Privacy Policy and Legal Notice

Last updated 10 November 2026

Dorfrivalen is a small browser game run by one person. It keeps as little about you as it can. You can play the whole game without an account, and without an account nothing about you is kept on our servers.

Who runs Dorfrivalen

Dorfrivalen is a private project, run without profit by Thomas Fercher, Graz, Austria: the controller of your data under the GDPR, and the media owner under § 25 of the Austrian Media Act. For any question or request, about your data or anything else, write to dorfrivalen@protonmail.com.

Playing without an account

• Your games and settings are saved in your browser's local storage on your device. They never leave it, except for the moves you send while playing online, or once you sign in (see Accounts). Clearing your browser's site data removes them.
• Play counts. When you open the game, start, continue, finish or leave a game, we count it. With a game we keep how it was set up and how it went: local or online, website or Discord, touch screen or mouse, the map shape, the rules and expansions on, how many people and computers played and the computers' style and level, the points to win and the turn time limit, and at the end the turn reached, the minutes played, the winning score and whether the winner was you, another person or a computer. We never keep names, moves or chat with it. A game is told apart by a hash of its seed and start time, so every screen at one table counts it once. A visitor is counted as a hash of your IP address and browser, salted afresh each day, so the same device counts once a day and can't be followed from one day to the next. Your IP address itself is not stored. We also keep the country Cloudflare reports for the request.
• We use no cookies, no advertising and no third-party analytics or tracking.

Playing online with friends

• Relay tables (the default, and the only kind inside Discord): your moves pass through our server to the other players at the table. The server passes them on and stores none of them. The table code, and the name and colour you choose, are shown to the others at the table.
• Server tables and quick match: our server runs the game and keeps its state while the table is open, deleted at the latest an hour after the game ends. The name and colour you sit down with are shown to the others at the table. Quick match needs no account: the server matches you with whoever else is looking and gives your seat a token for that game only. If a host lists a server table on the open tables, anyone using quick match can see the table's code, the island, and the names and colours of the people sitting there until the game starts.
• P2P tables (when you choose “P2P table”): your browser connects straight to the other players' browsers, so they can see your IP address. To set up that connection your browser briefly contacts a connection broker (ours, or the public PeerJS server at 0.peerjs.com), Google's STUN server, and, when a direct connection isn't possible, Cloudflare's TURN relay. Each of these sees your IP address.
• To stop abuse, our servers limit how many connections and requests come from one address. Game connections are counted in memory for about a minute. Sign-ins and friend-code lookups are counted against a keyed hash of your IP address, which is deleted within an hour. The address itself is never stored.

Accounts

An account is optional. It adds friends, invites and ranked games, and keeps your game the same on every device you sign in on. You need to be at least 16 to create one.

You can sign in with Google or Discord. With Google, we receive and keep your Google account ID and your email address, if Google has verified it. With Discord, we ask only for your basic Discord profile and keep just your Discord user ID, not your email. Either way, we don't keep your name, picture or access tokens from that service, and we never show your email or account IDs to other players.

With an account we keep:

• Your profile: the name and colour you pick, your friend code and, if you choose one, your country. Your country is shown only to you.
• Friends: your friends, friend requests, the players you've blocked and any reports you've made about a player. A friend can see whether you're online.
• Invites you send or receive. They're deleted after 30 minutes.
• Your game data: your settings, the islands and rulesets you save, the game you can continue, and your last 20 online games with the names and colours of the people at them (and their friend codes, if they were signed in). Only you can see them. Whatever you'd saved in this browser before signing in joins your account at your first sign-in. Profile → Forget recent games removes those games.
• Rulesets you publish: a ruleset you publish to the community choices is shown to everyone who plays, with its name, its rules and your profile's name and colour, until you take it down. We also keep which published rulesets you've starred or reported. Nobody else can see your stars or reports.
• Ranked play: your rating for the current season, your games and wins, and for each ranked game the place you finished and how your rating changed. Once you've played a ranked game in a season, the public leaderboard shows your profile's name and colour with your rating and number of games. Profile → Hide me from the leaderboard takes you off it at any time. While a ranked game is running, our server keeps that game's state. It's deleted when the table closes, at the latest an hour after the game ends.
• Sessions: a sign-in token for each device, valid for up to 30 days. We don't store the IP address or browser of a session.

Your account data stays until you delete your account. A sign-up that isn't finished is deleted after 24 hours. In the game, Profile → Download my data gives you everything we hold about you as a file. Profile → Delete account deletes it all at once.

Playing in Discord

When you play Dorfrivalen as a Discord Activity, Discord's own Privacy Policy applies to what Discord handles. If you sign in there, Discord first asks whether to allow it, and we receive your Discord user ID as described above. All game traffic goes through Discord's proxy, so our server sees Discord's addresses instead of yours.

Who processes data for us

• Cloudflare hosts the game and our servers. Our database and game servers are placed in the EU.
• Google handles sign-in if you sign in with Google, and runs the STUN server used by P2P tables.
• The PeerJS project runs the public broker that P2P tables may use.
• Discord, when you play there or sign in with Discord.

Some of these companies are based outside the EU. Where data is transferred there, it's covered by the EU–US Data Privacy Framework or the EU's standard contractual clauses.

Why we may use it

• To run the game and your account: to perform our agreement with you (GDPR Art. 6(1)(b)).
• Abuse limits and anonymous play counts: our legitimate interest in keeping the game working and knowing roughly how much it's played (Art. 6(1)(f)).

Your rights

You have the right to access, correct, delete, restrict and export your data, and to object to how we use it. Most of this you can do in the game. For anything else, email us. You can also complain to a data protection authority. In Austria that's the Datenschutzbehörde (dsb.gv.at).

Changes

If this policy changes, the new version will be posted here with a new date.