Privacy

1. Controller

Michael Neidhöfer

Am Brunnenberg 14

67661 Kaiserslautern

Germany

Email: info@blockypush.com

No data protection officer has been appointed; none is legally required.

2. In short

You can play Blocky Push without an account. Your progress then stays in your browser only.

With an account we store your email address, your progress and — if you choose one — your player name. Only your player name, your results and the courses you share are public. We never show your email address to anyone.

We currently use no advertising or analytics services and no cookies for advertising or statistics. If that changes, we will ask for your permission first via the consent banner.

3. Visiting the website (hosting and server logs)

The website is operated by Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden, and delivered through a worldwide content delivery network. Lovable processes data on our behalf (Art. 28 GDPR).

Each page request involves technically necessary data: IP address, date and time, requested address, amount of data transferred, browser and operating system, and the referring page. This is required to deliver the website and protect it against misuse and attacks.

Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR). We do not use these logs to identify people. The host deletes them once they are no longer needed for operation and security.

4. Playing without an account: browser storage

The game stores your progress (solved levels, records, stars), language, sound and control settings, and courses you build in your browser's local storage. This data does not leave your device.

This storage is strictly necessary to provide the features you explicitly use (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings; the game also offers “Reset progress”.

Neither the game nor the website loads content from third-party servers; fonts and graphics are embedded.

5. Account

An account needs an email address and a password. We store: email address, password (only as an encrypted hash we cannot read), a random user ID, the times of sign-up and sign-in and the IP address used (security log of the sign-in service).

You receive emails from the sign-in service to confirm your address and to reset your password.

With an account the game mirrors your progress and your own courses to our server so you can continue on other devices.

Legal basis: performance of the user agreement (Art. 6(1)(b) GDPR). We keep the data until you delete your account, which you can do yourself at any time on the “Account” page; all related data (progress, player name, results, courses, hearts, reports) is deleted with it immediately.

Accounts are intended for people aged 16 and over. Younger players need the consent of a parent or guardian. Playing works without an account.

6. Public data: player name, leaderboards, community courses

If you choose a player name, it is public: on the daily course leaderboard, on community course leaderboards and as the author of courses you share. Please don't pick a name that identifies you if you don't want that.

Leaderboards: when you solve the daily course or a community course with an account, the game sends your sequence of moves and your time to our server. The server replays the moves to rule out cheating. Only player name, move count, time and rank are public — not the move sequence itself.

Shared courses are public with title, layout, the author's player name, number of solutions and number of hearts. Who gave which heart is not public.

Reports: when you report a course we store the reason, your optional text, the time and your user ID to prevent abuse of the reporting system. The author is not told who reported.

Legal basis: performance of the user agreement (Art. 6(1)(b) GDPR); for moderation also our legal obligations (Art. 6(1)(c) GDPR with the Digital Services Act). Stored until the account or course is deleted; daily results older than 90 days may be aggregated or deleted.

7. Database and servers in the USA

Account, progress and community data are stored in a database of the Supabase service (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513), provided to us by Lovable. The servers are located in the USA (Amazon Web Services, North Virginia region).

Transfers to third countries are covered by the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy at info@blockypush.com.

8. Consent (cookie banner)

On your first visit a banner asks whether you allow optional services. No optional services are active at the moment. Once we use advertising or audience measurement, we will name the providers here and in the banner and only activate them after you consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

Your choice is stored in your browser (entry “blockyPush.einwilligung” with your choice and the time). You can change or withdraw it at any time via “Cookie settings” at the bottom of every page; withdrawal applies to the future.

9. Contact by email

If you write to us we process your address and message to reply (Art. 6(1)(b) or (f) GDPR) and delete them once the request is settled and no retention duty applies.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Just write to info@blockypush.com. Many rights you can exercise yourself: change your player name and delete your account on the “Account” page.

You can lodge a complaint with a data protection authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.

11. No automated decisions

We make no automated decisions with legal effect and do no profiling. The automatic check of solutions only decides whether a result enters a leaderboard. Automatically hiding a course after several reports is provisional; a human decides afterwards (see Terms of Use).