Last updated 30 September 2026.
KLOTZO is a browser game. You can play it without an account, without a name, and without agreeing to anything. This page says exactly what is stored when you do more than that, and why.
There is no analytics platform on this site. No Google Analytics, no Facebook pixel, no session recording, no advertising tag. The page's content security policy does not permit third-party scripts at all, which is enforced by your browser rather than by our good intentions.
We do count visits, on our own server, in a way that stores nothing at all on your device. That is described in full under How visits are counted, and it is the reason this site has no cookie banner: there is no cookie to ask you about.
The operator named in the imprint is the controller for the processing described here. Contact: hello@klotzo.com.
The name you type into the menu box is kept in your own browser and sent to the game server only so the other player can see who they are playing. Nothing else about you is written to our database — with one exception, which is the round itself: when a game or a match ends, your browser uploads a recording of the boards it just drew. That is described under recorded rounds below.
Our web server writes ordinary access logs (IP address, time, requested URL, user agent), which is what lets us find faults and notice abuse. Your IP address is also held briefly in memory to rate-limit sign-ups and logins. It is never written to the database in a form that identifies you; the one place it is used beyond that is the visit counting described next.
We want to know how many people play, how long a session lasts, and how many come back. We do not want to follow anybody around to find out. So the counting works like this:
The legal basis is our legitimate interest in knowing whether the game is working and worth continuing (Art. 6(1)(f) GDPR). Because nothing is stored on or read from your device, this does not require consent under the ePrivacy rules that cookie banners exist for. You can object at any time using the contact address above.
| Stored | Why |
|---|---|
| Email address | To sign you in, verify the address, and reach you about your subscription. |
| Password | Never in plain text. Only a scrypt digest with a per-account salt. |
| Display name | Shown to other players and on the leaderboards. |
| Sign-in sessions | Only a SHA-256 hash of each session token, so the table cannot be used to sign in as you. |
| Verification codes | A six-digit code and its attempt count, deleted as soon as it is used or expires. |
| Scores and records | Your solo scores, win/loss record and personal bests. |
| Scheduled matches | Matches you arrange or answer an invite to. See below. |
| Country | Two letters, shown as a flag next to your name on your profile and on the world table. See below. |
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for the account itself, and our legitimate interest in a working, non-abusable service (Art. 6(1)(f)) for rate limiting and fault logs.
Every game and every match is recorded while it is played, and the recording is uploaded when the round ends. It holds the boards and nothing else: the blocks that were settled, the piece that was falling, and how much time passed between one picture and the next — about fifteen pictures a second, of your board and, in a 1v1, of your opponent's as their game sent it. The name shown on it is the one that was in the menu box. There is no video of you, no sound, no keystrokes, and nothing about your device.
It is uploaded to give a finished round a page somebody can watch, at a
link like /p/…, which is the link the share button hands
you. That page is public to anybody who has the link, and it is not
listed or searchable. A 1v1 recording is also linked from the match page,
which was already public — see the note at the top of it about which
numbers are the server's and which are a player's own.
While a round is in progress the recording lives in your own browser's storage and nowhere else; if the round never finishes, it is thrown away rather than uploaded. Legal basis: our legitimate interest in a game whose results can be looked at and shared afterwards (Art. 6(1)(f) GDPR), and performance of a contract (Art. 6(1)(b)) where the round is a match on an account. You can object at any time using the contact address above, and ask for a recording to be removed — a link to it is enough to find it.
An account carries a country: two letters, shown as a flag beside your name on your public profile and used to rank you against other players from the same place. It is optional — you can set it to nothing at any time in the account panel, and nothing else changes.
When you sign up we guess it once, from the language your browser asks for pages in, so that the field is not empty for most people. Every browser sends that with every request — it is how a site knows to answer in German rather than English — and a language often names a country ("de-DE", "en-GB"). Your address is not looked at for this at all. The two letters are written down and nothing else is: no IP, no city, no coordinates, no record that a guess happened. Nothing is downloaded and no third party is asked.
The guess is only a starting value, and it is often wrong — anybody running their computer in a language other than the one where they live gets the wrong flag, or none at all. You can change it, and once you do we never guess again for your account. Legal basis: our legitimate interest in a leaderboard that can be read by region (Art. 6(1)(f) GDPR), and your consent by choosing one when you set it yourself.
You can invite somebody who does not play yet by typing their email address. We store that address, the account that sent the invitation, and a random token — the link in the invitation — so that when the person signs up we know who invited them and can put the two of you on each other's friends lists. That is the only thing it is used for. The address is never used to advertise anything, is never passed to anyone else, and receives exactly one email.
An unanswered invitation is deleted after 30 days, and one that has been used is deleted 30 days after that. Legal basis: our legitimate interest, and the sender's, in letting people bring a friend to a game (Art. 6(1)(f) GDPR). If somebody invited you and you would rather we did not hold your address at all, write to us and it goes immediately — see your rights below.
An avatar is optional. There are two kinds and they hold different amounts of you, which is the reason they are described separately here.
| Stored | Why |
|---|---|
| A drawing | Not a picture: a list of tetromino positions and colours, a couple of kilobytes of numbers. It cannot contain anything that was not placed block by block in the editor. |
| An uploaded picture | The image itself, kept at up to 1024 pixels square, with smaller copies of it down to 64 pixels so a thumbnail does not cost a full-size download. |
| Which account it belongs to, and when it arrived | So it can be shown beside your name, and so you can remove it. |
| The review decision, and the reason for a refusal | So we can tell you why something did not go up, and so the same thing is not reviewed twice. |
An avatar that has been approved is public. Other players see it beside your name in a match, on the results card and on profile cards. Treat it the way you would treat anything else you publish under a name people can find you by.
A photograph can say more than you meant it to — where you live, who you are related to, your health, your beliefs, your ethnicity. Special categories of data (Art. 9 GDPR) are not something this site asks for or wants, so please do not upload a picture that reveals them, and do not upload a photograph of somebody else, above all not of a child.
What does not get stored is worth saying: the picture is re-encoded by your own browser before it is sent, into a plain square PNG. Everything the camera attached to the original file — the location it was taken, the device, the timestamp — is dropped on your machine and never reaches us.
While an uploaded picture is waiting to be approved it is visible to you and to the person doing the review, and to nobody else. If it is refused it is never shown to anyone else.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for storing and showing the avatar you chose, and our legitimate interest in a service that is not used to publish illegal or abusive images (Art. 6(1)(f)) for the review itself.
A scheduled match stores what you typed — its title, the time, and any note — against your account, plus a random link token. Anyone holding that link can see all of it, which is the point of a link you send to your friends: it is the only credential, so treat it the way you would treat the address of a private chat.
Saying you are coming puts your display name in front of everyone else holding that link. Your email address is never shown to them, and neither is anything else about your account. Nobody is told who merely opened the link and said nothing.
When you schedule a match you choose Public or Private; Public is preselected. A public match is listed on the calendar at /events.html together with its link, so anyone — signed in or not — can see its title, time, note, host name and head count, open it, and see the display names of everyone who answered it and the room code once the room is open. A private match is visible only to whoever has the link. We can take any match off the calendar or remove it.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — arranging the match is the thing you asked for.
Payment is handled entirely by Stripe. We never see or store your card details. What we keep is your Stripe customer id, the status of your subscription, and the id of the checkout that created your account. Stripe processes the payment as its own controller under its privacy policy.
Both work the same way, and both store one opaque random id in your browser. It identifies this browser to our own server so a creator can be credited, or so we can tell which adverts are worth paying for. It is not a profile and it is not shared with anyone.
An advert click additionally carries an identifier from Google in the landing URL. We ask before storing it, and we ask only if you actually arrived on an advert. If you say no, it is discarded and the URL is cleaned. If you say yes, it is stored and later reported back to Google alongside the fact that a match was played or a subscription started, so a campaign can be measured. Legal basis: your consent (Art. 6(1)(a) GDPR and §25(1) TDDDG), which you can withdraw at any time by clearing this site's data in your browser.
No advertising script from Google or anyone else runs on this site, and no third-party advertising cookies are set. There are no advertisements between matches at all: that panel asks you to make an account, or to chip in, and it is served from this site like everything else.
| Who | What for | Where |
|---|---|---|
| Hetzner | Server hosting and the database | Germany |
| Supabase | Database backup, being retired | EU (eu-west-1) |
| Stripe | Payments | EU / USA |
| Email provider | Verification and reset emails | See the imprint |
| Google Ads | Only if you consented, and only conversions | USA |
You can ask for a copy of your data, correction of it, deletion of it, restriction of processing, or portability, and you can object to processing based on legitimate interest. Email hello@klotzo.com and it will be done. Deleting your account also deletes your scores and your ladder record. You may also complain to a supervisory authority.
Accounts are not intended for children under 16. If you believe a child has created one, email us and it will be removed.