1. Controller
ChillWebGames, Luca Cataldo, c/o Autorenglück #69236, Albert-Einstein-Str. 47, 02977 Hoyerswerda, Germany. Email: [email protected] (see imprint).
2. Hosting at OVH
This website is hosted by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France ("OVH"). When you visit the website, technically necessary data (IP address, browser user agent, time of the request, requested URL, HTTP status code, bytes transferred) is processed on OVH servers in the EU in order to deliver the website and ensure the stability and security of the infrastructure.
Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in secure and stable operation of the website). Data transfer to third countries outside the EEA does not occur through OVH hosting. A data processing agreement (Art. 28 GDPR) is in place with OVH.
Further information on data processing by OVH can be found in OVH's privacy policy at ovh.de/persoenliche-daten/.
3. Cloudflare (CDN and reverse proxy)
This website is delivered via the CDN and reverse proxy service of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare sits between your browser and our hosting provider OVH and processes technically necessary data (IP address, browser user agent, operating system, referrer URL, requested URL, HTTP status code, bytes transferred, time of request, Cloudflare-internal fields such as cf-ray, cf-connecting-ip, cf-cache-status, cf-country) to deliver the website quickly, securely and reliably.
Purpose: delivering website content from the geographically nearest data centre (CDN), protection against DDoS attacks and bots (web application firewall), caching of static content for performance, and anonymised threat analytics.
Third-country transfer: Cloudflare processes data worldwide, including the United States. Cloudflare relies on the EU Standard Contractual Clauses (SCC) under Art. 46 (2) lit. c GDPR and is certified under the EU-US Data Privacy Framework. A data processing agreement (Art. 28 GDPR) is in place. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in secure, fast and stable delivery).
Further information can be found in Cloudflare's privacy policy (cloudflare.com/privacypolicy/) and in Cloudflare's sub-processor disclosure.
4. Data processing on this website
When visiting, technically necessary data (IP address, user agent, time) is processed in order to deliver the website (Art. 6 (1) lit. f GDPR).
5. Accounts
For an account we store your email address and a securely hashed password (Argon2). Sign-in uses a session cookie (httpOnly, secure). Legal basis: Art. 6 (1) lit. b GDPR (contract) or consent.
6. Push notifications
With your consent (Art. 6 (1) lit. a GDPR) we register your device for push notifications. For this, a device-specific subscription (endpoint, encryption keys) is stored. You can disable notifications at any time in your account.
7. Advertising
We do not run any first-party advertising network on this website. Any ads you see while playing come from Google AdMob, which is embedded in the games (see §9). We do not actively embed any other third-party cookies or trackers.
8. Games on this website (self-hosted)
All games offered on chillwebgames.com (currently 25 titles, e.g. CubeMatch, Sudoku, Chess Arena, Tic-Tac-Toe, Wörterle, Bowshot and others) are developed and operated by us and hosted on our own infrastructure. They run behind a reverse proxy at /g/
If a single game should ever embed content from an external provider (e.g. an ad slot or third-party asset), it will be visibly labelled inside the game; the privacy policy of that provider then applies in addition. Currently this is not the case for any of the 25 games.
9. Google AdMob (advertising platform, in all games)
All games on chillwebgames.com (all 25 titles: CubeMatch, Sudoku, Chess Arena, Tic-Tac-Toe, Wörterle, Bowshot, MixLab, Schlangen.io, Minefield, HoleGame, Crossword, Candy Puzzle, Dot Connect, Fish, TopDown Royal, Stickman Count, Planet Wars, 2048, Cross The Road, Four in a Row, Falling Blocks, Snake, WallDuel, Flappy Game, Boxed.io) use Google AdMob, an advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). AdMob is embedded both in the Android apps (e.g. the CubeMatch app on Google Play, more to follow) and on this website itself (mobile web + desktop) via the Google Mobile Ads SDK and Google Ads SDK. CubeMatch is therefore not a special case but the first example of an entire line of games, all of which are subject to the same advertising standards and privacy rules.
Data collected across all games (app + web): Advertising ID (Google Advertising ID / GAID on Android, IDFA on iOS, resettable via Android Settings → Privacy → Ads or iOS Settings → Privacy → Tracking), App Set ID (Android apps only, assigned by Google Play Services), device information (model, manufacturer, screen resolution, OS version, language and country settings, mobile network, browser type/version on web), IP address, install/update sources (app) and referrer URL (web), ad impressions and clicks, app crash diagnostics.
Legal basis: Art. 6 (1) lit. a GDPR (consent) for personalised ads; Art. 6 (1) lit. f GDPR for non-personalised ads. On the web AdMob is only loaded after your consent via the cookie/consent banner. Third-country transfer to the US based on SCC and the EU-US Data Privacy Framework.
Disable personalisation: you can disable personalised ads at any time: Android Settings → Privacy → Ads → Disable personalised ads; iOS Settings → Privacy → Tracking; web: via the consent banner ("Privacy → Disable ads"). AdMob will then only show contextual, non-personalised ads.
Children's data (COPPA): Our games and apps are not intended for children under 13. We neither knowingly request nor knowingly collect personal data from children under 13. Users under 13 should not install or use the games without the consent of a parent or guardian.
Further information can be found in Google's privacy policy (policies.google.com/privacy) and in the AdMob help for publishers (support.google.com/admob/answer/6128543).
10. Google AdSense (web)
This website uses Google AdSense, an advertising service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). AdSense uses cookies and similar technologies (web beacons, device IDs) to serve ads that are relevant to you. In particular, Google processes your IP address, browser and device information, referrer URL and time of ad delivery. Data may be processed in the United States; Google relies on EU standard contractual clauses for this.
Legal basis: Art. 6 (1) lit. a GDPR (consent) or lit. f GDPR (legitimate interest in economically funding the service), where permitted by law.
Personalised advertising: With your consent, Google may serve personalised ads based on your usage behaviour on this and other websites. You can disable personalised advertising at any time at adssettings.google.com.
Authorisation: Ads are delivered on behalf of Google via the publisher ID "ca-pub-9519326856798719" registered with Google; the authorisation is recorded in our ads.txt.
Further information on Google's data processing can be found in Google's privacy policy at policies.google.com/privacy.
11. Retention periods
Server log files (OVH) and Cloudflare edge logs are stored for a maximum of 30 days. Account data is stored until you delete your account. Push subscriptions are deleted after sign-out or 180 days of inactivity. Google AdSense cookies follow the provider's retention periods (typically 13 to 24 months). Session cookies expire when the browser is closed. In the mobile app, AdMob data is stored according to Google's standard policy (usually 60 days); you can reset the Advertising ID at any time in your Android settings.
12. Your rights and right to complain
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw any consent given at any time. Please send requests to [email protected].
You also have the right to lodge a complaint with the competent data protection supervisory authority. The competent authority is the one of your habitual residence or of the country where the controller has its seat, for ChillWebGames (seat: Saxony, Germany) the Saxon Data Protection and Transparency Commissioner, Postfach 11 01 32, 01330 Dresden, datenschutz.sachsen.de.