Last updated 10 August 2026.
KLOTZO is a browser game. You can play it without an account, without a name, and without agreeing to anything. This page says exactly what is stored when you do more than that, and why.
There is no analytics platform on this site. No Google Analytics, no Facebook pixel, no session recording, no advertising tag. The page's content security policy does not permit third-party scripts at all, which is enforced by your browser rather than by our good intentions.
We do count visits, on our own server, in a way that stores nothing at all on your device. That is described in full under How visits are counted, and it is the reason this site has no cookie banner: there is no cookie to ask you about.
The operator named in the imprint is the controller for the processing described here. Contact: hello@klotzo.com.
Nothing about you is written to our database. The name you type into the menu box is kept in your own browser and sent to the game server only so the other player can see who they are playing; it is not stored after the match unless you have an account.
Our web server writes ordinary access logs (IP address, time, requested URL, user agent), which is what lets us find faults and notice abuse. Your IP address is also held briefly in memory to rate-limit sign-ups and logins. It is never written to the database in a form that identifies you; the one place it is used beyond that is the visit counting described next.
We want to know how many people play, how long a session lasts, and how many come back. We do not want to follow anybody around to find out. So the counting works like this:
The legal basis is our legitimate interest in knowing whether the game is working and worth continuing (Art. 6(1)(f) GDPR). Because nothing is stored on or read from your device, this does not require consent under the ePrivacy rules that cookie banners exist for. You can object at any time using the contact address above.
| Stored | Why |
|---|---|
| Email address | To sign you in, verify the address, and reach you about your subscription. |
| Password | Never in plain text. Only a scrypt digest with a per-account salt. |
| Display name | Shown to other players and on the leaderboards. |
| Sign-in sessions | Only a SHA-256 hash of each session token, so the table cannot be used to sign in as you. |
| Verification codes | A six-digit code and its attempt count, deleted as soon as it is used or expires. |
| Scores and records | Your solo scores, win/loss record and personal bests. |
| Scheduled matches | Matches you arrange or answer an invite to. See below. |
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for the account itself, and our legitimate interest in a working, non-abusable service (Art. 6(1)(f)) for rate limiting and fault logs.
A scheduled match stores what you typed — its title, the time, and any note — against your account, plus a random link token. Anyone holding that link can see all of it, which is the point of a link you send to your friends: it is the only credential, so treat it the way you would treat the address of a private chat.
Saying you are coming puts your display name in front of everyone else holding that link. Your email address is never shown to them, and neither is anything else about your account. Nobody is told who merely opened the link and said nothing.
Matches are private to whoever has the link unless we put one on the public calendar at /events.html, which is done by hand and only for announced events like championships. On that page the title, time, host name and head count are visible to anyone.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) — arranging the match is the thing you asked for.
Payment is handled entirely by Stripe. We never see or store your card details. What we keep is your Stripe customer id, the status of your subscription, and the id of the checkout that created your account. Stripe processes the payment as its own controller under its privacy policy.
Both work the same way, and both store one opaque random id in your browser. It identifies this browser to our own server so a creator can be credited, or so we can tell which adverts are worth paying for. It is not a profile and it is not shared with anyone.
An advert click additionally carries an identifier from Google in the landing URL. We ask before storing it, and we ask only if you actually arrived on an advert. If you say no, it is discarded and the URL is cleaned. If you say yes, it is stored and later reported back to Google alongside the fact that a match was played or a subscription started, so a campaign can be measured. Legal basis: your consent (Art. 6(1)(a) GDPR and §25(1) TDDDG), which you can withdraw at any time by clearing this site's data in your browser.
No advertising script from Google or anyone else runs on this site, and no third-party advertising cookies are set. The advertisements shown between matches are our own, served from this site.
| Who | What for | Where |
|---|---|---|
| Hetzner | Server hosting | Germany |
| Supabase | Database | EU (eu-west-1) |
| Stripe | Payments | EU / USA |
| Email provider | Verification and reset emails | See the imprint |
| Google Ads | Only if you consented, and only conversions | USA |
You can ask for a copy of your data, correction of it, deletion of it, restriction of processing, or portability, and you can object to processing based on legitimate interest. Email hello@klotzo.com and it will be done. Deleting your account also deletes your scores and your ladder record. You may also complain to a supervisory authority.
Accounts are not intended for children under 16. If you believe a child has created one, email us and it will be removed.