Privacy policy

1. Who is responsible

Mad About Pandas GmbH, Oranienstraße 37, 10999 Berlin, Germany. Contact for privacy questions: contact@notabug.games.

2. What we collect

• Account: your e-mail address, the player name you choose, your password and the dates you signed up and confirmed the address; your birth year and the date you confirmed being 18 or older (see section 9). The password is stored only as a one-way hash, so nobody, not even we, can read it. Whoever can read your mailbox can set a new password through a reset link, so keep that mailbox safe. We do not ask for your real name.
• Your YouTube channel: the channel of your first entry is kept with your account, and later entries must come from the same channel. We take it from the video you submit. We check who owns the channel only before we send a prize (official contest rules, section 8).
• Suggestions: if you suggest a challenge, we store the game, the title and the description you write, with your account, so we can answer you. Only you and our administrators see it.
• Reports: if you report content, we store the link, your reason and explanation, and, if you give them, your name and e-mail address, so we can check the report, tell you our decision and show later how we decided. Legal basis: our legal obligation under the EU Digital Services Act (Art. 6(1)(c) GDPR).
• Messages: if you write to us or use the contact form, we use your name, e-mail address and message to answer you.
• Username: the player name you choose is public: it is shown on your entries, on your player page and in results.
• Entries: the YouTube link you submit, the video title, channel name and channel link that YouTube returns, and your optional note.
• Ratings: which entry was rated from your device and the three scores given.
• Winners: if you win, we use your account e-mail address to contact you, your reply confirming that you are 18 or older, and the code of the prize we send you, and the proof that the YouTube channel of your entry is yours. We need this to give you the prize (Art. 6(1)(b) GDPR).
• Security data: a shortened, salted hash of your network (IP) address when you sign up and when you rate; for IPv6 addresses we use only the network part (the first half), which a household shares. We cannot read your IP address back from it, but it is still personal data. We use it to spot several accounts of one person, to limit how many ratings for one video count from the same network, and to spot abuse. When you sign up we also check whether this browser was used by another account before (from the device cookie) and whether the e-mail address belongs to a throwaway mail service. If one of these applies, your account is marked for a check: you can take part as usual, and your ratings count once our team has checked them. A person on our team makes that decision. If our team excludes your ratings, you can ask us to check again (contact@notabug.games).
• Device cookie: one cookie named "device" holding a random code, so this browser stays signed in to your account for up to 30 days. It is required for taking part and needs no consent; it is not used to follow you around the web. When you sign up, we also read it to see whether this browser was already used by another account, to keep the competition fair (see "Security data"). If you delete it, you are signed out on this browser.
• Consent cookie: one cookie named "consent" holds your cookie choice ("accepted" or "rejected") for 6 months, so we do not ask on every visit. It holds nothing else and needs no consent itself.
• Campaign cookie, only if you accept it in the cookie banner: if you arrive through a link carrying a campaign label (for example ?src=instagram), one cookie named "src" keeps that short label for up to 90 days, and we store it with the entries and ratings you make. It tells us which channel brought players, and nothing more: it holds no name, no profile and no advertising identifier, it is set by us alone, and it is not shared with anyone else. If you delete it, nothing about taking part changes.
• Staff: administrators have accounts with email and password (stored only as a one-way hash), and a "session" cookie for up to 30 days.

We use no third-party analytics or advertising cookies, no advertising networks and no tracking pixels. The only measuring we do is our own campaign label described above, and only with your consent (§ 25 TDDDG, Art. 6(1)(a) GDPR). You can give or withdraw it at any time under "Cookie settings" at the bottom of every page; withdrawing removes the label cookie. If anything changes, we will ask for your consent first where the law requires it, and update this policy.

3. What is public

Your username, your entries (video, title, channel, note), each entry's number of ratings and average score, and results are visible to everyone. Individual ratings are not public.

4. Why we use your data

• to create and run your account, run the competitions you take part in, send you the e-mails they need (confirmation, new password, results, prizes) and check that you are 18 or older: this is needed for our contract with you (Art. 6(1)(b) GDPR);
• to keep ratings fair and the service secure, including limits per device and network and detecting several accounts of one person: our legitimate interest in fair competitions and a safe service (Art. 6(1)(f) GDPR);
• to know the age groups of our players: we keep only your birth year and the date you confirmed being 18 or older, never the day and month of your birth, and show them to our staff only as counts, never publicly: our legitimate interest in planning challenges for our audience (Art. 6(1)(f) GDPR);
• to answer your messages: our legitimate interest in answering you, or our contract with you if your message is about your account (Art. 6(1)(f) or (b) GDPR);
• to measure which link brought you here, only with your consent (Art. 6(1)(a) GDPR, § 25 TDDDG; section 2);
• to meet legal obligations, for example handling reports of illegal content under the EU Digital Services Act and keeping accounting records (Art. 6(1)(c) GDPR).

To take part you need to give your e-mail address, a player name, a password and your date of birth, and confirm that you are 18 or older; without them you cannot create an account. Everything else is optional.

5. YouTube

The pictures of the videos are copies on our own server, so looking at a page does not connect your browser to YouTube. A video is loaded only when you press "Play video": then your browser loads YouTube's embedded player in privacy-enhanced mode (youtube-nocookie.com) and connects to Google/YouTube, which receives your IP address and can set its own cookies. Google's privacy policy applies to that: https://policies.google.com/privacy. Google decides itself what it does with this data and is responsible for it. Google may process the data in the USA; how it protects such transfers is described in Google's privacy policy. We do not send your data to the USA ourselves.

When you submit a link, our server asks YouTube whether the video exists and copies its picture. These requests do not contain your personal data.

We check from our server, once a day, whether submitted videos are still available on YouTube; this request contains only the video's address.

6. Who else receives data

We do not sell personal data. Service providers that host notabug.games process data on our behalf under a data processing agreement: Hetzner Online GmbH, Germany, hosts the website and its database on a server in Nuremberg; ALL-INKL.COM, Germany, sends our e-mails. Both are in Germany; our data stays in the EU. When you press "Play video", your browser connects to YouTube/Google directly (section 5). We give data to authorities only where the law requires it.

7. How long we keep data

• Device cookie: up to 30 days in your browser; you can delete it at any time.
• Consent cookie: 6 months in your browser; you can delete it at any time (the banner then asks again).
• Campaign cookie: up to 90 days in your browser; you can delete it at any time. The label stored with your entries and ratings goes when they go.
• Account: until you ask us to delete it. Deleting removes your e-mail address, your password, your confirmation and reset links and your suggestions, so nobody can sign in as you any more. Your entries, ratings and places in past results stay, under your player name, because removing them would change results other people took part in. If you want those removed as well, ask us and say so.
• Links we mail you: a confirmation link works for 24 hours, a link to set a new password for 60 minutes, and each one works once. Used and expired links are kept no longer than needed to stop them being used again.
• Username, entries and ratings: until you ask us to remove them, or until we close notabug.games. When removed, your entries, ratings and places in results are deleted with them. An entry nobody has rated yet you can delete yourself on its page while the challenge runs; once others have rated it, we delete it for you on request (contact@notabug.games).
• Reports: one year after our decision.
• Winners: until the prize is delivered; records of the prizes we gave are kept as long as tax and commercial law require.
• Messages: until the matter is closed, at the latest one year after our last answer, unless the law requires us to keep them longer.
• Thumbnail copies: refreshed or deleted at least every 30 days, and deleted when the entry is removed or not published, or the video is no longer available on YouTube.
• Security hashes: deleted 90 days after the results of the challenge they belong to are published, or earlier together with the username or rating they belong to. Whether an account was marked for a check, and what our team decided, is kept with the account and deleted with it.
• Staff login sessions: until logout, at most 30 days.

8. Your rights

You can ask for access to your data, correction, deletion, restriction, a copy in a common format, and you can object to processing based on our legitimate interest. Write to contact@notabug.games. You can also complain to a data protection authority, for example ours: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, mailbox@datenschutz-berlin.de. We do not make decisions about you based solely on automated processing (Art. 22 GDPR): where our tools mark accounts or ratings, a person on our team decides.

9. Age

notabug.games is for people aged 18 and older. When you create an account we ask for your date of birth to check that you are at least 18. We keep only your birth year and the date you confirmed being 18 or older, for as long as your account exists; the day and month are not stored. We use the birth year only to know the age groups of our players, shown to our staff as counts, never publicly (our legitimate interest, section 4). You can object to this (section 8). We do not verify the date you give. If we learn that a player is under 18, we delete the account.

10. Security

Connections in production run over HTTPS, cookies cannot be read by scripts, and staff passwords are stored only as hashes.

11. Changes

We update this policy when the service changes. The date at the top shows the current version.