Privacy notice

This notice explains what personal data eg4f.it collects, why, for how long and what rights you have, under Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003. The Italian version prevails in case of differences.

1. Controller

Eordea Games for Fun
Email: contact@eg4f.it

Write to the address above with any question about your data or to exercise your rights.

2. What data we process

Account data: email, player name, password (stored only as an Argon2id hash, never in clear text), preferred language, playtest choice, sign-up date, email confirmation, acceptance of the terms, last sign-in.
Security log: IP address, date and time and type of operation (successful or failed sign-ins, password changes, data exports, administration actions).
Technical browsing data: web server logs (IP address, requested page, date and time, browser) generated automatically by every visit. To limit abuse, the site also keeps the number of requests per IP address in memory for at most one hour: it is never written to disk.
Technical cookies: described in the cookie policy.
Game statistics: once EG4F games are online, the results of matches linked to your account. We will update this notice before starting.

We do not process special categories of data (art. 9 GDPR) and we do not ask for payment data.

3. Purposes and legal bases

Creating and running your account, letting you into the games and your stats: performance of a contract (art. 6.1.b).
Service emails (account confirmation, password reset, security notices): performance of a contract (art. 6.1.b).
Playtest invitations, only if you tick "I want to playtest": consent (art. 6.1.a), which you can withdraw at any time from your account page.
Site security (preventing abusive access, blocking addresses that attack the site, operation log): legitimate interest in protecting the service and its users (art. 6.1.f).
External content (trailer videos on YouTube): consent (art. 6.1.a), given with "Accept all".
Legal obligations and legal defence: art. 6.1.c and 6.1.f.

4. How long

Unconfirmed accounts: deleted automatically after 7 days.
Active accounts: until you delete them. You can do it yourself, at any time, from your account page.
Security log: 12 months, then deleted automatically. If you delete your account, the remaining entries are detached from you and stripped of the IP address.
Email confirmation and password reset links: 48 hours and 1 hour, then unusable and deleted within 2 days.
Web server logs: up to 14 days.
Database backups: at most 30 copies, replaced on a rolling basis starting from the oldest.

5. Who receives the data

Data is stored on the server that hosts the site and is never sold or handed to third parties for commercial purposes. It is processed only by:

the controller and the people they authorise to administer the site;
Google LLC (Gmail), which sends service emails on our behalf and therefore processes your email address and the message content. Google participates in the EU-U.S. Data Privacy Framework; the transfer to the United States relies on the European Commission's adequacy decision of 10 July 2023;
Google Ireland Ltd / YouTube, only if you accept external content and open a page with a trailer: the player uses the youtube-nocookie.com domain and receives your IP address;
public authorities, only when the law requires it.

6. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection (arts. 15–22 GDPR), and to withdraw consent at any time without affecting processing already carried out. From your account page you can already edit your data, download it as JSON and delete your account yourself. For anything else write to contact@eg4f.it: we reply within one month.

If you believe the processing infringes the GDPR you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the authority of your country.

7. Minors

You must be at least 14 to create an account (art. 2-quinquies of Legislative Decree 196/2003). If we find an account belonging to a younger person we delete it.

8. Security

The site only uses encrypted connections (HTTPS), passwords stored with Argon2id, protection against forged requests (CSRF), limits on sign-in attempts and an email code to access administration. Fonts are served from our own server: visiting the site sends no data to third parties.

9. Automated decisions and artificial intelligence

We do not run artificial intelligence systems on your data and do not use it to train models (see Artificial intelligence). We do not take decisions based solely on automated processing that produce legal effects on you. A temporary block of an IP address after many failed sign-ins is a security measure and can be challenged by writing to us.

10. Changes

If we change this notice we update the date at the top. For important changes we email account holders.