Privacy Policy

Last updated: 7 October 2026

This policy explains how personal data is processed when you use Sfermish at sfermish.io.

1. Controller and contact

The data controller is the individual operator of Sfermish.io. Privacy requests can be sent to privacy@sfermish.io.

2. Data processed by Sfermish

• Nickname: the pseudonym you choose is sent to the game server, shown to other players during a match and may appear in the public Highscore.
• Gameplay data: room participation, score and gameplay events needed to operate the multiplayer game are processed during play.
• Custom skin: a skin you create is sent to the server so other players can see it. If the score associated with that skin enters the current Top 10, that record skin may be stored server-side while it remains relevant to the Top 10 archive.
• Highscore: the best score for a nickname can be stored persistently together with the time it was achieved.
• Technical data: IP address, request metadata, browser/user-agent information and security/connection logs may be processed by the hosting infrastructure and reverse proxy to deliver and protect the service.
• Browser storage: Sfermish uses local storage for functional preferences such as theme and nickname. Advertising-related local storage is only intended to persist where the relevant consent permits it. See the Cookie Policy.

3. Why data is used

Data is used to provide the multiplayer service requested by the user, display the game state and Highscore, maintain security and reliability, prevent abuse, diagnose failures, and operate advertising only where applicable. Where consent is legally required for advertising cookies or other non-essential device storage, Sfermish will rely on consent.

4. Advertising and Google

Sfermish is preparing to use Google AdSense and Google H5 Games Ads. Once advertising is enabled, Google and its advertising partners may process identifiers, IP addresses, cookies, local storage and related advertising data according to the user's consent choices and applicable law.

More information about Google's processing is available at How Google uses information from sites or apps that use its services.

5. Recipients and infrastructure

The service is hosted on infrastructure provided by netcup GmbH. Technical data may therefore be processed by the hosting provider as a processor for service delivery, network operation, security and troubleshooting. When Google advertising is enabled, relevant advertising data may also be processed by Google and participating advertising technology providers.

6. Retention

• Live gameplay state is primarily transient and is discarded as sessions end, except for information that is intentionally persisted as described below.
• A nickname's best Highscore may remain stored until it is replaced, removed, or no longer needed for the Highscore service.
• Top 10 skin records are limited to current Top 10 entries and are removed when they no longer belong in that archive.
• Technical logs are retained only for operational, diagnostic and security needs and are rotated/deleted according to server administration settings.
• Local browser preferences remain on the user's device until they are changed or browser/site storage is cleared.

7. Visibility to other players

Nicknames, scores and in-game skins are designed to be visible to other players. Do not use a nickname or skin that reveals information you do not want to make public.

8. Your rights

Where the GDPR applies, you may have rights including access, rectification, erasure, restriction, objection, data portability where applicable, and withdrawal of consent at any time without affecting earlier lawful processing. You may also lodge a complaint with the competent data protection authority.

For a request concerning an in-game record, include the nickname and enough context to identify the record. Because Sfermish does not require an account or identity document, additional information may be needed to avoid deleting another player's data by mistake.

9. Children

Sfermish does not require a real name, date of birth, email address or account to play. The service is not intended to solicit sensitive personal data from children. A parent or guardian can contact the privacy address above regarding a child's data.

10. Changes

This policy may be updated when the game, hosting or advertising setup changes. The date at the top of this page identifies the current version.