Privacy policy

As of September 2026

1. Controller

2. Principles

Roll & Barrel is a browser game in testing, built to collect as little as possible:

• There are no accounts, no cookies, no advertising and no third-party analytics or advertising services. We don't sell, rent or share data.
• Play data is only stored and sent with your consent (section 6). Without your "yes", none of it stays on your device and nothing reaches our server.
• Feedback is only sent when you send it yourself (section 7).
• There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

3. Visiting the game (Cloudflare)

The game's files are delivered by the content delivery network of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA). On each visit Cloudflare processes the technically necessary connection data — IP address, time, requested address, browser identification — to deliver the page, fend off attacks (DDoS protection) and speed up loading. We don't receive this data.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in delivering the game securely and quickly). Transfers to the US are based on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023; Cloudflare is certified under it). More at cloudflare.com/privacypolicy.

4. Fonts

All fonts are loaded together with the game from our own site. There is no connection to Google Fonts or any other font service.

5. Storage in your browser (localStorage)

The game sets no cookies. It keeps a few entries in your browser's local storage (localStorage). They stay on your device; you can delete them at any time by clearing this site's data in your browser.

Technically necessary (no consent needed, § 25 (2) no. 2 TDDDG)

Only with your consent (§ 25 (1) TDDDG)

If you withdraw your consent, both entries are deleted at once (feedback you already sent that is still waiting is delivered).

6. Play data (only with consent)

At your first click on "Tutorial" or "Play" we ask whether the game may send play data. Only if you agree, the following is collected:

• a random player id made in your browser. It isn't linked to your name, email address or IP address — the data is pseudonymous: it is linked only by this id;
• per visit: the time, the game version, the names of your browser, operating system and graphics card, and your screen size;
• about your play: the start and end of fights (arena, result, rounds), the standings after each round (share of hit points left, heroes down, enemies left, number of actions), how smoothly the game ran (frame rate, the share of stutters), and the tutorial steps you reached;
• if the game hits a script error: its message and where in the game's code it happened;
• the record of a finished fight: your moves and the random seed, so our server can re-compute the fight and check its result, and the game's summary of it;
• if you opened the performance panel (key F): frame rates and processing times.

Purpose: balancing the difficulty, improving the tutorial, and finding bugs and performance problems.

Legal basis: your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

Withdrawal: at any time under "Privacy" on the title screen. The game then sends nothing more, and the player id is deleted from your browser. Data already sent stays stored under the pseudonymous id; we delete it on request — tell us your player id, which the same window shows.

Retention: play events and visits 12 months, fight records 3 years; then they are deleted automatically.

7. Feedback

If you send feedback — a rating, a bug report or an idea via "Feedback", or your answers to the two quick questions after your first arena fight — we store: the kind, the rating (1–7, if given), your answer to "Would you play another arena?" (if given), your comment, the context (arena, game version, the last fight's result, tutorial progress, a reference to the last fight) and your player id — without consent to play data, a one-off id instead that isn't stored. If you tick "Attach this fight" when sending feedback during a fight, we also send the fight so far (your moves), so we can replay it — even without consent to play data, because you choose it yourself. Please don't put personal information in the comment.

Legal basis: your consent by sending it (Art. 6 (1) (a) GDPR). Retention: 3 years.

8. Server and transmission

Play data and feedback are stored on our server in a German data centre of Hetzner Online GmbH (Industriestraße 25, 91710 Gunzenhausen, Germany), under a data processing agreement (Art. 28 GDPR). The connection to our server runs through a Cloudflare tunnel: Cloudflare ends the encrypted connection at a location near you (for Germany usually Frankfurt am Main) and forwards it encrypted to our server, processing the technically necessary connection data including the IP address (see section 3).

Our server stores no IP addresses. Its logs contain only the kind, path, result and duration of a request and are continuously overwritten. Legal basis for running it: Art. 6 (1) (f) GDPR (legitimate interest in secure and stable operation).

Backups of the database are made daily, transferred encrypted to a Finnish data centre of Hetzner Online GmbH (Helsinki, EU; under the same data processing agreement), and deleted after at most 8 weeks. Deleted data may therefore remain in a backup for up to 8 weeks.

9. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), and the right to withdraw consent at any time with effect for the future (Art. 7 (3)). As we keep no accounts, we can only find your data by your player id; please include it in requests to privacy@roll-and-barrel.com.

You also have the right to lodge a complaint with a data protection supervisory authority. Responsible for us is the Unabhängiges Datenschutzzentrum Saarland (UDS), Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany.

10. Changes

We update this policy when the game or the law changes. The current version is always at roll-and-barrel.com/privacy.