Privacy Policy

Data Controller

This policy explains how Copernicus Berlin Games handles information on your phone and when you use a room. Data controller: Copernicus Berlin e.V..

Service operator:
Copernicus Berlin e.V.
Sophienstrasse 28/29
10178 Berlin
Germany
info@copernicusberlin.de

The seller shown in the App Store may be an individual authorised to distribute the app. That seller listing does not, by itself, change who operates the service or determines how personal data is used.

Overview

You can use a nickname. Do not enter sensitive information about yourself or someone else in names, notes or answers.

Categories of Personal Data

Processing by Service Mode

Single-phone games

Game information remains on the phone. We do not receive your local notes, answers or history through an automatic upload.

Rooms on the same Wi-Fi or hotspot

Phones exchange room information directly with the facilitator's phone. These connections do not use our online server. Use a trusted network; the local TCP connection does not add its own transport encryption.

Online rooms

Player phones connect through our server to the facilitator's phone, which runs the game. Connections to our production server use HTTPS/WSS encryption. This is not end-to-end encryption: the server processes readable messages while forwarding them. The facilitator receives room information and can save it locally; players receive the game-specific information intended for their view. In Explain it!, the current word is sent only to the explainer's player view.

Camera, exports and sharing

Camera access is optional and used to read QR codes on the device, not to record or upload photos or video. You can enter a room code or address instead. When you print or share a PDF or send an email, your chosen recipient, printer or service receives what you send.

Photo Roulette and Gallery Access

Photo Roulette optionally accesses your photo library to sample random photos for a group guessing game. You can decline access and participate by guessing without contributing photos. The app does not request access to your videos or use photo location metadata.

Selected photos are resized and re-encoded as JPEG copies. You review them and can deselect photos or shuffle the selection before pressing Ready. Only the photos you approve are sent to the facilitator for the game. The owner can also skip a photo during its preview.

In a local room, approved copies travel directly between phones. In an online room, they pass through our relay server to the facilitator and the players receiving that game view. The server forwards photo data without saving it to a photo database or message-content log. The game keeps the copies in memory; generated temporary JPEG files are deleted after conversion. Game copies are cleared when the photo game ends or its screen closes. Original gallery files are not edited or deleted.

Do not share private or non-consensual images. Other people may see a photo once shared; screenshot protections cannot prevent someone photographing a screen or otherwise making a copy.

Room Reports and Support Escalation

Participants can report a player or a visible game photo and select a reason. A room report goes to the facilitator, not automatically to Copernicus Berlin. The facilitator receives the reporter display name and room player identifier, the report reason, the reported player or an opaque photo reference, the time and review status. Photo reports do not attach an image or reveal a private gallery identifier. In online rooms this metadata passes through the same relay as game messages.

A reported photo is hidden on the reporting phone. Facilitators can review reports, remove photos from the room and remove or block a player from that room. This is a room-level control, not an account ban or a personal block across the service. In-room report records remain in the facilitator app’s memory until the room ends or the app closes.

Contact app support opens your email app with the report type and reason. It does not automatically attach photos, player names or room credentials. You must review and send the email yourself; opening a draft does not deliver a report. You can contact support directly when the report concerns the facilitator. The Copernicus Berlin team monitors info@copernicusberlin.de.

If you send an email, Copernicus Berlin and its email service receive your sender address, the message and any attachments you choose to include. These emails are separate from temporary room traffic. We use them to investigate and respond, retain them only while needed for that purpose or an applicable legal obligation, and delete them when that need ends. Avoid unnecessary personal information and other people’s photos.

Purposes and Legal Bases

Room information is used to provide the multiplayer session you request, restore connections, calculate results and let the facilitator manage the group. Technical information is used to deliver the service, prevent abuse and diagnose faults. Support information is used to answer your request.

The GDPR legal bases are Article 6(1)(b) where processing is necessary to provide the requested service, and Article 6(1)(f) for the legitimate interests of service security and responding to enquiries. These interests must be balanced against your rights, particularly for young participants. Where consent is required for a particular use, it must be obtained separately and can be withdrawn for that use. A camera permission is a device permission, not blanket consent to other processing.

No data is used for targeted advertising, sale of personal information, or automated decisions producing legal or similarly significant effects.

Recipients and International Transfers

The current online service is hosted by Amazon Web Services (AWS) in Frankfurt, Germany (eu-central-1). Hosting providers process information needed to supply and secure their infrastructure. Facilitators and other players receive the game information described above. Support messages are handled through the organisation's email services.

Older test versions may still use Cloudflare Workers for online rooms. Those versions relay messages through Cloudflare and store temporary room metadata: room code, host-reconnect key and creation time. Update to a current version to use the AWS service.

Providers must be subject to appropriate data-protection terms. Where processing involves access from outside the EEA, an applicable adequacy decision or other lawful safeguard, such as the European Commission's Standard Contractual Clauses, is required.

Data Retention

• Current online server: game messages are forwarded without a gameplay database or message-content logs. Room and connection state exists in process memory. It is removed when the host ends the room, after the 120-second host-disconnect grace period, on expiry at 12 hours total or two hours without activity, or when the server restarts. Periodic cleanup can add a short delay.
• Abuse-prevention counters: the relay holds IP-keyed connection and room-creation rate-limit counters in memory across requests. They are removed when the rate-limit allowance has refilled and periodic cleanup runs, or when the server restarts. This security processing is separate from forwarding game messages.
• Support emails: retained separately as described under Room Reports and Support Escalation; ending a room or resetting the app does not erase an email already sent.
• Legacy Cloudflare room metadata: removed on room closure or scheduled expiry; the normal maximum is 12 hours, with cleanup/reconnect scheduling delays.
• Web logs: the current proxy configuration rotates logs weekly and retains 52 archived rotations, plus the active file. WebSocket connection URLs are excluded from access logs. This does not establish the separate retention periods of hosting-provider infrastructure records.
• On phones: room recovery is offered for six hours and some game recovery for three days. These cutoffs hide old saves; they do not erase the underlying records. Profile information, Bingo marks, worksheet notes and preferences can remain until cleared, overwritten or removed with the app's local data.

Device backups, copies exported by you, and information saved by a facilitator or another recipient may remain outside the app's control.

Privacy Choices and Erasure

• Use single-phone games without joining an online room, or leave a room to stop participating in that session.
• Use a nickname and change your profile information in Settings. Deny or revoke camera permission in your phone's settings.
• Use the relevant game controls to clear a Bingo card or reset a worksheet. Resetting card history only clears used-card history; it is not a full data reset.
• Ending a hosted room clears its saved room and game state on the host; profile information and remembered lobby settings remain.
• Use Settings → Reset app to clear local profiles, settings, rule acceptance, saved games, room identities, history and generated temporary files and return to initial setup. Resetting ends a room you host and leaves a room you joined. It preserves original gallery photos and cannot retract information already shared or reports emailed to support. You can also use the operating system's app-data removal options. On iPhone, Delete App removes the local app container; Offload App retains documents and data. Copies in backups or exports require separate handling.
• For a privacy request, contact info@copernicusberlin.de. Provide only the information needed to find the relevant data. We cannot retrieve or erase data that exists only on another person's phone; contact the facilitator for their copies.

There is no online user account to delete. Leaving a room does not erase data already shared with other participants.

Data Subject Rights

Where the GDPR applies, you may request access, correction, erasure, restriction or portability where the legal conditions are met. You may object to processing based on legitimate interests and withdraw consent where consent is the basis, without affecting earlier lawful processing. Contact info@copernicusberlin.de to exercise these rights.

You may complain to a supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information, or the authority in the place where you live or work.

Children and Young Persons

Store content ratings describe the suitability of game content; they do not verify a player's age or provide consent to share personal information or photos. The in-app age-content setting controls which questions are shown. Facilitators must choose suitable games and prompts for their group and follow any applicable consent and safeguarding requirements. Use nicknames where practical and avoid entering sensitive information. A parent or guardian with a concern can contact the privacy address above.

Website Processing and Policy Changes

These support and policy pages do not set cookies or use analytics, advertising scripts, remote fonts or embedded social-media widgets. A script served by this website highlights the section currently being read; it does not store information or send tracking requests. The server still processes ordinary web requests and technical logs as described above. External links open services with their own privacy practices.

We will update this policy when the service or its handling of information changes. The date at the top identifies this version.