1. Data Controller

Charles Smith (trading as Ludisto)
Gartenstr. 3a
10115 Berlin
Germany

Email:

If you have questions about your data or want to exercise any of the rights described below, email us. We’ll reply in English, German, or Esperanto.

2. What This Policy Covers

This policy explains what happens to personal data when you use What the Shell — the mobile and tablet app and the companion website at whattheshell.games. It applies to everyone, but it is written with the General Data Protection Regulation (GDPR / DSGVO) in mind because we are based in Berlin.

You can play What the Shell against the computer or in tutorial mode without an account and without sending any personal data to our servers beyond the minimal anonymous analytics described in section 3.5. Personal data is only collected when you choose to play online, which requires an account.

3. What We Collect and Why

3.1 Account data (only if you create an account)

• Email address — so you can log in, receive confirmation and password-reset emails, and be contacted about your account.
• Username (display name) — shown to your opponents in the inbox and during games. You choose it and can change it.
• Password — stored only as a bcrypt hash, never in plain text.
• Authentication tokens — JWT access tokens (signed, expire after 90 days) and short-lived one-time tokens used for email confirmation and password reset.
• Newsletter sign-up choice — whether you ticked the optional newsletter checkbox when registering, stored as a one-time record so we can see how many new players opt in. It reflects only your choice at signup and is independent of your actual newsletter subscription status.

3.2 Game data

• Game state — for every online game you play: the 9×9 board, move history, eggs, captures, turn counters, timestamps, and which two accounts played.
• Ratings and stats — a chess-style skill rating (Glicko-2) computed from your completed online games — a rating value together with a statistical uncertainty that shrinks as you play — plus win/loss/draw and sudden-death counts. You can see your own by signing in at whattheshell.games/login. Each game mode keeps its own rating, so additional ratings may appear when new game modes ship. Ratings of tournament participants and top-ranked players can also appear as described in section 3.9.
• Client version and platform — when you submit a move, your app attaches its version string (e.g. 2.6.0) and platform (iOS / Android) to the move record so we can diagnose platform- or version-specific bugs and know which client each move was made from.
• Time zone — your app reports your device’s current UTC offset (and, where available, its time-zone label). We use this to understand when players around the world are active, to schedule events and tournaments at reasonable local times, to show deadlines in your local time, and to avoid sending notifications in the middle of your night. It is a coarse signal that does not pinpoint your location, and it is never shown publicly. We process it under legitimate interest (GDPR Article 6(1)(f)).

Game records (moves, outcomes, timestamps, and the usernames of the two players) are visible to the two players of the game. We may also use individual games to showcase or promote the Service, as described in Terms of Service, section 6.

What is never shared publicly: your email address, IP address, password hash, push notification tokens, account metadata, and preferences.

3.3 Push notification data (only if you allow notifications)

When you grant notification permission in the app, your device issues a push token:

• On iOS: an APNs device token provided by Apple.
• On Android: an FCM registration token provided by Firebase.

We store this token against your account so we can notify you when it’s your turn, your opponent has resigned, a rematch has been requested, etc. You can revoke the permission in your operating system settings at any time — that invalidates the token and we stop being able to reach you.

If push delivery isn’t available for your account — for example, you never granted permission or your device token stopped working — we may instead send you an occasional email about games you are actively playing, such as a reminder that a move deadline is approaching. These are transactional messages, not marketing, and you can turn them off in the app’s notification settings.

3.4 Technical data (server logs)

Our hosting provider (Vercel) keeps standard HTTP access logs — things like IP address, user agent, request path, timestamp — for a short period, for security and operations. We do not read or aggregate these logs for analytics. Our own API also briefly processes your IP address in short-lived counters to rate-limit abuse (for example, repeated login attempts); these counters expire automatically and are not used for anything else.

3.5 Anonymous in-app analytics

The app records two kinds of best-effort analytics:

• Tutorial steps — which steps of the interactive tutorial a player reaches on first run, together with basic app context (app version, platform, language, screen size). Keyed to a per-install random UUID, not to your identity.
• AI game outcomes — when you play against the computer, we count wins/losses/draws per difficulty tier. If you’re signed in, these are attributed to your account so your AI stats follow you between devices. If you’re not signed in, they are stored on our server against the same kind of per-install random identifier — not your identity — and deleted automatically after 90 days, or merged into your account if you sign in on that device.

We use these to understand whether the tutorial is working and whether the AI difficulty curve feels right. We do not use any third-party analytics, tracking, or advertising SDK.

3.6 Newsletter (optional, opt-in only)

We send a newsletter with updates about What the Shell — new releases, events, and the odd featured game. It is entirely optional. You only receive it if you actively ask for it: there is an unticked checkbox on the sign-up form, and we never add you by default.

We use a double opt-in. When you tick the box (or sign up through a standalone newsletter form), we send a single confirmation email. You are only added to the list once you click the link in that email. If you never confirm, nothing further is sent, and your unconfirmed sign-up (including the technical details recorded with it, such as the IP address of the request) is automatically deleted after 14 days.

As proof that consent was given, we record the confirmation — the email address, the time you confirmed, the IP address from which you confirmed, and a version tag for the consent wording you agreed to. This record is our legal basis evidence under GDPR; we keep it for as long as you remain subscribed, and after you unsubscribe for as long as we may still need to demonstrate that consent was given (statutory limitation periods).

You can unsubscribe at any time using the one-click link in the footer of every newsletter; you can also reply and ask. Unsubscribing affects only the newsletter — you will still receive transactional emails (sign-up confirmation, password reset) because those are required to operate your account. The newsletter is delivered by Resend (see Section 5); we do not sell or share the list.

3.7 Booth and demo devices

At in-person events and game-industry showcases, What the Shell may run on shared tablets in a special “booth mode” signed in to generic system accounts that we operate. If you play on one of those tablets:

• You may be asked to type a short first name so your opponent can tell who they’re playing. You can type anything you like, or skip it.
• That first name is kept as part of the game record, alongside the moves and result, and may appear in content we share online for promotional purposes — for example a clip or post about a memorable booth game. We use only first names this way, never contact details, and you can ask us to remove your name from any published material at any time (see “Your rights” below).
• You don’t need an account to play on a booth device, and we don’t link booth play to any personal account you may already have.

3.8 Friend invites and referrals

What the Shell grows mostly by players inviting friends. A player’s personal invite link contains a reference to the inviter; if you install and create your account through it, we record which player invited you. If the inviter is signed in, that reference is their account; if they don’t have an account, it is an anonymous per-install identifier — a random value containing no personal information and no device or hardware identifiers — which lets us credit them, including if they create an account later. We use this to understand how the game grows through word of mouth, to recognize the players who bring friends in, and to support friend-oriented features (such as seeing which of your friends are online). We process it under legitimate interest (GDPR Article 6(1)(f)). This information is never shown publicly, and we do not sell or share it (and never with advertising networks or data brokers). We may also record or correct this reference manually — for example, when a player tells us who invited them, or when it is reasonably clear from how accounts are connected (such as two players who mainly play each other). You can object to this processing at any time (see “Your rights” below), in which case we remove the reference.

3.9 Tournaments and leaderboards

From time to time we run tournaments. Taking part is entirely optional. If you enter one, your participation is public: the name you play under, your results, and your rating appear on the tournament pages of our website for anyone to see, and remain there afterwards as part of the tournament’s historical record. You can also choose a small flag or other emoji to be displayed next to your name — many players pick a country flag. Displaying one is optional and always your explicit choice. The app may suggest a flag based on the country your internet connection appears to come from; we look only at the country, we do not store it, and nothing is published unless you confirm it. You can change or remove your flag at any time, and nationality is never published without your consent.

Separately, the website shows a small leaderboard of the top-rated players. It is visible only to signed-in players who are themselves on it, and it shows usernames and ratings only. If you would rather not appear on it, contact us.

3.10 Event RSVPs

From time to time we host in-person events (for example a launch party) and put up a public event page where you can let us know you’re coming. If you RSVP, we collect the name and email address you enter (both required so we can reach you about the event), how many people you’re bringing, and which arrival option you pick. You may also optionally provide your What the Shell username and your Telegram handle. We use this only to organize the event — to know the headcount and size the table — and never for marketing. Providing an RSVP is entirely voluntary and we rely on your consent (GDPR Article 6(1)(a)); you can ask us to remove your RSVP at any time. RSVP details are deleted after the event has taken place.

3.11 In-app announcements

When you are signed in, the app occasionally shows a short in-app announcement (a “What’s New” banner) about things like new features or upcoming events. So we can tell whether these announcements actually reach players, and so we don’t keep re-showing you one you have already closed, we record against your account which announcements you have seen and which you have dismissed. This is a simple internal engagement measure — it holds no message content, is never shown publicly, and is not sold or shared (and never with advertising networks or data brokers). We rely on legitimate interest (GDPR Article 6(1)(f)); you can object at any time (see “Your rights” below). This record is kept only while the announcement is active and is deleted when the announcement is removed.

4. Lawful Basis

We rely on the following lawful bases under Art. 6 GDPR:

• Art. 6(1)(b) — performance of a contract. Account data, game data and push tokens are needed to deliver the game to you as described.
• Art. 6(1)(f) — legitimate interests. Server logs (for security and abuse prevention) and the minimal anonymous analytics (for improving the game) rely on our legitimate interest. These interests are balanced against your rights; if you object, contact us.
• Art. 6(1)(a) — consent. Push notifications are sent only after you explicitly grant permission in the OS dialog. The newsletter (Section 3.6) is sent only after you tick the opt-in box and confirm via the double-opt-in email. You can withdraw either consent at any time — by turning off notifications in your device settings, or by unsubscribing from the newsletter — without affecting the lawfulness of processing before withdrawal.

5. Who We Share Data With

We use a small number of service providers (“processors” under GDPR) to operate the game. We have data processing agreements (DPAs / Standard Contractual Clauses) in place with each of them.

Provider	Purpose
Vercel Inc.	Hosts our website and API backend; serves web pages; writes server logs.
Upstash Inc.	Stores account and game data in a Redis database; daily backups to Vercel Blob.
Upstash QStash	Runs scheduled tasks (move deadline reminders, daily backups).
Resend	Delivers transactional emails (sign-up confirmation, password reset) and, if you opt in, the newsletter; holds the newsletter subscriber list.
Apple Inc.	Delivers push notifications to iOS devices via APNs.
Google / Firebase	Delivers push notifications to Android devices via FCM.

All of the providers above are US-incorporated. Three of them are configured to store data in the EU: Upstash Redis (your account and game data) and Upstash QStash (scheduled tasks) in Frankfurt (eu-central-1), and Resend (transactional email and the newsletter list) in Ireland (eu-west-1). Apple (APNs) and Google / Firebase (FCM) are global push-delivery services, not regional data stores: they route notifications to your device and hold no game data. Vercel, which hosts the site and API, runs its serverless functions and server logs in the United States (iad1); the daily backups it stores for us are kept in the EU (Frankfurt, fra1).

We do not sell or rent your data to anyone. We do not use it to profile you or to build advertising audiences.

6. International Transfers

All of the providers above are US-incorporated companies. Where personal data does cross to the United States, those transfers rely on the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. The exceptions are Upstash Redis, Upstash QStash and Resend, where data is stored in the EU as noted above; the SCC framework still governs the processor relationships with the US-incorporated entities. You can request a copy of the relevant safeguards by emailing us.

7. How Long We Keep Your Data

• Account data — for as long as your account exists. You can delete your account at any time, either with the in-app Delete account option or via the /delete page on our website. You’ll be asked to sign in and confirm before any data is removed. On deletion we remove: your user record, email address, push notification tokens, head-to-head statistics, and any pending matchmaking entries. Active games you have not yet finished are forfeited to your opponent.
• Finished games — game records (moves, outcomes, turn history) are preserved indefinitely with the usernames as displayed when the games were played. This applies to games you played before deleting your account as well — your move history remains attributed to the username you used at the time. Preserving this history matters because every game is part of the record between you, the person you played, and (for public games) the broader What the Shell community, and altering it retroactively would falsify that record. We process retained usernames under legitimate interest (GDPR Article 6(1)(f)) — specifically, the integrity of competitive rankings, the historical record of the game, and the interest of your former opponents and other viewers in an accurate account of the match — and we have conducted and documented a legitimate interest assessment for this retention. You can object to this processing at any time under Article 21 (see “Your rights” below); we will then replace your username in the affected records with a non-identifying label. You can also change your username to a non-identifying handle before requesting deletion if you prefer.
• Server logs — retained by Vercel per their policy (usually no more than 30 days).
• Backups — daily Redis snapshots are kept in Vercel Blob for 30 days, then automatically deleted.
• Ephemeral tokens — email confirmation tokens (48 h), password reset tokens (1 h), one-time login tokens (15 min), join codes (72 h) all expire automatically.
• Newsletter — if you opt in and confirm, your email address is held by Resend (Section 5) until you unsubscribe. An unconfirmed sign-up is automatically deleted after 14 days. The consent record (proof of opt-in — see Section 3.6) is retained while you are subscribed, and afterwards for the statutory limitation period, so we can demonstrate that consent was given.
• Event RSVPs — the details you submit to attend an in-person event (see Section 3.10) are deleted after the event has taken place.
• In-app announcements — the record of which in-app announcements you have seen or dismissed (see Section 3.11) is kept only while the announcement is active and is deleted when it is removed.

8. Your Rights

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify data that’s wrong or out of date.
• Erase your data (“right to be forgotten”).
• Restrict or object to our processing.
• Portability — get a machine-readable copy of your data.
• Withdraw consent at any time (affects future processing only).
• Complain to a supervisory authority. For Berlin residents this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (datenschutz-berlin.de). You can complain to the authority in your own EU member state too.

To exercise any of these, email . We’ll respond within 30 days.

9. Security

• Passwords are hashed with bcrypt. We never see your plaintext password.
• All communication between app, website and server is over HTTPS/TLS.
• JWT session tokens are signed (HS256) and expire after 90 days.
• Password resets bump a server-side token version, invalidating any old sessions.
• Redis access is authenticated with per-service tokens; backups are stored in a private Vercel Blob bucket.
• We are a small operation. If a data breach affects you, we will notify you and the supervisory authority within 72 hours as required by Art. 33 and 34 GDPR.

10. Children

Accounts require you to be at least 16 years old, the DSGVO baseline in Germany. The game itself can be played without an account by anyone of any age — against the computer or through the tutorial — and collects only the anonymous analytics described in section 3.5.

11. Changes to This Policy

We may update this policy as the game evolves. If the change is material (new data categories, new processors, changes to your rights), we will announce it by email to registered users. The “last updated” date at the top of this page will always reflect the latest version.