1. Controller
ChillWebGames, Luca Cataldo, c/o Autorenglück #69236, Albert-Einstein-Str. 47, 02977 Hoyerswerda, Germany. Email: [email protected] (see imprint).
2. Hosting at OVH
This website is hosted by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France ("OVH"). When you visit the website, technically necessary data (IP address, browser user agent, time of the request, requested URL, HTTP status code, bytes transferred) is processed on OVH servers in the EU in order to deliver the website and ensure the stability and security of the infrastructure.
Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in secure and stable operation of the website). Data transfer to third countries outside the EEA does not occur through OVH hosting. A data processing agreement (Art. 28 GDPR) is in place with OVH.
Further information on data processing by OVH can be found in OVH's privacy policy at ovh.de/persoenliche-daten/.
3. Cloudflare (CDN and reverse proxy)
This website is delivered via the CDN and reverse proxy service of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare sits between your browser and our hosting provider OVH and processes technically necessary data (IP address, browser user agent, operating system, referrer URL, requested URL, HTTP status code, bytes transferred, time of request, Cloudflare-internal fields such as cf-ray, cf-connecting-ip, cf-cache-status, cf-country) to deliver the website quickly, securely and reliably.
Purpose: delivering website content from the geographically nearest data centre (CDN), protection against DDoS attacks and bots (web application firewall), caching of static content for performance, and anonymised threat analytics.
Third-country transfer: Cloudflare processes data worldwide, including the United States. Cloudflare relies on the EU Standard Contractual Clauses (SCC) under Art. 46 (2) lit. c GDPR and is certified under the EU-US Data Privacy Framework. A data processing agreement (Art. 28 GDPR) is in place. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in secure, fast and stable delivery).
Further information can be found in Cloudflare's privacy policy (cloudflare.com/privacypolicy/) and in Cloudflare's sub-processor disclosure.
4. Data processing on this website
When visiting, technically necessary data (IP address, user agent, time) is processed in order to deliver the website (Art. 6 (1) lit. f GDPR).
Purposes of data processing
We process personal data exclusively for the following purposes (corresponding to Google's stated purposes):
Purpose: Website and app functionality
Providing the games and the website, sign-in and account management (§5), storing your recently played games (locally in your browser only), language and display settings, and push notifications if you enable them (§6). Legal basis: Art. 6 (1) lit. b GDPR (contract) or lit. f GDPR (functionally necessary).
Purpose: Analytics
We do not use any first-party analytics services such as Google Analytics, Matomo or similar. We only evaluate aggregated or anonymised data: Cloudflare security and performance statistics (§3), game view counts used to sort the charts, and – only after your consent – advertising performance data and stability/crash diagnostics by Google AdSense and Google AdMob (§9, §10). Legal basis: Art. 6 (1) lit. f GDPR (aggregated evaluation) or Art. 6 (1) lit. a GDPR (advertising-related evaluation).
Purpose: Developer communications
Push notifications about new games and important updates (§6, only with your consent and disableable at any time) and replies to your enquiries via the contact form (name, email, optional phone number, message). Legal basis: Art. 6 (1) lit. a GDPR (consent) or lit. b GDPR (handling your request).
Purpose: Advertising or marketing
Displaying, personalising and measuring advertising via Google AdSense on the website (§10) and Google AdMob in the games (§9), including advertising ID (GAID/IDFA), App Set ID and device and usage data. Without consent the AdSense script is not loaded at all; with “Essential only” it is loaded with npa=1, i.e. non-personalised ads. Legal basis: Art. 6 (1) lit. a GDPR.
Purpose: Fraud prevention, security and compliance
Protecting your account and our infrastructure: rate limiting on sign-in and registration (at most 60 attempts per 15 minutes), Argon2 password hashing, secure session cookie (§5), Cloudflare WAF and DDoS protection (§3) and server log files to detect abusive access (§2, §11). Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in secure operation).
Purpose: Personalisation
There is no personalisation of content or recommendations on a per-user basis: charts and recommendations are based on aggregated view counts, and recently played games are stored only locally in your browser. Only advertising is personalised – solely with your consent and disableable at any time (§9, §10). Legal basis: Art. 6 (1) lit. a GDPR.
Purpose: Account management
Creating, signing in to, managing and deleting your account and managing your push subscriptions (§5, §6, §12). We store your email address and a hashed password (Argon2). Legal basis: Art. 6 (1) lit. b GDPR.
5. Accounts
For an account we store your email address and a securely hashed password (Argon2). Sign-in uses a session cookie (httpOnly, secure). Legal basis: Art. 6 (1) lit. b GDPR (contract) or consent.
6. Push notifications
With your consent (Art. 6 (1) lit. a GDPR) we register your device for push notifications. For this, a device-specific subscription (endpoint, encryption keys) is stored. You can disable notifications at any time in your account.
7. Advertising
Ads on this website are delivered by Google AdSense (§10); inside the games by Google AdMob (§9). Both services are only loaded after your consent via the cookie banner; without consent the AdSense script is not loaded at all, and with “Essential only” it is loaded with npa=1, i.e. non-personalised. We do not embed any other third-party cookies or trackers.
8. Games on this website (self-hosted)
All games offered on chillwebgames.com (currently 25 titles, e.g. CubeMatch, Sudoku, Chess Arena, Tic-Tac-Toe, Wörterle, BouncyBow and others) are developed and operated by us and hosted on our own infrastructure. They run behind a reverse proxy at /g/
If a single game should ever embed content from an external provider (e.g. an ad slot or third-party asset), it will be visibly labelled inside the game; the privacy policy of that provider then applies in addition. Currently this is not the case for any of the 25 games.
8.1 Device identifier (device ID)
Some games (e.g. Candy Puzzle) automatically create an anonymous guest account on first launch. For this the game generates a random identifier on your device (a UUID, e.g. 3f1b466f-4eaf-487a-9c20-3ab0ec31a838) and stores it locally in your browser or app storage and on our server so that your guest account is recognised on the next start. This identifier is not a device fingerprint: it contains no hardware or advertising information and is explicitly not the advertising ID (GAID/IDFA), not the Android ID, not the IMEI and not the MAC address. Legal basis: Art. 6 (1) lit. b GDPR (providing the game). If you clear your browser or app data, a new identifier is generated on the next start and the previous guest account can no longer be reached.
8.2 Cloud save
For this guest account we store your save on our server: level progress (levels, stars, score), coins, boosters, the automatically generated nickname and the time of last access. The purpose is to restore your progress after a reinstall, a device change or cleared browser data. It is not used for advertising or profiling. Legal basis: Art. 6 (1) lit. b GDPR (providing the game including your save) and lit. f GDPR (protection against data loss).
8.3 Leaderboard (public)
Your nickname (automatically generated, e.g. Spieler1234) and your score appear on the game's public leaderboard and are visible to all visitors. Your real name, e-mail address, IP address and device identifier are not shown on the leaderboard. Legal basis: Art. 6 (1) lit. b GDPR (taking part in the leaderboard as a game feature).
8.4 Gameplay and performance statistics
We also record pseudonymous gameplay and performance events (e.g. level started/finished, load times, frame rate) to improve difficulty and stability. These events are linked to the guest account but not to a name, e-mail address or advertising ID. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in error analysis and game balance).
8.5 Retention and deletion
Guest accounts unused for 24 months are deleted automatically, together with the save, the leaderboard entry and the statistics. You can request deletion of your cloud save and leaderboard entry at any time by e-mail to [email protected]; uninstalling the app or clearing browser data additionally removes the local copy and the local device identifier.
9. Google AdMob (advertising platform, in all games)
All games on chillwebgames.com (all 25 titles: CubeMatch, Sudoku, Chess Arena, Tic-Tac-Toe, Wörterle, BouncyBow, MixLab, Schlangen.io, Minefield, HoleGame, Crossword, Candy Puzzle, Dot Connect, Fish, TopDown Royal, Stickman Count, Planet Wars, 2048, Cross The Road, Four in a Row, Falling Blocks, Snake, WallDuel, Flappy Game, Boxed.io) use Google AdMob, an advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). AdMob is embedded both in the Android apps (e.g. the CubeMatch app on Google Play, more to follow) and on this website itself (mobile web + desktop) via the Google Mobile Ads SDK and Google Ads SDK. CubeMatch is therefore not a special case but the first example of an entire line of games, all of which are subject to the same advertising standards and privacy rules.
Data collected across all games (app + web): Advertising ID (Google Advertising ID / GAID on Android, IDFA on iOS, resettable via Android Settings → Privacy → Ads or iOS Settings → Privacy → Tracking), App Set ID (Android apps only, assigned by Google Play Services), device information (model, manufacturer, screen resolution, OS version, language and country settings, mobile network, browser type/version on web), IP address, install/update sources (app) and referrer URL (web), ad impressions and clicks, app crash diagnostics.
Legal basis: Art. 6 (1) lit. a GDPR (consent) for personalised ads; Art. 6 (1) lit. f GDPR for non-personalised ads. On the web AdMob is only loaded after your consent via the cookie/consent banner. Third-country transfer to the US based on SCC and the EU-US Data Privacy Framework.
Disable personalisation: you can disable personalised ads at any time: Android Settings → Privacy → Ads → Disable personalised ads; iOS Settings → Privacy → Tracking; web: via the consent banner ("Privacy → Disable ads"). AdMob will then only show contextual, non-personalised ads.
Children's data (COPPA): Our games and apps are not intended for children under 13. We neither knowingly request nor knowingly collect personal data from children under 13. Users under 13 should not install or use the games without the consent of a parent or guardian.
Further information can be found in Google's privacy policy (policies.google.com/privacy) and in the AdMob help for publishers (support.google.com/admob/answer/6128543).
10. Google AdSense (web)
This website uses Google AdSense, an advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). AdSense uses cookies and similar technologies (web beacons, device IDs) to serve ads that are relevant to you. In particular, Google processes your IP address, browser and device information, referrer URL and time of ad delivery. Data may be processed in the United States; Google relies on EU standard contractual clauses for this.
Legal basis: Art. 6 (1) lit. a GDPR (consent) or lit. f GDPR (legitimate interest in economically funding the service), where permitted by law.
Personalised advertising: With your consent, Google may serve personalised ads based on your usage behaviour on this and other websites. You can disable personalised advertising at any time at adssettings.google.com.
Authorisation: Ads are delivered on behalf of Google via the publisher ID "ca-pub-9519326856798719" registered with Google; the authorisation is recorded in our ads.txt.
Further information on Google's data processing can be found in Google's privacy policy at policies.google.com/privacy.
11. Retention periods
Server log files (OVH) and Cloudflare edge logs are stored for a maximum of 30 days. Account data is stored until you delete your account. Push subscriptions are deleted after sign-out or 180 days of inactivity. Google AdSense cookies follow the provider's retention periods (typically 13 to 24 months). Session cookies expire when the browser is closed. In the mobile app, AdMob data is stored according to Google's standard policy (usually 60 days); you can reset the Advertising ID at any time in your Android settings.
12. Your rights and right to complain
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw any consent given at any time. Please send requests to [email protected].
You also have the right to lodge a complaint with the competent data protection supervisory authority. The competent authority is the one of your habitual residence or of the country where the controller has its seat, for ChillWebGames (seat: Saxony, Germany) the Saxon Data Protection and Transparency Commissioner, Postfach 11 01 32, 01330 Dresden, datenschutz.sachsen.de.