment and stores the declaration timestamp and policy version; it does not request a date of birth. For minors, it also stores a self-attested parent or guardian authorization timestamp and version.
10. International Transfers
Your data may be transferred to and processed in countries outside the EU/EEA. We ensure appropriate safeguards are in place (Standard Contractual Clauses).
11. Security
We implement appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS), password hashing, and access controls.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice on the Service.
13. Contact Us
For questions about this Privacy Policy or to exercise your rights:
Email:
You also have the right to lodge a complaint with your local data protection authority.