Privacy policy
Information under Articles 13 and 14 of the GDPR. Last updated 9 October 2026.
In short: no ads, no analytics, no trackers, no selling of data. You can play without an account. An account needs a name and a password, or a Google sign-in, or a passkey; an email address is optional and used only to reset your password. Your name, rating, games and forum posts are public; your email never is.
1. Who is responsible
The controller is Francesco Fano, c/o IP-Management #11106, Ludwig-Erhard-Straße 18, 20459 Hamburg, Germany. For anything about your data, write to hello@matesquad.com. There is no data protection officer: Article 37 GDPR does not require one here, as there is no large-scale monitoring and no special categories of data.
2. What is processed, why, and for how long
| Data | When | Legal basis | Kept |
|---|---|---|---|
Session cookie __Host-sid: a signed token with a random guest id or your account id, your name, and whether the bot check passed. No tracking, not readable by scripts. | On your first visit | Art. 6(1)(f), running the service | Guests 1 year, accounts 30 days from the last sign-in; it lives only on your device |
| Bot check (Cloudflare Turnstile): before your first online game, Cloudflare checks your browser is not a script. Cloudflare may process your IP address and browser details for that. | Before online play, sign-up and posting | Art. 6(1)(f), keeping the service up for everyone | Result in the session cookie; nothing stored on our side |
| Account: name, password (stored as a salted PBKDF2 hash, never in clear), optional email, creation date | If you create an account | Art. 6(1)(b), the service you asked for | Until you close the account (Profile → Close account) |
Google sign-in: Google's technical id for your account and your verified email. Only the openid email scope is requested; nothing is posted to Google. | If you choose "Continue with Google" | Art. 6(1)(b) | Until you close the account |
| Passkeys: the public key and credential id of each passkey you add. The private key never leaves your device. | If you add a passkey | Art. 6(1)(b) | Until you remove it or close the account |
| Password reset: a one-time link sent to your email, valid for one hour | If you ask for one | Art. 6(1)(b) | Link expires after one hour |
| Games: the setup, every move, the result, the clocks, and the names and ratings of the players, human or bot. Rated results change your rating. | Every online game | Art. 6(1)(b); Art. 6(1)(f) for the leaderboard and replays | Indefinitely: results and replays are part of the game's record. Closing an account leaves the name on past results. |
| Live games list: names of the humans in games running right now | While you play | Art. 6(1)(f), a lobby that shows what is going on | Until the game ends |
| Friends and invitations; "online" and "in a game" shown to your friends (last activity, written at most once a minute) | If you add friends | Art. 6(1)(b) | Until unfriended or the account is closed |
| Community: posts, replies, poll votes, reports and follows, with your name and the time | If you post | Art. 6(1)(b) | Posts and replies stay, without your name, after you close the account; delete them yourself first if you prefer. Poll votes are stored anonymously. |
| Content screening: each new post and reply is checked by an AI model (Llama 3.3, run on Cloudflare Workers AI) against the forum rules before it appears; nothing is kept by the model. A hidden post goes to a human moderator who can restore it. Reports from other players also hide a post until a moderator looks. | Every post | Art. 6(1)(f), a forum without spam and abuse; Art. 6(1)(c) in part (Digital Services Act) | The decision is kept with the post |
| Fair-play penalties: leaving rated games in a row pauses quick play on a ladder (5 minutes, 30 minutes, 2 hours, 24 hours). Keyed to the account, or for guests to a one-way hash of your network. | If you leave games | Art. 6(1)(f), games that are worth playing | One step down per clean day; gone with the account |
| Abuse limits: how many games, sign-ups, mails and posts a network starts a day, stored as a keyed hash of the day and your network address. The address itself is not stored and days cannot be linked. | Every online action | Art. 6(1)(f), keeping a free service free | Rows older than a day are deleted daily |
Where you came from: when a link we posted carries a ?ref= tag (the forum's name), the page sends that tag once so we can count which community brought players, and keeps it with an account created on that same visit. Nothing is stored on your device; the tag holds no personal data. | If you arrive through such a link | Art. 6(1)(f), knowing where to talk about the game | Counts are aggregate per tag |
| Technical logs: Cloudflare keeps request logs (IP address, user agent, URL, time) for its network and for a sample of our server logs (errors, timings) | Every request, as on any site | Art. 6(1)(f), security and diagnostics | Cloudflare: a few days |
| Local settings in your browser (sound, hints, your last setup, an unfinished practice game): stored on your device only | As you play | Strictly necessary for the features you use (§ 25(2) TDDDG) | Until you clear your browser data |
3. What is public
Your player name, ratings, number of games, game results and replays, forum posts and replies, and whether you are in a game right now can be seen by anyone, with or without an account. Your email address, Google id and passkeys are never shown to anyone and never sold or passed on.
4. Who else sees data (processors and third parties)
- Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA: hosting, database, the bot check (Turnstile), the AI screening of posts, and the sending and receiving of email. Cloudflare acts as our processor under its Data Processing Addendum. Data may be processed on Cloudflare's servers in the EU and in the USA; transfers rest on Cloudflare's certification under the EU-US Data Privacy Framework and on the EU standard contractual clauses.
- Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): only if you sign in with Google. Google then learns that you signed in to Mate Squad; see Google's privacy policy.
No data is passed to anyone else, except where the law requires it.
5. Cookies and consent
The site sets no advertising or analytics cookies and loads no third-party scripts apart from Cloudflare's bot check. The session cookie and the local settings are strictly necessary and need no consent. No cookie banner is shown because there is nothing to consent to.
6. Automated decisions
The AI screening of forum posts hides a post that breaks the rules; it has no legal effect on you and a human moderator reviews hidden posts and restores the ones wrongly hidden. You can ask for a human review at any time by writing to the address above.
7. Children
The game is for all ages. Playing as a guest needs no personal data, and an account needs only a name and a password; the email address is optional. We never ask a child's age, name or anything else about them. A parent or guardian can have a child's account and data deleted by writing to hello@matesquad.com.
8. Your rights
Under the GDPR you have the right to access your data (Art. 15), to correct it (Art. 16), to have it erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on legitimate interest (Art. 21). You can change your name, email and password, and close your account, on your Profile page; closing deletes your account at once. For anything else, write to hello@matesquad.com.
You also have the right to complain to a supervisory authority, for instance the one for Hamburg: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, datenschutz-hamburg.de.
9. Changes
When this policy changes, the date at the top changes with it, and a notable change is announced in the Community.