Summary
| Controller | Velode |
|---|---|
| Legal and privacy contact | [email protected] |
| Scope | Free game with no account, payments, newsletter, behavioral advertising, or analytics. |
| Age | Ludor is not directed at children under 14. |
Data processed
| Category | Data | Purpose |
|---|---|---|
| Match | Player name, room code, match identifier, cards, turns, roles, and game events. | Create rooms, match players, show match state, and apply the rules. |
| Chat | Message text, displayed player name, date, time, and message identifier. | Show room chat to the players in that match. |
| Reconnection | Match identifier, player name, and temporary reconnect token. | Allow a match to be recovered after a reload or short disconnect. |
| Technical | IP address or WebSocket session identifier, rate-limit counters, timestamps, and technical errors. | Maintain security, availability, performance, and anti-abuse protection. |
| Browser | Language, reconnect data in sessionStorage, and tutorial notice state in localStorage. | Remember preferences and technical features requested by the player. |
Purposes and legal basis
We process the data needed to provide the game, manage matches, keep room chat, allow reconnection, and apply technical security and anti-abuse measures.
The legal basis is performance of the requested service when you play and the legitimate interest of Velode in keeping a secure, stable, abuse-resistant service. We do not use this data for behavioral advertising, data sales, commercial profiling, or automated decisions with legal effects.
Retention
Match state is kept in Redis while the room or match exists and is deleted when the match is removed or the service clears runtime state. Chat is limited to the configured latest room messages and is deleted with the match.
Reconnect tokens are temporary; the browser stores the token in sessionStorage and the server keeps only its hash during the session or reconnect grace period. Rate-limit counters are local and expire through short configured windows.
Recipients and providers
Players in a match can see player names, game state, and chat messages for that room. The stats page may show names and active-match summaries while runtime state exists.
The public website is served with Cloudflare as a technical provider for security, availability, and performance. Cloudflare may process technical connection data and make international transfers with the safeguards applicable to its services. Velode does not sell personal data.
Rights
You can request access, rectification, erasure, objection, restriction, and portability where applicable by writing to [email protected].
You can also lodge a complaint with the Spanish Data Protection Agency if you believe the processing does not comply with applicable rules.
Children
Ludor is not directed at children under 14. If you are under 14, do not use Ludor or enter personal data in the game.
Security
Ludor applies input validation, rate limits, security headers, restricted WebSocket origins, and random reconnect tokens whose value is stored hashed on the server. Even so, no online service can guarantee absolute security.
Cookies and terms
Browser storage is explained in more detail in the Cookie policy and general service use in the Terms of use.
Updates
Velode will update this policy if Ludor adds accounts, analytics, advertising, payments, new providers, or relevant changes to data processing.