Privacy Policy

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

David Legenjović
Schallmooser Hauptstraße 16
5020 Salzburg, Austria
Email: info@sudoshi.com

2. Data processed

• Account data: display name, username, email address, password (stored only as a BCrypt hash), verification status.
• Profile picture: optionally uploaded avatar image.
• Game data: games, moves, statistics (wins/losses per difficulty), multiplayer rooms.
• Authentication: time-limited JWT tokens as well as email-verification and password-reset tokens.
• Server logs: IP address, timestamps and technical events.

There is no tracking, no advertising and no sharing for marketing purposes.

3. Purposes and legal bases

• Account management & gameplay (Art. 6(1)(b) GDPR) — providing the account and game features.
• Email verification & password reset (Art. 6(1)(b) and (f) GDPR) — account security. Verification tokens are valid for 24 hours, reset tokens for 15 minutes.
• Profile picture (Art. 6(1)(a) GDPR) — voluntary consent, revocable at any time by deleting it.
• Server logs & abuse prevention (Art. 6(1)(f) GDPR) — secure operation, protection against brute force (max. 5 login attempts per IP every 5 minutes).

4. Recipients

To send verification and password-reset emails, Proton AG (Switzerland, smtp.protonmail.ch) is used. The email address and message content are transmitted. Operation and data storage take place with [hosting provider]. No further disclosure to third parties takes place.

5. Retention

Account data is stored for as long as the account exists and is removed on deletion. Tokens expire automatically. Server log files are deleted after at most [7–30] days.

6. Local storage in the browser

For sign-in, technically necessary data is stored in localStorage (access/refresh token, user object, theme and language preference). This is required for the sign-in function (Art. 6(1)(b) GDPR) and does not constitute tracking cookies. The data remains locally on your device and is removed on logout.

7. Your rights

You have the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), as well as objection (Art. 21) and withdrawal of consent (Art. 7(3)). You can change your name, username and password in the settings, and delete your account there yourself.

To exercise these rights, a message to info@sudoshi.com is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

8. Data security

Passwords are stored exclusively as a BCrypt hash. Authentication uses signed, time-limited JWTs; login attempts are rate-limited per IP. The service should only be operated over encrypted connections (HTTPS/TLS).