Legal
Privacy notice
Last updated 26 September 2026
EpicYatzy uses room data to run the game, and monthly statistics and cookie-free website analytics to understand how it is used.
Who is responsible
Norbert Laszlo, based in Sweden, is responsible for this data. Contact: hello@norbertlaszlo.com.
What we process, why, and for how long
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Your guest name | Show who is at the table | Providing the game you asked for, GDPR Article 6(1)(b) | Until the room is deleted |
| Room name and settings | Create, list and run the room | Article 6(1)(b) | Until the room is deleted |
| A secret code for rejoining your seat | Let you rejoin your seat | Article 6(1)(b) | Until the room is deleted |
| Game state: dice, scores, cards, emotes | Run the game and restore it after a server restart | Article 6(1)(b) | Until the room is deleted |
| Your IP address | Deliver the connection and limit room requests | Our legitimate interest in keeping the game working, Article 6(1)(f) | The game uses a window of 60 seconds to limit requests and regularly clears expired entries from memory |
| Page visit data sent to Cloudflare Web Analytics: page address, referring site, browser and device type, load timings, and your IP address | Count page visits and measure page speed, see Website analytics below | Our legitimate interest in understanding use and improving the website, Article 6(1)(f) | Full records 7 days, then a reduced sample for reports covering the previous six months |
| Browser information sent when you join (User-Agent) | Estimate whether you use a phone, tablet or computer | Our legitimate interest in understanding use and improving the game, Article 6(1)(f) | The statistics store only a count for the device category |
Rooms are set to expire after 30 minutes without activity, or 24 hours while a game is in progress or paused. Expired rooms are removed from the live database during cleanup.
Game statistics
We keep monthly counts of rooms, players joining, AI players, room sizes and settings, and games finished or left unfinished. We also count broad device types. These are counts of game activity, not unique people. We use them to understand use and improve the game, based on our legitimate interest under GDPR Article 6(1)(f).
The stored statistics contain counts rather than records of individual games. They do not include names, player or room IDs, IP addresses, or the browser information used to estimate device type. They are kept in the game's database for the current month and the preceding 12 calendar months, with older counts removed during cleanup.
Website analytics
The website uses Cloudflare Web Analytics, provided by Cloudflare, Inc. as our data processor, to count page visits and measure how fast pages load. It does not use cookies or browser storage. When a page loads, your browser sends Cloudflare the page address without its query string, the referring site, your browser and device type, and page load timings. Cloudflare also receives your IP address as part of the connection and uses it to work out your country. Cloudflare states that Web Analytics never fingerprints individual visitors; see Cloudflare's GDPR information and privacy policy. We see only totals, such as visits per page, country, referring site and device type, never individual visitors.
Cloudflare keeps the full page-load records for 7 days and then keeps a reduced sample for reports, which we can view for the previous six months. This is based on our legitimate interest in understanding use and improving the website, GDPR Article 6(1)(f). Cloudflare, Inc. may process this data outside the EU under the EU–US Data Privacy Framework.
Where the data is
The game server and database are hosted in the European Union by a cloud hosting provider. Website analytics are processed by Cloudflare, as described above.
What stays in your browser
The game saves your guest name, preferences and rejoin codes in your browser. You can remove them by clearing this site's data in your browser. The statistics feature does not use cookies or browser storage.
Your rights
You can ask to see, correct or delete your personal data, limit how it is used, or receive a copy you can move elsewhere, where these rights apply. You can also object to use based on legitimate interest. Contact hello@norbertlaszlo.com and include the room code and guest name, if available, to help us find your data.
You may complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), or to the data protection authority in the EU country where you live.