Privacy Policy
Effective from 1 November 2026.
1. Data controller
The controller of your personal data is a private individual who runs MAGNETIO! on a non-commercial basis (the “Administrator”, “we”). The game is free and is not run as a business. Contact the Administrator, including on data protection matters, at [email protected].
2. What data we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Nickname, e-mail address, password (stored only as a cryptographic hash), date you accepted the Terms | Creating and running your account, confirming your e-mail address | Art. 6(1)(b) – performance of a contract (the Terms) |
| Game scores, knockouts, play time, chosen color | 30-day ranking, Hall of Fame, account statistics | Art. 6(1)(b) – performance of a contract |
| Guest nickname and gameplay data (snake position, score) | Running live multiplayer matches | Art. 6(1)(b) – performance of a contract |
| IP address, technical connection data | Security, abuse prevention (e.g. login attempt limits), keeping the service running | Art. 6(1)(f) – legitimate interest |
| Google Analytics cookies | Visit statistics and improving the game | Art. 6(1)(a) – your consent |
You can play without an account and without giving us any data. Providing data when you sign up is voluntary but required to create an account.
3. Cookies and browser storage
Essential (no consent needed): in your browser's local storage we keep the session token of your logged-in account, your nickname and color, language, sound setting, your local best score and your cookie choice. This data stays on your device, except the session token, which is sent to our server.
Analytics (only with consent): Google Analytics 4 (Google Ireland Ltd.) sets the _ga and _ga_* cookies to count visits and see how the game is used. Until you consent, Google Analytics runs in cookieless mode (Consent Mode). You can change your choice at any time: cookie settings.
4. Recipients
We share data only with providers that help us run the game, under data processing agreements:
- the server (VPS) and database provider – hosting the game and accounts,
- Cloudflare, Inc. – CDN, attack protection, traffic delivery,
- Resend (Plus Five Five, Inc.) – sending account confirmation e-mails,
- Google Ireland Ltd. – Google Analytics (only with consent).
Cloudflare, Resend and Google may process data outside the European Economic Area (e.g. in the USA). Such transfers rely on the European Commission's EU-US Data Privacy Framework decision or on standard contractual clauses.
Your nickname and scores are publicly visible to other players (in-game ranking, Hall of Fame). Your e-mail address is never public.
5. How long we keep data
- Account and scores – until the account is deleted.
- Accounts with an unconfirmed e-mail – deleted automatically after 7 days.
- Login sessions – 30 days from logging in.
- IP addresses in security mechanisms – up to several minutes in server memory; technical logs – up to 30 days.
- Google Analytics data – 14 months.
6. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on legitimate interest. You can withdraw your consent to analytics cookies at any time, without affecting the lawfulness of processing before the withdrawal.
You can delete your account, together with your e-mail address and all your scores, yourself in the game: in the menu, next to your account name, choose “delete account” and confirm with your password. Your account data (nickname, statistics) is shown in the game menu. To exercise your other rights (e.g. access, rectification or portability), write to [email protected] from the address linked to your account – we will reply within one month. You also have the right to lodge a complaint with a data protection authority – in Poland, the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or the authority in your country of residence.
7. Security
The connection to the game is encrypted (HTTPS). Passwords are stored only as a salted cryptographic hash (scrypt) – nobody, including us, knows your password. Confirmation links and session tokens are random and expire.
8. Children
Accounts may be created by people aged 16 or over. Younger people may create an account only with the consent of a parent or legal guardian.
9. Changes
We will announce material changes in the game. The current version is always available at this address.