Privacy Policy

Last updated: September 2026 · According to GDPR, BDSG and TDDDG

This English version is provided for convenience. In case of discrepancies the German version prevails.

This policy explains which personal data we process when you use Playnexi, why we need it, how long we keep it and what rights you have. In short: we only process what is needed to run the platform, we do not sell data, we do not use advertising trackers and we host in Germany.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

ananas.codes e. K.
Tim Jaszdziewski
Lindenstraße 8
23558 Lübeck
Germany
Phone: +49 451 160 894 30
E-mail: datenschutz@playnexi.com

A data protection officer is not legally required and has not been appointed.

2. Hosting and server log files

Playnexi is hosted on servers of Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany. The server location is Germany. Contabo is our processor under Art. 28 GDPR.

Each time the platform is accessed, the following data is automatically stored in server log files:

• IP address of the requesting device
• Date and time of the request
• Requested URL and amount of data transferred
• Browser type and operating system (user agent)
• HTTP status code

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure and stable operation and in defending against attacks). Log files are deleted automatically after 30 days at the latest.

3. Registration and user account

A user account is required to use Playnexi. When you register, we collect:

• E-mail address
• Username (your public name on the platform)
• Display name (optional, see below)
• Password (stored as a hash, never in plain text)
• Time of registration and of the confirmation of your e-mail address

This data is processed to provide and manage your account and to communicate with you (e.g. invitations, notifications). The legal basis is Art. 6 (1) (b) GDPR (contract of use) and Art. 6 (1) (f) GDPR for security measures such as login protection and abuse detection.

While you use the platform we also store the content you enter: game collections, wishlists, game nights, matches and results, tournaments, statistics, ratings, house rules, notes, photos, groups, friendships, support tickets and your settings. This data is processed exclusively to provide the Playnexi service (Art. 6 (1) (b) GDPR).

Username and display name

Your username is your public name on Playnexi. Other users can find it (e.g. for friend requests) and it is shown wherever people without a connection to you can see you, in particular on public share links (section 5). Your display name (e.g. your first name) is optional and is only shown to you, your friends and the members of your groups. Exception: if you yourself publicly share a game night invitation link or a collection, your display name appears there as host or owner because you deliberately release that page. You can change or clear the display name in your profile at any time.

Minimum age

Only persons aged 16 or over may create an account (Art. 8 GDPR). We do not ask for a date of birth at registration and do not knowingly process personal data of younger children. Younger players can be entered as guest players without their own account and without an e-mail address; a voluntarily entered date of birth in the profile is only used for birthday hints within your own group. If we learn that an account was created by a person under 16, we delete it.

Deleting your account and data export

You can delete your account yourself in your profile at any time. After the deletion request there is a 14-day cooling-off period during which you can cancel the request. After that your account and all associated data (game nights, matches, tournaments, own games, collections, photos, profile data, settings, tickets) are deleted automatically. In other users' groups an anonymised player entry without name and e-mail address remains so that their statistics stay complete. Statutory retention obligations (e.g. for invoice data at Stripe, section 7) remain unaffected. Backups that still contain your account are overwritten within 14 days after deletion at the latest.

Before deleting you can export your data as a file in your profile at any time (Art. 20 GDPR).

4. Data of other people that you enter

Guest players

You can add fellow players without their own account as guest players in your group (name, optionally birthday and notes) and record results for them. We process this data on your behalf to provide the service to you and your group (Art. 6 (1) (b) and (f) GDPR). Please only enter people who agree to it and, in case of doubt, use first names or nicknames. Guest players do not receive any e-mails from us. They can contact us at any time (section 13) to learn which data is stored about them and request correction or deletion; as a rule we then ask you as group administrator to make the change. Guest player entries remain stored until you remove them or the group or your account is deleted.

Photos of game nights

You can upload photos of game nights and matches that may show people. The photos are only visible to the members of the respective group and are not published via share links. Please only upload photos whose storage all persons shown agree to. Any person shown can request the deletion of a photo, directly from the uploader or from us (section 13). Photos are deleted together with the game night or match, or at the latest with the uploader's account.

Invitations to third parties

If you invite people by e-mail to a game night, a group, a collection or as a friend, we process the e-mail address you entered to deliver the invitation and match replies (accept, decline). The invitation e-mail names your display name or username as sender. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in organising your game night); the invitation e-mail also contains the information under Art. 14 GDPR with a link to this policy. Recipients without an account can unsubscribe from further e-mails via a link in every invitation e-mail; the address is then stored in a block list and no longer contacted. Invitations that are not accepted are deleted no later than 90 days after they expire.

Reports about content

Via the “Report content” form anyone, even without an account, can point out illegal or problematic content. We store the reported link, the reason, the description, your IP address and, if given, your e-mail address for feedback. The legal basis is Art. 6 (1) (c) GDPR (obligations under Art. 16 and 17 of the Digital Services Act) and (f) (protection against abuse). If we decide to hide content, we inform the responsible person with reasons without revealing who reported it. Reports are deleted twelve months after closure.

5. Public share links

Some content can be deliberately released via a link: match results (“share result”), collections and wishlists, tournament pages, the spectator view of a game night and invitation links to game nights and tournaments. For these links:

• The page is accessible to anyone who knows the link, without logging in. The link contains a long random code and cannot be guessed, but it can be forwarded.
• Only the content of the respective page is visible: for results the game, date, rankings and points; for collections the games; for tournaments participants, pairings and standings; for the spectator view the live results of the evening.
• Fellow players with a Playnexi account appear with their username, not their display name. Guest players appear with the name the group entered for them.
• All share pages are blocked for search engines (“noindex”).
• Whoever created the link can deactivate it at any time; the page is then immediately unavailable.

The legal basis is Art. 6 (1) (b) GDPR towards the sharing user and Art. 6 (1) (f) GDPR towards the other players named (the group's interest in sharing joint results, with minimised details). If you do not wish to appear in your group's shared results, talk to the creator or contact us (section 13); we will then consider deactivating the link.

6. E-mails from Playnexi

We send you e-mails that belong to the service: confirmation of your registration, password reset, invitations and replies, reminders for game nights and votes, ticket replies, subscription and payment information and security notices (Art. 6 (1) (b) GDPR).

In addition there are optional notifications that you can switch on and off individually in the e-mail settings, such as your group's monthly recap, achievement notifications, friend requests and news about Playnexi (new features, important changes). These e-mails only concern Playnexi itself; we do not send third-party advertising. The legal basis is Art. 6 (1) (f) GDPR (informing our users about the service) or your consent if you explicitly subscribed to news at registration (Art. 6 (1) (a) GDPR). Each of these e-mails contains a link to the settings; you can object or withdraw your consent at any time.

We use the e-mail service of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (processor, Art. 28 GDPR) for sending. We do not evaluate whether you opened an e-mail; our e-mails contain no tracking pixels. If an e-mail bounces, we store the address, type and reason of the bounce for twelve months and stop sending to permanently undeliverable addresses (Art. 6 (1) (f) GDPR).

7. Payment processing (Stripe)

For paid subscriptions we use the payment provider Stripe. Our contracting partner is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; it may transfer data to Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA.

Stripe processes your payment data (credit card, SEPA direct debit, PayPal, Apple Pay or Google Pay, depending on the offer) directly and on its own responsibility. You enter it exclusively on Stripe's pages. We transmit your e-mail address, the selected plan and the amount to Stripe. We ourselves only store the Stripe customer ID, the subscription ID, the plan, the status, the end of the term and the trial data. We do not hold complete payment data. Stripe provides invoices and receipts in the customer portal and retains them in accordance with commercial and tax law.

The legal basis is Art. 6 (1) (b) GDPR (subscription contract). Stripe is an independent controller for the payment processing and, as far as it manages our customer data, additionally bound by contract as a processor. Transfers to the USA are based on the adequacy decision for the EU-US Data Privacy Framework (Stripe, Inc. is certified) and additionally on standard contractual clauses (Art. 46 (2) (c) GDPR). Stripe's privacy policy: stripe.com/privacy.

Proof of order and cancellation

When you take out a subscription, we log your confirmation (acknowledgement of the Terms and the withdrawal notice, request to start the service during the withdrawal period): time, IP address, browser identifier, the confirmed text, the versions of the legal texts and the Stripe transaction number (Art. 6 (1) (c) and (f) GDPR, obligation to demonstrate consent under Art. 7 (1) GDPR and §§ 312 et seq. BGB). If you cancel via the cancellation page, we store your cancellation (e-mail address, type of cancellation, time of receipt, IP address and, if given, username, reason and requested date) as proof under § 312k BGB and confirm it by e-mail. We keep these records until three years after the end of the respective contract (standard limitation period, § 195 BGB).

8. Spam protection (Cloudflare Turnstile)

To protect the registration and login forms against automated abuse we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (represented in the EU by Cloudflare Germany GmbH, Rosental 7, 80331 Munich).

To distinguish bots from humans, Turnstile analyses:

• IP address
• Browser information (user agent, language setting)
• Interaction patterns with the form

Turnstile does not set tracking cookies. Accessing information in your browser is strictly necessary to provide the form you explicitly requested (registration, login) free of abuse (§ 25 (2) no. 2 TDDDG). The legal basis for the processing is Art. 6 (1) (f) GDPR (protecting the platform against abuse). Cloudflare is our processor; transfers to the USA are based on the EU-US Data Privacy Framework (Cloudflare is certified) and standard contractual clauses. Privacy policy: cloudflare.com/privacypolicy.

9. Audience measurement (Matomo, self-hosted)

To analyse the use of our public pages we use the open-source software Matomo. Matomo runs exclusively on our own server in Germany; no data is transferred to third parties.

Audience measurement is deliberately configured to be data-minimising:

• No cookies: Matomo sets no cookies and stores nothing on your device.
• IP anonymisation: your IP address is truncated before storage (the last two octets are removed) and can no longer be traced back to you.
• Approximate location: from the already truncated IP address we determine the country of origin using a locally stored geo database. No request is made to external services.
• Do Not Track: if your browser sends a “Do Not Track” signal, your visit is not recorded.
• The logged-in member area is not recorded.
• Retention: raw data of individual visits is deleted after 180 days; only aggregated reports remain.

The legal basis is Art. 6 (1) (f) GDPR (statistical evaluation to improve content and findability). Since no information is stored on or read from your device beyond the technically necessary transmission, no consent under § 25 TDDDG is required. You can nevertheless object to the recording at any time:

10. Cookies and local storage

Playnexi uses only technically necessary cookies and storage functions. They are strictly necessary for the service you explicitly requested (§ 25 (2) no. 2 TDDDG); a cookie banner is therefore not required. The legal basis for the associated processing is Art. 6 (1) (b) and (f) GDPR.

When you go through the payment process with Stripe, Stripe sets cookies on its own domain (checkout.stripe.com) that are necessary for payment processing and fraud prevention. We have no influence on these; Stripe's privacy policy applies (section 7). We do not use advertising or tracking cookies and no services such as Google Analytics or Facebook Pixel.

11. Retention periods at a glance

12. Your right to object (Art. 21 GDPR)

13. Your further rights as a data subject

• Access (Art. 15 GDPR): you can request information about the data we process; you can export it directly in your profile.
• Rectification (Art. 16 GDPR): you can have inaccurate data corrected; most details you change yourself in your profile.
• Erasure (Art. 17 GDPR): you can request deletion of your data unless retention obligations apply; you delete your account yourself in your profile.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR): export as a file in your profile.
• Withdrawal of consent (Art. 7 (3) GDPR): at any time with effect for the future, e.g. for news e-mails in the e-mail settings.

To exercise your rights, also as a guest player or invitee without an account, contact: datenschutz@playnexi.com. We usually reply within one month.

14. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR), in particular in the Member State of your habitual residence. The authority responsible for our registered office (Schleswig-Holstein) is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98
24103 Kiel, Germany
www.datenschutzzentrum.de

15. Data security

Data is transferred between your browser and our servers exclusively encrypted via HTTPS (TLS). Passwords are stored only as hashes and cannot be viewed by us. We create daily backups of the database, which are stored on the server in Germany and deleted automatically after 14 days, and protect our systems through appropriate technical and organisational measures under Art. 32 GDPR (including access restriction, login throttling and regular security updates).

16. Use of artificial intelligence

The descriptions, FAQs, assessments and meta texts in our public game database were generated with the help of an AI language model (provider: OpenAI, L.L.C., USA) from structured game data and editorially reviewed by us. They are marked as AI-generated on the respective pages. Only factual data about games is processed, no personal data of our users.

Your content (collections, results, messages, tickets) is not transmitted to AI providers. Should we offer AI-supported features in the future, such as automatic reply suggestions in support, we will inform you here and in the respective dialogue beforehand, and you will always be able to tell whether you are interacting with an AI system.

17. Board game news from external sources

Under “News” we show headlines, short teasers and preview images from public RSS feeds of publishers, magazines and communities. Only our server fetches this content at regular intervals; we also cache the preview images on our server and serve them from there. When you open the news page, no connection to the sources' servers is established and none of your data is transmitted to them. Only when you click on an article do you leave Playnexi, and the privacy policy of the respective source applies.

18. Changes to this policy

We update this policy when our processing or the legal situation changes. The current version can always be found at this address; we announce material changes to logged-in users by e-mail or a notice in the app.

Last updated: September 2026 · German version prevails