Below we explain what data the Powiatówka game collects, why we need it, who we share it with and what rights you have. This policy fulfils the information obligation under Article 13 GDPR.
1. Data controller and contact
The controller of your personal data is ArchXS Dariusz Tyszka, address: al. Komisji Edukacji Narodowej 52/77, 02-785 Warszawa, NIP (tax ID) 7591323387, REGON 146517520 (we or the Operator).
You can write to support@powiatowka.com or to the postal address above about anything concerning personal data. We have not appointed a data protection officer, as the law does not require one in our case.
2. What data we process and why
We process only the data needed to run the game and to meet our legal obligations. If you play without an account, we do not know your name or email address. The legal bases refer to the points of Article 6(1) GDPR.
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Displaying the game and protecting it against abuse | IP address and basic technical browser data | point (b) (contract) and point (f) (security) | for the duration of the connection; request rate limits work in server memory and are not stored |
| Account and sign-in | email address, or the Google account identifier and email, nickname, language, country, county, date of creation, sign-in session | point (b) | until the account is deleted; session up to 30 days, sign-in link shorter |
| Rankings, drive recordings, collection and village mayor of the week | sections of routes driven with times, use of the horn and lights, scores, sights collected, passes through villages | point (b) | until the account is deleted |
| Fair competition | result of the drive check, marking of exclusion from rankings | point (f) (protection against cheating) | until the account is deleted |
| Painting walls | pixels placed, linked to the account, paint balance, packs bought, painting bans and breaches | point (b), and point (f) for moderation | pixels until the account is deleted, then without a link to the account; bans and breaches until the account is deleted |
| Billboards, content moderation, reports and appeals | uploaded images, landing page address, result of the automated assessment, moderator decisions, content of reports with the name and email of the person reporting | point (b), point (c) (obligations under the Digital Services Act) and point (f) | for the duration of the billboard right and 12 months after it expires; reports 12 months |
| Purchases and accounting | orders, amounts, statuses, Stripe payment identifiers and, with automatic renewal, the Stripe customer and saved payment method identifiers (without the card number) | point (b) and point (c) (tax and accounting law) | 5 years from the end of the tax year |
| Billboard resale | Stripe Connect account identifier, offers, settlements, notification emails and, in future, the data required for tax reporting | point (b) and point (c) | settlements 5 years from the end of the tax year; reporting data for the period required by law |
| Campaigns, coupons and the notice board | coupons collected and when, exchanges between players; codes are stored in encrypted form | point (b) | for the duration of the campaign and 12 months after it ends |
| Measuring how the game works | a random browser tab identifier, the type of event (game start, share, visit from a link, error) and the time; without the account, page address or error content | point (f) (development and stability of the game) | 90 days |
| Counting visits from billboard links | a random visit identifier and the billboard the link led to | point (f) | 90 days |
| Contact, complaints, withdrawals and requests to exercise rights | the content of the correspondence and the data you give in it | point (b), point (c) and point (f) | until the matter is closed, then until the limitation periods for claims expire |
| Backups | a copy of the database and game files | point (f) (recovery after a failure) | up to 12 months: 7 daily, 4 weekly and 12 monthly copies |
| Email notifications | email address, language, type of notification, order or billboard data needed for its content (place, term, amount, dates), delivery status and the message identifier at the email provider | point (b) and point (c) (confirmation of the contract on a durable medium) | until the limitation periods for claims under the contract expire |
Providing data is voluntary, but without an email address or Google account you cannot create an account, and without payment details you cannot make a purchase.
3. Data visible to other players
Powiatówka is a shared world, so other players see some information about you. This applies only to signed-in players:
- nickname, country, county and scores in the rankings;
- the recording of your drive with a fictitious number plate, honking and flashing lights;
- your nickname under the village sign if you become village mayor of the week;
- your nickname in the wall editor while you are painting on it;
- the pictures on walls that you help create;
- if you buy a billboard: your nickname, your image, the landing page address, dates and prices in the public history of the billboard.
We do not show other players your email address or Google account identifier.
4. Who we share data with
We use services from other companies. Some of them process data on our behalf, and some are separate controllers with their own privacy policies.
| Company | What we use it for | Role | Where it processes data |
|---|---|---|---|
| Hetzner Online GmbH | servers that run the game and the database, and storage of encrypted backups | processes data on our behalf | Germany |
| Stripe Payments Europe, Limited | payments, saved cards, seller accounts for resale | separate controller for payments and seller verification | Ireland, also the USA |
| Google Ireland Limited | signing in with a Google account | separate controller | Ireland, also the USA |
| Cloudflare, Inc. | Turnstile, which protects forms against bots | processes data on our behalf | the USA and other countries |
| Anthropic | automated assessment of images, campaign content and parts of walls; we send the image and text, without account data | processes data on our behalf | the USA |
| Resend or Brevo, depending on configuration | sending sign-in links, purchase confirmations and reminders about billboard terms | processes data on our behalf | Resend: the USA; Brevo: France |
Public authorities may also receive data where the law requires it, for example the National Revenue Administration for the reporting of resale sellers, or courts and the police on the basis of their decisions.
5. Transfers of data outside the European Economic Area
Some of our providers process data in the United States. We transfer it only where the recipient participates in the EU-US Data Privacy Framework, which the European Commission has recognised as ensuring an adequate level of protection, or where we have concluded the standard contractual clauses adopted by the Commission with them. You can obtain a copy of the safeguards by writing to support@powiatowka.com.
6. Automated decisions
Two things in the game are first assessed automatically:
- Content moderation. Billboard images, campaign content and parts of walls are assessed by a system based on an artificial intelligence model. In doubtful cases a person takes the decision. You can appeal against any decision, and appeals are always handled by a moderator.
- Drive checks. The server checks whether a submitted drive is possible, for example whether the speed and times add up. The result only decides whether the kilometres count towards the rankings.
None of these decisions produces legal effects concerning you within the meaning of Article 22 GDPR. If you think the automated system got it wrong, write to us and a person will look into it.
7. Your rights
You have the right to:
- obtain information about what data we process about you, and a copy of it (Article 15 GDPR);
- have inaccurate data corrected (Article 16);
- request erasure of your data, including your whole account (Article 17);
- request restriction of processing (Article 18);
- receive the data you have provided in a machine-readable format (Article 20);
- object to processing based on our legitimate interest, for example measuring how the game works (Article 21);
- lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl.
To exercise these rights, write to support@powiatowka.com from the address linked to your account. We will reply within one month. Deleting an account and its consequences are described in § 5 of the Terms of Service. We cannot delete some data immediately where the law requires us to keep it, for example sales documents.
8. Cookies and browser storage
The game stores some information in your browser. Most of it is strictly necessary for features you use, so under Article 399 of the Polish Electronic Communications Law it does not require consent. We do not use advertising cookies or third-party analytics tools.
| Name | Type | What it is for | How long |
|---|---|---|---|
| __Host-powiatowka | cookie | keeping you signed in | up to 30 days or until you sign out |
| __Host-powiatowka-oauth | cookie | securely completing a Google sign-in | 10 minutes |
| powiatowka.language | browser storage | the language you chose | until you delete your browser data |
| powiatowka.onboarded | browser storage | a note that the instructions have already been shown | until you delete your browser data |
| powiatowka.brakeSide | browser storage | the side of the screen with the STOP button | until you delete your browser data |
| powiatowka.metrics | tab storage | a random identifier for measuring how the game works | until the tab is closed |
| powiatowka.visit.(billboard) | tab storage | counting a visit from a link only once | until the tab is closed |
| powiatowka-offline-(version) | application cache | the page shown without an internet connection | until the next version of the game |
| Cloudflare Turnstile | provider cookies and storage | protecting sign-in against bots | according to Cloudflare's rules |
Measuring how the game works collects no data if your browser sends a “Do Not Track” signal. You can delete stored data at any time in your browser settings. After deleting the sign-in cookie you will need to sign in again.
9. Security, children and changes to this policy
Security. The game runs only over an encrypted HTTPS connection. We do not store passwords, because you sign in with a Google account or a one-time link. We store campaign codes in encrypted form and show them only to the person who collected them. Only people who need it to run the game have access to the data, and backups are encrypted.
Children. An account may be created by a person who is at least 16 years old. If we learn that an account was created by a younger person, we will delete it.
Language versions. This policy is available in Polish and in English. Both versions are equally binding.
Changes. If we change how we process data, we will update this policy and let you know in the game, and by email for significant changes. This policy applies from the day it is published in the game.