GDPR — privacy notice

1. Controller

David Odehnal, Company ID (IČO) 08215219, registered at Pekařská 392/29, 602 00 Brno, Czech Republic. Sole trader registered in the Czech Trade Licensing Register. Contact: duely@davidodehnal.cz.

This English text is a courtesy translation. The Czech version is the authoritative one and prevails in case of any discrepancy.

2. Playing without an account: no personal data

Settings, progress and personal bests stay in your browser (localStorage) and are never sent to the server. The duely_lang cookie remembers your language; signing in adds duely_sid, which holds the session. Both are strictly necessary, so neither needs consent — there are no other cookies and nothing is tracked through them.

Audience figures are aggregate only. Your browser mints a random id which the server stores solely as an HMAC under a secret generated on this installation — no IP address, no user-agent, no fingerprint. Do Not Track and Global Privacy Control are honoured before any id is minted.

3. Duel suggestions

The form asks for two names and an optional note — it does not ask for an e-mail address or anything else. The basis is legitimate interest in handling and publishing the suggestion (Art. 6(1)(f) GDPR).

Suggestions are public in the Duelbox — the pairing you proposed and how many votes it has. Who sent it is not part of the public page. If you were signed in, the suggestion is noted against your account, but only so that you can spot your own in the list; nobody else sees it.

4. Accounts and voting

Signing in works without a password: you give an e-mail address and a link arrives at it. The link lasts one hour and works once; only a hash of it is stored, so the database cannot be used to sign in as you. The session then lasts a year, until you sign out. The account holds your e-mail address and a nickname you choose. The basis is performance of a contract (Art. 6(1)(b)).

Voting for a suggestion needs an account — otherwise the votes would mean nothing. All that is stored is that this account voted for this suggestion, and when. A vote can be taken back at any time with another click, which deletes the record.

The account also holds your game progress — your best result per duel, the stars you have given, and which duels you have opened — so your records survive a move to another device. Signing in merges what is in the browser with what the account already knows; nothing is ever overwritten by a worse result.

Should I ever offer sign-in with Facebook, Google, Apple or a passkey, I would receive only your e-mail and an account identifier — no friend list, no posts, no other content, and never your password. That option is not available today.

5. Who else sees it

The hosting provider running the site and the mailbox provider sending the mail — which includes the sign-in link. Data is never sold or shared for advertising.

6. How long

Account data until you delete the account; its votes go with it. Suggestions while queued or published.

The site takes no payments, so there are no accounting records to keep for years. If you ask for erasure, there is nothing to hold back.

7. Your rights

You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest — write to duely@davidodehnal.cz.

You may also lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.