This policy explains what data we process, why we do so, and how you can exercise your rights. It also covers data connected with optional digital purchases when the shop is available.
1. Controller and contact
The controller of data connected with Plumki is Kamil Bakierzyński, ul. Juliusza Słowackiego 56/35, 80-257 Gdańsk, Poland. For privacy, access, correction or deletion matters, write to contact@plumki.games.
You can start solo and training as a guest. Creating an online account requires a separate OTP sign-in process; starting a guest game does not mean consenting to optional analytics.
You can join an online match from an invitation link without an account, as a guest. You only provide a nickname (2–24 characters). The game server issues a signed, random guest ID valid for 12 hours. Your browser keeps it in tab session storage and keeps the nickname in local storage to suggest it next time. People in the same room see the nickname. The server holds the nickname and ID in memory only while the room exists and never writes them to the database. Matches with a guest are friendly: we record no result, history, statistics or ranking change for anyone. Your IP address is used for 10 minutes to rate-limit new guest sessions (abuse prevention, Article 6(1)(f) GDPR). Joining as a guest is not consent to optional analytics. As a guest you can also open a private friendly room and invite friends to it with a link; this uses the same data and the same 12-hour ID. Every match in such a room is friendly. Public rooms, the public room list and tournaments still require an account.
2. What data we use and why
| Category | Examples | Purpose and legal basis |
|---|---|---|
| Account and sign-in | Email address, account UUID, profile display name, information needed for a one-time code. | Creating and operating the account and signing in — performance of a contract, Article 6(1)(b) GDPR. Without an email address, the online account does not work. |
| Guest from an invitation | Nickname, random guest ID, expiry time, IP address (rate limit). | Taking part in a match a friend invited you to, or opening a private friendly room — Article 6(1)(b) GDPR. Abuse prevention — point (f). The data never reaches the database and leaves the server when the room closes. |
| Appearance and progress | Selected skins, bottles, sticks, pets, unlocks and account-linked settings; optional custom PNG image. | Providing profile features and saving progress — Article 6(1)(b) GDPR. A custom image is also processed under the content rules in the terms. |
| Matches and results | Match IDs, participants, result, throws, statistics, gameplay telemetry and trajectory archive. | Maintaining history and results, security, dispute resolution and service development — Article 6(1)(b) and (f) GDPR, especially security and abuse prevention. |
| Social features | Friend relationships, online status, invitations and spectator permissions. | Connecting players and operating online features — Article 6(1)(b) GDPR. Invitations expire after 10 minutes, but this does not automatically delete related data. |
| Ranking | Display name, result statistics and ranking position visible to signed-in players. For “Ghost training”, signed-in players can also load the throws and the drinking and collecting times from the last 30 cardless ranked 1v1 matches of any player with at least 10 ranked 1v1 matches, together with that player's equipped character, stick, bottle and pet skins; a ghost match runs in the browser and does not enter results, rankings or history. | Providing competition features and result integrity — Article 6(1)(b) and (f) GDPR. |
| Orders and payments | Account and order IDs, pack, price, currency, payment status, dates, purchase-terms version and preserved text, confirmation recipient and language, delivery status, Stripe session and payment identifiers, payment events, refunds and disputes. Depending on the chosen method, Stripe may collect an email address, billing details and payment-method details; we do not store the full card number in the game. | Forming and performing the contract, assigning the pack, confirming the purchase, refunds and complaints — Article 6(1)(b) GDPR. Applicable accounting obligations — point (c); security, fraud prevention and defending claims — point (f). |
| Contact and reports | Email address, message content and information needed to respond. | Support, security and handling complaints — Article 6(1)(f) GDPR; where a report concerns a contract, also Article 6(1)(b) GDPR. |
Visibility in online features
Signed-in players may see completed match history, results, statistics and available trajectory archives and replays within the history features. Friends and opponents may see online status and information needed to connect. Spectating is available only after the authorization provided by the game. An email address is used for sign-in and is not a public profile name.
Shareable cards and clips
The “Share” button next to the player card and a match result creates a PNG image directly in your browser; we do not upload it to our servers. The image contains your display name, result, rank and statistics, as well as the arena and match date. Other players' names are replaced by a generic label such as “Opponent” by default; they appear in the image only if you select that option yourself. Include another person's nickname only if they agree.
When you share the image through the system share menu, the clipboard or a downloaded file, its content leaves the group of signed-in players and reaches the people or services you choose, such as a messenger or social network. Further processing follows the rules of those services. If you consent to optional analytics, we record only the card type, format, sharing method and whether other players' names were shown — no nicknames, identifiers or the image itself.
The “Clip” button on the results screen and in the replays creates a short vertical video (6–15 s) from the saved match moments. The video is rendered and encoded only in your browser and is not uploaded to our servers. It shows the player models in their skins, the course of the action and captions: your display name, the result, the arena and the plumki.games address. Other players' names are replaced by a generic label by default and appear only if you select that option; Stream mode can hide them as well. The video contains only game sounds and music with a confirmed licence. Once you share or download the file, the same rules as for cards apply. If you consent to analytics, we record only the moment type, length, file format, sharing method or failure reason — no nicknames, identifiers or the video itself.
3. Telemetry and optional analytics
Optional PostHog analytics starts after consent in the privacy banner. Consent is stored locally under plumki.privacy-consent.v1 and expires after 180 days. You can withdraw it in the consent settings or by contacting us. Withdrawal stops future analytics sending but does not delete information already sent; a deletion request is handled separately.
PostHog receives a random browser pseudonym and session ID, plus events about activity, game start and end, errors, connection and performance. Events do not include session recording, advertising or automatic capture of forms and clicks. The sanitizer removes typical tokens, passwords and email addresses; we do not intend to send player names, room codes, skins or account IDs to the analytics layer. The basis is consent — Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law.
With consent, we also measure site visits, visible time, selected navigation buttons, and the stages and outcome of signing in or registering. We record only the status “guest”, “signed in” or “unknown”, without linking analytics to an account ID. Acquisition data may include the referring site's domain and restricted UTM campaign labels; we do not record the full referring address, form contents, sign-in codes or invitations. With consent, we also record when an invitation link is shared: the place in the game, the sharing method, the team size and whether a guest shared it — without the room code, the link address or nicknames.
Regardless of the analytics choice, the server counts deliveries of the game page by day and approximate country to assess overall traffic and service reach. It determines the country locally from the connection address; this counter does not retain or transmit IP addresses, set cookies or create visitor identifiers. PostHog receives only daily totals per country and broad acquisition-source category (for example TikTok, YouTube, a game portal, a search engine or a direct visit), without a person's history or account status. The server derives the category from the utm_source tag in the page address or from the name of the site the visitor came from; it does not store the referrer itself, the page address or the campaign name. Totals include reloads and may include bots; they are not unique-person counts. In the same way, the server counts first downloads of three sound files the game needs anyway: the menu music, the menu button sound and the stick swing sound. This yields daily totals of startup stages (assets ready, menu entered, first match) per country and acquisition-source category, derived from the utm_source tag in the game page address. This measurement adds no browser request, cookie or identifier, and the stages are not linked to each other. The basis for briefly processing the address for this limited purpose is our legitimate interest — Article 6(1)(f) GDPR. Country data: DB-IP (CC BY 4.0); the database provider does not receive visitor addresses.
Links that players share with friends (for example the short room link /p/CODE, or a link from a player card or clip) carry the source label utm_source=friend and the link type; the room code is not part of that label. In the counter above they fall into the “friend” category. The short link only redirects to the game and stores nothing; its preview in messaging apps does not include the host’s nickname. The server also counts daily totals of invitation stages: opening a room, a guest’s first entry, issuing a guest ID, a match and a rematch with a guest, the end of a friendly match, and returning to the room after creating an account. PostHog receives only the stage name and its daily total — no country, IP address, account or guest IDs, room codes or nicknames. Like the page delivery counter, this counter does not depend on analytics consent; its basis is our legitimate interest in assessing whether invitations work — Article 6(1)(f) GDPR.
PostHog may also be used for necessary release flags. This separate mechanism may send an account UUID or shared anonymous identifier to determine feature availability. It concerns menus and feature presentation; a flag is not an account permission or authorization mechanism. We do not record this call as analytics. The basis is legitimate interests in security, release control and proper service operation — Article 6(1)(f) GDPR. The provider may see the IP address resulting from the network connection.
4. Browser data
The browser stores game settings, appearance, progress, tutorial and session resume data, as well as a technical Supabase session token with a name such as sb-*-auth-token. A detailed list of functions, names and clearing instructions is in the Browser data information. Non-essential data requires consent where the law requires it.
5. Recipients and providers
We use providers that help operate the service. Roles and locations depend on the feature and deployment configuration:
- Railway — server hosting; deployment runs in the Amsterdam region;
- Supabase — authentication, account database, results and file storage;
- PostHog EU — optional analytics, aggregate page-delivery and startup-stage totals and necessary release flags;
- Resend — delivery of sign-in codes and purchase confirmations;
- Stripe — payment, refund and dispute processing. It also acts on our instructions when facilitating payments and may act as a separate controller for its own legal, security and fraud-prevention purposes;
- Cloudflare — DNS and mail routing for the domain;
- Google Gmail — mailbox used for support correspondence.
Data needed for payment goes to Stripe and institutions participating in the chosen payment method. The scope depends on that method. For more about Stripe’s processing, see its Privacy Center. Its Data Processing Agreement describes the EU–US Data Privacy Framework and standard contractual clauses as possible transfer mechanisms outside the EEA; which applies depends on the particular transfer.
An EU provider region does not rule out support, subcontractors or administrative access involving transfers outside the EEA. We do not declare that all data stays in the EU or that every provider provides an identical level of protection. For transfers outside the EEA, we need an appropriate basis and safeguards required by the GDPR; details follow the current configuration and processor terms.
Public provider information: Supabase, Railway, PostHog, Resend, Cloudflare, Google and Stripe.
6. Retention
We keep account data for the life of the account and until a justified closure request is handled, subject to legal obligations and the defence of claims. Completed match results, history and trajectory archives support continuity of history and competition features. They currently have no automatic deletion date or uniform retention schedule. We apply a purpose criterion: we keep them as long as needed for these features, security, handling reports or defending claims, then delete or anonymize them after reviewing deletion rights.
We keep order and confirmation data for the time needed to fulfill the purchase and operate the account, then as needed to handle refunds, complaints and disputes, meet applicable accounting obligations, and establish, pursue or defend claims. When those purposes end, we delete or anonymize the data unless the law requires further retention. The period for each record depends on the type of obligation and the time limits for claims. Stripe applies its own retention rules to data it processes as a separate controller.
Technical records and provider backups may have their own retention periods. We do not present them as fixed periods until they have been verified in configuration and agreements.
7. Your rights
You may request access, correction, deletion, restriction of processing and portability, and object to processing based on legitimate interest. You may withdraw consent to optional analytics at any time; this does not affect the lawfulness of processing before withdrawal. Write to contact@plumki.games. By default, we do not request identity-document scans — we ask for proportionate data that locates the account and limits access by unauthorized persons.
You also have the right to complain to the President of the Polish Personal Data Protection Office. An email address is necessary for the account and OTP. If you choose to buy a pack, account, order and payment data are needed to form and perform that contract; without them you cannot buy the pack, but you can still play the basic game. Analytics settings are optional, and refusing them does not block the game. We do not make decisions producing legal or similarly significant effects about you solely by automated means. Ranking and results are game features, not decisions under Article 22 GDPR.
8. Security and updates
We use one-time-code authentication, access controls in online services and limits on data sent to analytics. No internet transmission is completely risk-free. We will announce changes to this policy by publishing a new dated version and, where a change is material to users, an additional notice.
9. Legal bases
In preparing this information, we take into account the GDPR, the Polish Act on Providing Services by Electronic Means and Article 399 of the Polish Electronic Communications Law concerning storing information on a terminal device. Bases and rights follow current law.
Game theme: Bottles and drinking are fictional elements of the Plumki setting. This is not advice or encouragement to consume alcohol.