Privacy Policy
Effective 5 October 2026
This policy explains what personal data TowerPanic collects, why, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR). In short: if you have an account, we keep only your e-mail address and your play time. Players who join by link give only a player name, and we do not save it.
1. Who is responsible for your data
The controller is Maciej Smoleński, trading as Usługi Informatyczne Maciej Smoleński, ul. Stawki 4d m. 9, 00-193 Warszawa, Poland, NIP 1132666162. For anything about your data, write to jezdnia@gmail.com. We have not appointed a data protection officer, as the law does not require one for a service like this.
2. What we collect and why
| Data | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Account: your e-mail address (from Google sign-in), when the account was created, the date your play time ends, and an internal game id. | To identify your account, give you the free trial, and know whether you may start a game. | Performing our agreement with you, Art. 6(1)(b). |
| Purchases: your Stripe customer id, and for each payment the Stripe checkout id, the number of days bought and the date. | To add the days you paid for, handle refunds and complaints, and keep the accounting records the law requires. | The agreement, Art. 6(1)(b), and our legal duties under tax and accounting law, Art. 6(1)(c). |
| In a game: the player name each player types, and the game's moves. | To run the game and show it to everyone in it. | The agreement, Art. 6(1)(b). For invited players: our legitimate interest in running the game they chose to join, Art. 6(1)(f). |
| Server logs: IP address, time, the page or address requested, and browser type. Our application logs may also contain your e-mail address when a sign-in, payment or game start fails or a payment is credited. | To keep the service secure, stop abuse, and find and fix faults. | Our legitimate interest in a secure, working service, Art. 6(1)(f). |
| Messages you send us by e-mail. | To answer you, and to handle complaints and withdrawals. | The agreement, Art. 6(1)(b), or our legitimate interest in answering, Art. 6(1)(f). |
We do not use your data for advertising, sell it, build profiles, or make automated decisions about you. We do not send marketing e-mails. We write to you only about your account, for example about a change to our terms.
You do not have to give us your e-mail address, but without it we cannot create an account. Invited players can type any name they like, not their real one.
3. Google sign-in
We use Google sign-in with only the openid and
email scopes. From Google we receive only your e-mail address and
whether Google has verified it. We do not get your name, photo, contacts, or
access to your Gmail, Drive or anything else in your Google account. We use
the e-mail address only as your account's identity, as described here, and we
do not share it with anyone except Stripe when you buy a pass (section 4).
Google processes the sign-in under its own privacy policy:
policies.google.com/privacy.
4. Who receives data
- Stripe (Stripe Payments Europe Ltd., Ireland) processes payments. When you buy a pass, we give Stripe your e-mail address; you give your payment details directly to Stripe on its checkout page, and we never see them. Stripe acts as an independent controller for payment processing and fraud prevention: stripe.com/privacy.
- Google (Google Ireland Ltd.) handles sign-in (section 3). Our pages also load a font from Google Fonts, so your browser sends your IP address to Google when it loads a page.
- Contabo GmbH, Germany hosts our servers and stores the data on our behalf, as our processor.
- Authorities, only where the law requires it.
Stripe and Google may transfer data to the United States. Both are certified under the EU-U.S. Data Privacy Framework, and also use the European Commission's standard contractual clauses.
5. How long we keep it
- Account data: until you ask us to delete your account.
- Payment records: 5 years from the end of the year of the payment, as Polish tax law requires. They are kept even if you delete your account.
- Player names and game moves: only in the game server's memory, while the game runs (at most 24 hours). They are never written to disk.
- Server logs: up to 120 days.
- E-mails: as long as needed to deal with the matter, and for complaints and withdrawals until the related claims expire.
6. Cookies and browser storage
We do not use cookies for analytics or advertising, so we do not show a cookie banner. What we do store in your browser is needed for the service you ask for:
| Name | Where | What it is for | How long |
|---|---|---|---|
session (cookie) |
towerpanic.com | Keeps you signed in: holds your e-mail address, signed so it cannot be changed. While you sign in, it also holds the one-time codes that protect the sign-in. | 30 days, or until you sign out |
joinName (local storage) |
play.towerpanic.com | Fills in the name you used last time when you join a game. It stays on your device and is not sent to us until you join. | Until you clear your browser data |
Stripe's checkout page and Google's sign-in page are on their own websites and set their own cookies there, under their own policies.
7. Your rights
You have the right to:
- get a copy of your data (access) and receive it in a portable format;
- have it corrected;
- have it deleted, unless we must keep it by law (such as payment records);
- restrict how we use it;
- object to processing based on our legitimate interest;
- lodge a complaint with a supervisory authority. In Poland that is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). You can also complain to the authority in the EU country where you live or work.
To use any of these rights, e-mail jezdnia@gmail.com from your account address. We reply within one month.
8. Security
All traffic to TowerPanic is encrypted (HTTPS). Payment details are handled only by Stripe. Game links contain a token that cannot be guessed, but anyone who has a link can join that game until it ends, so share it only with people you want to play with.
9. Children
Accounts are for adults (18 and over). Children can play in a game an adult invites them to. Then we process only the player name typed in, which does not need to be a real name, and only for as long as the game runs.
10. Changes
If we change this policy, we will update the date at the top. If a change matters for how we use your data, we will tell account holders by e-mail beforehand.