Privacy Policy

Pointification is operated by Mirza Polat. You can reach me through kontakt (at) pointification.de.

When you create an account or use the service, the following data is stored:

• your email address (for sign-in and notifications)
• a hashed password
• games, teams, and scores that you create or that are shared with you
• point change logs (timestamp, team, delta, who made the change)
• technical access logs created by the hosting and database providers (IP address, user-agent, timestamp) — used for security and abuse prevention

Public game links contain only an unguessable token and the game's current state (team names, scores). Anyone with the link can read those values until you turn sharing off or regenerate the link.

The web application is self-hosted by the operator on a dedicated server located in the European Union. Your account, games, teams, scores, point logs, and any game logo you upload are stored in a SQLite database and on the file system of that same server — no third-party database, authentication, or storage service is involved. The only processor is:

• Hosting: Hetzner Online GmbH (hetzner.com) — provides the EU-based server that delivers the web application.

Hetzner processes data in the European Union. A data processing contract under Art. 28 GDPR is in place.

• Art. 6(1)(b) GDPR — performance of the contract (running the service for you).
• Art. 6(1)(f) GDPR — legitimate interest (security, abuse prevention, technical logs).
• Art. 6(1)(a) GDPR — consent, where applicable (e.g. when you publish a game via a public link).

Pointification stores a session token in your browser so you stay signed in. There are no advertising cookies and no third-party tracking pixels.

For visitor statistics the site uses Umami, an open-source analytics tool that the operator self-hosts on his own infrastructure. No data is passed to an external analytics provider. Umami sets no cookies and stores no identifier in your browser; visits are counted using a hash that is derived from your IP address and browser and rotates daily, so it cannot be traced back to you or followed across days or across other websites. Your IP address itself is never stored.

Each measurement records only:

• the page visited, the referring page, browser, operating system, device type, and screen size
• the country derived from the IP address, which is then discarded
• a handful of named actions — account created, game created, points scored, public link enabled, public scoreboard viewed, collaborator invited, donate link clicked — recorded as counts, with no account, game, or team attached

Page addresses are anonymised before they are recorded: game ids and public share tokens are replaced with placeholders, so a share link never appears in the statistics. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding how the service is used). Because no cookies are set and no personal data is stored, no consent banner is required. You can opt out of the counting entirely by enabling “Do Not Track” in your browser.

Under the GDPR you can ask to:

• access the personal data stored about you (Art. 15)
• correct inaccurate data (Art. 16)
• delete your account and data (Art. 17) — you can do this yourself from the Account page
• restrict or object to processing (Art. 18, 21)
• receive your data in a portable format (Art. 20)
• lodge a complaint with a data protection authority (Art. 77)

To exercise these rights, contact kontakt (at) pointification.de.

Account and game data is kept for as long as your account exists. When you delete your account, the games you own (and their teams, scores, and logs) are removed. Games that other users shared with you remain with their respective owners.

Technical logs at the hosting and database providers are retained according to their own policies, typically a few days to a few weeks.

This policy may be updated to reflect changes in the service or in applicable law. The current version always lives at this URL.