Privacy Policy

You sign in with your Google account. We keep three things from it: your Google account ID, your email address, and whether Google has verified that address. Google also sends your name and profile photo with every sign-in. We do not read them and do not store them.

Your email address is never shown to other players.

Signing in starts a session. We store only a fingerprint (a SHA-256 hash) of its token, never the token itself. A session lasts 30 days from when you last used shifr, and signing out ends it at once.

Your profile holds the display name you choose, your avatar, a bio of up to 160 characters if you write one, the date you joined, your statistics and your ratings with their history. Every signed-in player can open it, and can find you by searching for your name.

Your avatar is either a pattern generated from a random number or a photo you upload. An uploaded photo is cropped and re-encoded at 256 pixels, which strips its metadata, such as where and with what camera it was taken. It is stored on our server, and anyone who has its address can load it.

For each match we store who played, the secret each player chose, every guess and its marks, the clocks, the result and the change in each player's rating. We also keep a log of what happened in the match and when, so that a dispute can be settled and a fault found.

While a match is running your opponent sees every guess you make. Once it ends, both secrets are shown to both players. Your finished matches appear on your profile, without the secrets, and your record against each opponent is kept.

When you look for a game, your seek is listed in the lobby for other signed-in players until it is matched or you cancel it. An invitation or a rematch offer is kept until it is answered or expires.

We store your friend requests and your friendships. Your friends can see when you are online. That is known only while you are connected, is held in the server's memory, and is never written down.

The website keeps these in your browser, and nothing else:

shifr_session

Keeps you signed in. Scripts on the page cannot read it, and it expires 30 days after you last used shifr.

shifr_oauth_state, shifr_oauth_verifier, shifr_oauth_native

Exist only while you sign in with Google, to protect that step against forgery. They expire after ten minutes.

i18next

Remembers your language for a year.

theme, palette

Remembers your theme and your colours, if you choose them. Both are kept in local storage rather than in a cookie.

Each of these is strictly necessary for something you asked for, which is why the site does not ask for consent. There are no tracking or advertising cookies.

The Android app asks only for internet access. The sign-in library it uses adds the biometric permission, so that Android can confirm a saved sign-in with your fingerprint or face; the app never sees that data.

The app stores its session encrypted with a key held in the Android Keystore and leaves it out of Android's backup. Your theme and colour settings are backed up by Android, which, depending on your device, may keep them in your Google account; we have no access to that backup.

When you pick a photo, Android's photo picker hands the app only that photo, and the app crops it on the device before uploading it.

shifr runs on a server we rent from netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, which processes data on our behalf. The database and the uploaded photos are on that server.

Every time your browser or the app contacts the server, it records your IP address, the time, the address requested, the response's status and size, the referring page and your browser's identification. We use that to keep shifr running and secure, including limiting how many requests one address can send. These logs are deleted after 14 days. shifr itself does not record IP addresses.

When you choose to continue with Google, you sign in on Google's own page, and Google tells us your account ID and your email address. Google processes that sign-in under its own privacy policy.

Google LLC is based in the United States and is certified under the EU–US Data Privacy Framework, on which the transfer rests (Art. 45 GDPR). To check that a sign-in is genuine, our server also fetches Google's public signing keys; that request carries nothing about you.

If you install the Android app from Google Play, Google also processes data about the install and updates as part of running the store, under the same policy.

Nobody beyond what this page describes: other players see what the sections above say they see, netcup hosts the server, and Google handles sign-in. We do not sell your data or use it for advertising. The pages load no third-party scripts, fonts or trackers; everything comes from our own server. We disclose data to an authority only when the law obliges us to.

• Your account, profile, matches and friends are processed to provide the game you signed up for (Art. 6(1)(b) GDPR).
• The server logs, the match log and the limits on requests serve our legitimate interest in running shifr securely and fairly (Art. 6(1)(f) GDPR).
• The cookies and local storage above are strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG).

• Your account, profile, matches and friendships: until you delete your account.
• A session: 30 days after you last used shifr, or until you sign out.
• A seek, an invitation or a rematch offer: until it is matched, answered, cancelled or expires.
• Server logs: 14 days.

You can delete your account yourself, in Settings on the web or in the app. A match you are still playing is resigned.

If you can no longer sign in, write to us from the email address of your account and we will delete it within one month. Either way, that removes your email address, your link to Google, your sessions, your profile with its name, photo and bio, and your friendships.

The matches you played stay, because they are also your opponents' history, but your name in them is replaced by “Account deleted” and they no longer lead to you. Deleted data can remain in our database backups until those are replaced.

Signing out of the Android app removes its session from your device, and uninstalling the app removes everything it stored.

You must be at least 16 to create an account. If we learn that an account belongs to someone younger, we delete it. A parent or guardian can ask us to by email.

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or its processing restricted (Art. 18), and to receive it in a machine-readable format (Art. 20). You can change your display name, avatar and bio yourself in Settings, and delete your account there.

You can object at any time to processing that rests on our legitimate interests (Art. 21 GDPR).

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The one responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information.

Before shifr stores anything new, or offers another way to sign in, we will update this page and the date at the top.

For any question about this policy or your data, write to us at the address above or by email.