This translation is provided for convenience; the French version prevails.
Privacy policy
Last updated: 3 October 2026
This policy explains how personal data is processed on funknight.games under the General Data Protection Regulation (EU) 2016/679 (GDPR) and the loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et du régime général sur la protection des données (the Luxembourg law organising the CNPD and the general data protection framework).
Controller
Polymath ASBL, 3, rue Nicolas Petit, L-2326 Luxembourg. Contact: [CONTACT EMAIL].
Data processed and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Player account | Email, username, password hash (via Supabase) | Contract (Art. 6(1)(b)) |
| Duels and leaderboard | Username, rating, match results | Contract; legitimate interest in fair rankings (Art. 6(1)(b), (f)) |
| Game results, streak, preferences | Stored only in your browser's localStorage; never sent to us | No processing of personal data by us |
| Payments (Stripe) | Name, email; card data handled by Stripe only; we store subscription status | Contract and legal obligation (Art. 6(1)(b), (c)) |
| Newsletter | Email, record of consent | Consent (Art. 6(1)(a)), withdrawable any time via the unsubscribe link |
| Analytics (Google Analytics (GA4)) | Pages visited, device and browser type, anonymised IP address | Consent (Art. 6(1)(a)) |
| Server logs | IP address, user agent | Legitimate interest in security (Art. 6(1)(f)) |
Processors and international transfers
We use Supabase (authentication and database), Stripe (payments), Lovable (hosting) and Google Analytics (GA4) (analytics). For Google Analytics the processor is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be transferred to Google LLC in the USA under the EU–US Data Privacy Framework and Google's Standard Contractual Clauses. Analytics run only after you give consent in the cookie banner, IP addresses are anonymised, and data retention in Google Analytics is set to 14 months. Where a processor transfers data outside the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses or, for certified US recipients, the EU–US Data Privacy Framework, where applicable.
The Google tag is loaded on every page in consent mode. Until you accept, analytics storage is denied and no _ga cookies are set; measurement cookies and data collection start only after your consent.
Retention
- Account and duel records: while your account exists, deleted within 30 days of closure.
- Payment and invoicing records: 10 years, as required by Luxembourg accounting law.
- Newsletter: until you unsubscribe.
- Analytics (Google Analytics (GA4)): 14 months.
- Server logs: 30 days.
- localStorage: until you clear it in your browser.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time without affecting earlier processing. To exercise them, write to [CONTACT EMAIL]; we reply within one month.
You may lodge a complaint with the Commission nationale pour la protection des données (CNPD), 15 boulevard du Jazz, L-4370 Belvaux, cnpd.lu.
Automated decision-making
We do not take decisions producing legal or similarly significant effects by automated means. Duel ratings are calculated automatically from game results only.
Children
The service is not directed at children under 16 without parental consent.
Cookies
Changes to this policy
We may update this policy. The date above shows the latest version; significant changes are announced on the site or by email to account holders.