Privacy policy
Information under Articles 13 and 14 of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Version of 11 October 2026.
1. Controller
The controller responsible for processing personal data on allgameclub.com (the "Service") is:
AllGame Club
T. Brandl
c/o IP-Management #5763
Ludwig-Erhard-Str. 18
20459 Hamburg
Deutschland
Phone: 0160 4348884
Email: hi@allgameclub.com
We have not appointed a data protection officer because we are not legally required to (Section 38 BDSG). For every question about data protection you can reach us directly at the address above.
2. The short version
- We store what is needed to run your account, your play time, your saves and your scores. Nothing more.
- We use no advertising, no tracking cookies and no third-party analytics. There is nothing to consent to in a cookie banner, so you will not see one.
- The fonts, scripts and images of this site are delivered from our own server. No request is sent to Google Fonts or similar services when you open a page.
- Payments are processed by Stripe. Your card number never reaches us.
- Logging in with Google or Facebook is optional and only happens when you click the respective button.
- You can export and delete your data yourself in your account at any time.
3. Terms and legal bases
"Personal data" is any information relating to an identified or identifiable person (Art. 4 (1) GDPR). We process personal data only on one of the following legal bases:
- Art. 6 (1) (a) GDPR, consent: for example the newsletter. You can withdraw consent at any time with effect for the future.
- Art. 6 (1) (b) GDPR, contract: everything needed to provide the Service you registered for, including free play and the Unlimited membership.
- Art. 6 (1) (c) GDPR, legal obligation: in particular retention duties under tax and commercial law.
- Art. 6 (1) (f) GDPR, legitimate interest: security, abuse prevention, defence of legal claims and the stable operation of the Service. Where we rely on this basis we describe the interest and you have the right to object (see section 16).
Where cookies or similar technologies are used, Section 25 TDDDG applies in addition. All storage we use on your device is strictly necessary to provide the Service you request, so no consent is required (Section 25 (2) no. 2 TDDDG).
4. Hosting and server logs
The Service runs on servers located in Germany and operated for us by hosting providers in the European Union under data processing agreements pursuant to Art. 28 GDPR. Our database and our outgoing email are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
Every time you call up a page the web server records the following in a log file: the requested address, date and time, the amount of data transferred, the HTTP status, the page you came from (referrer), your browser and operating system, and your IP address. We need these logs to deliver the pages, to detect attacks and to find errors. Legal basis: Art. 6 (1) (f) GDPR (secure and stable operation). Log files are deleted or anonymised after 30 days at the latest unless an incident requires us to keep a specific entry as evidence.
5. Cookies and storage on your device
We use only technically necessary storage. None of it is used to track you across websites.
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
agc_session | Keeps you logged in during a visit, protects forms against cross-site request forgery, stores short status messages. | First-party cookie (HttpOnly, Secure) | Until the browser is closed |
agc_remember | Only if you tick "keep me logged in" when signing in. Contains a random token, never your password. | First-party cookie (HttpOnly, Secure) | 30 days, or until you log out |
| Local storage of individual games | Some games remember a setting or which round you played last so that the next round looks different. The data stays in your browser and is not sent to us. | Browser localStorage | Until you clear your browser data |
Legal basis: Section 25 (2) no. 2 TDDDG together with Art. 6 (1) (b) GDPR. You can delete cookies in your browser at any time; without the session cookie you cannot stay logged in.
6. Account registration and profile
To play you create an account. We process your email address, a username, a display name and a password, which we store only as a salted hash (never in plain text). Optionally you can add a profile picture, a short bio and your country. Your username, display name, picture, bio and country are visible to other members on your public player page and on leaderboards; your email address is never shown.
During registration we send you an email with a confirmation link and record when you accepted the terms and this policy. Legal basis: Art. 6 (1) (b) GDPR; the proof of acceptance is based on Art. 6 (1) (c) and (f) GDPR (accountability, Art. 5 (2) GDPR).
Providing the email address, username and password is necessary to conclude the contract; without them no account can be created. Everything else is voluntary.
7. Signing in with Google or Facebook
Instead of a password you can link your account to Google or Facebook. This only happens when you actively click the respective button; simply visiting our pages sends no data to these providers.
When you use it, you are forwarded to the provider, authenticate there and the provider sends us your account ID with that provider, your name, your email address (if confirmed there) and the address of your profile picture. We use these to create or sign you into your AllGame Club account and store the provider ID so you can sign in again. We receive no access to your contacts, posts or friends.
- Google Sign-In: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: policies.google.com/privacy. (Not yet activated on this site.)
- Facebook Login: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Privacy policy: facebook.com/privacy/policy. (Not yet activated on this site.)
The providers may transfer data to their parent companies in the United States. Google LLC and Meta Platforms, Inc. are certified under the EU-US Data Privacy Framework; in addition the providers use the EU standard contractual clauses. Legal basis: Art. 6 (1) (b) GDPR (you request this sign-in method) and Art. 49 (1) (b) GDPR for the transfer initiated by you. You can unlink a provider at any time under Account → Security.
8. Playing: play time, saves, scores and favourites
While a game is open we measure the play time in order to apply the free daily allowance and to show you your statistics. For each play session we store the game, start and end time, the duration, and, for abuse prevention, your IP address and browser identifier. IP address and browser identifier are deleted from play sessions after 30 days.
Games may store save states and submit scores through our API. Saves are visible only to you. Scores appear on the public leaderboard of the respective game together with your username and display name; you can ask us to remove a score at any time. Favourites are visible on your player page.
Legal basis: Art. 6 (1) (b) GDPR; the IP address in play sessions is processed under Art. 6 (1) (f) GDPR (prevention of cheating and multiple accounts).
9. Community, online status and invitations
Logged-in members can see on the community page which other members are currently online (last activity within the last five minutes), which game they are playing and their best scores. This is part of the social features you sign up for when you join the Club. You can hide yourself from the online list at any time under Account → Profile ("Show me in the community"). The online list is never visible to visitors who are not logged in.
When you invite another member to a game, we store the invitation (sender, recipient, game, optional message, time) and show it to the recipient. If the recipient is offline we also send them an email notification. Invitations expire automatically and are then deleted.
Legal basis: Art. 6 (1) (b) GDPR; the presence display additionally rests on Art. 6 (1) (f) GDPR (our interest and that of members in finding people to play with), balanced by the opt-out described above.
10. Multiplayer rooms and uploaded pictures
Some games (for example Photo Puzzle) let you open a room, invite others and upload a picture that all participants see. Uploaded pictures are stored on our server and shown only to members in that room (or to everyone if you mark the room as public). Please upload only pictures you have the right to share, and ask the people shown in them first. Rooms, including the picture and the positions of the players' pointers that are exchanged live during the game, are deleted 30 days after the last activity. You can close a room earlier at any time.
Legal basis: Art. 6 (1) (b) GDPR.
11. Unlimited membership and payments
If you purchase the Unlimited membership we store the plan, the price, the start and end of the period, the status (active, cancelled, expired) and a reference to the transaction. The payment itself is processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe"). You enter your payment details directly on Stripe's secure pages; we never receive your full card number. Stripe transmits to us the result of the payment, the last four digits and brand of the card, the amount and a transaction ID.
Stripe processes your data partly as our processor and partly as an independent controller (for example for fraud prevention and its own legal obligations). Stripe may transfer data to Stripe, Inc. in the USA on the basis of the EU-US Data Privacy Framework and standard contractual clauses. Details: stripe.com/privacy.
Invoices and booking records are kept for ten years from the end of the calendar year in which they were created (Sections 147 of the German Fiscal Code, AO, and 257 of the German Commercial Code, HGB). Legal basis: Art. 6 (1) (b) and (c) GDPR.
12. Emails we send
We send transactional emails that are necessary for the Service: confirmation of your email address, password resets, notification of invitations, confirmations and reminders concerning your membership, and replies to your messages. These are sent through our own mail server at Hetzner Online GmbH (Germany). Legal basis: Art. 6 (1) (b) GDPR.
A newsletter with news about games and the studio is sent only if you have opted in. You can unsubscribe at any time in your profile or via the link in every newsletter. Legal basis: Art. 6 (1) (a) GDPR; we record the time of your consent and withdrawal for accountability (Art. 7 (1) GDPR). We do not use tracking pixels in emails.
13. Contact form and support
When you write to us through the contact form or by email we process your name, email address, the topic, your message and, for the contact form, your IP address (to block automated spam). We use this data solely to handle your request. The IP address is deleted after 30 days; the message itself is deleted twelve months after the request has been settled unless statutory retention periods apply. Legal basis: Art. 6 (1) (b) GDPR if the request relates to your account or a contract, otherwise Art. 6 (1) (f) GDPR (answering enquiries).
14. Developer API
Developers can create API keys and players can create personal access tokens in their account. Keys and tokens are stored as hashes and shown to you only once. When the API is used we record the key or token used, the time, the endpoint and, for unauthenticated calls, the IP address, in order to enforce rate limits and detect abuse (Art. 6 (1) (f) GDPR). Rate-limit records are deleted shortly after they expire (the cleanup runs every 15 minutes).
Developers who publish a game module on the Club receive, via the API, only the data of players who play their game that is described in our developer documentation (player ID, display name, scores and save states of that game) and are bound by our developer terms to use it solely for operating their game.
15. Security log
Security-relevant actions on your account (login, password change, API key creation, membership changes, account deletion) are recorded in an audit log with time, action and IP address so that we can investigate misuse and support you if something looks wrong. IP addresses in this log are deleted after 30 days; the remaining entries are deleted together with your account. Legal basis: Art. 6 (1) (f) GDPR (security) and Art. 32 GDPR.
16. Recipients of your data
Within our organisation only the people who need your data to provide the Service have access. In addition we use the following categories of recipients:
| Recipient | Purpose | Location | Role |
|---|---|---|---|
| Hosting providers (web server, database, email); Hetzner Online GmbH, Gunzenhausen, Germany | Operation of the Service, storage of data, delivery of email | Germany / EU | Processor, Art. 28 GDPR |
| Stripe Payments Europe, Ltd., Dublin, Ireland | Payment processing for the membership | Ireland; transfers to the USA possible | Processor and independent controller |
| Google Ireland Limited, Dublin, Ireland | Only if you choose "Sign in with Google" | Ireland; transfers to the USA possible | Independent controller |
| Meta Platforms Ireland Limited, Dublin, Ireland | Only if you choose "Sign in with Facebook" | Ireland; transfers to the USA possible | Independent controller |
| Other members | Username, display name, picture, bio, country, scores, favourites, online status (if enabled) and invitations you send | Worldwide | Recipients within the Service |
| Authorities, courts, legal advisers | Only where we are legally obliged or where it is necessary to establish, exercise or defend legal claims | Germany / EU | Independent controllers |
We do not sell personal data and do not pass it on to advertisers.
17. Transfers to countries outside the EU/EEA
We store all data in Germany. A transfer to a third country only takes place in the cases described in sections 7 and 11, when you actively use Google, Facebook or Stripe. These providers are certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR) and additionally use the standard contractual clauses of the European Commission (Art. 46 (2) (c) GDPR). You can request a copy of the relevant safeguards from us.
18. How long we keep data
| Data | Retention |
|---|---|
| Account, profile, saves, scores, favourites, play statistics | Until you delete your account. Accounts that have never been confirmed are deleted after 30 days. |
| IP addresses in play sessions, audit log and contact messages | 30 days |
| Web server log files | 30 days |
| Session cookie | End of browser session |
| Remember-me token | 30 days or until logout |
| Email confirmation and password-reset links | 7 days |
| Invitations | Until accepted, declined or expired (then deleted) |
| Multiplayer rooms including uploaded pictures | 30 days after the last activity |
| Contact messages | 12 months after the request is settled |
| Invoices, orders, payment references | 10 years (Sections 147 AO, 257 HGB) |
| Payment-provider webhook events | 90 days |
| Newsletter subscription | Until you unsubscribe |
When you delete your account, all data linked to it is deleted immediately, except for the records we must keep under tax and commercial law. Those are blocked from any other use and deleted when the retention period ends.
19. Your rights
You have the following rights with regard to your personal data:
- Access (Art. 15 GDPR): to learn which data we process about you. Your account offers a one-click export of all your data as a JSON file under Account → Profile ("Download my data").
- Rectification (Art. 16 GDPR): you can correct most data yourself in your profile.
- Erasure (Art. 17 GDPR): you can delete your account yourself under Account → Security; statutory retention duties remain unaffected.
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR): the export mentioned above is provided in a machine-readable format.
- Withdrawal of consent (Art. 7 (3) GDPR): with effect for the future, for example by unsubscribing from the newsletter.
- Not to be subject to automated individual decisions (Art. 22 GDPR): we make no such decisions and do no profiling.
Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. If data is processed for direct marketing, you may object at any time without giving reasons; we will then no longer process it for that purpose.
To exercise your rights, email hi@allgameclub.com or write to the postal address in section 1. We answer within one month.
Right to lodge a complaint (Art. 77 GDPR): you can complain to a data protection supervisory authority, in particular in the member state of your habitual residence or place of work, or at the place of the alleged infringement. The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 7. OG, 20459 Hamburg, Germany, datenschutz-hamburg.de.
20. Obligation to provide data
You are not legally obliged to provide any data. Without an email address, username and password, however, we cannot create an account, and without payment data we cannot provide the Unlimited membership. Visiting the public pages (home, catalogue, studio pages) is possible without registration.
21. Security
All pages are delivered exclusively over TLS-encrypted connections (HTTPS). Passwords are stored as salted hashes using current algorithms recommended by PHP, API keys and tokens are stored as hashes, cookies are marked HttpOnly and Secure, forms are protected against cross-site request forgery, and administrative access is restricted and logged. We regularly review and update these measures (Art. 32 GDPR).
22. Children
The Service is intended for people aged 16 and older. Under Art. 8 GDPR in conjunction with German law, children under 16 need the consent of a parent or guardian to register. We do not knowingly collect data from younger children; if you believe a child has created an account without such consent, please contact us and we will delete it.
23. Changes to this policy
We update this policy when the Service or the law changes. The current version is always available at https://allgameclub.com/privacy. For material changes affecting registered members we will inform you by email or by a notice in your account before the change takes effect.