Privacy
Who is responsible. Satido (satido.lt) is a personal project. Data controller: Dmitrij Rudakov, Lithuania. Contact: info@satido.lt.
What we keep and why.
- Your account (performance of a contract, GDPR art. 6(1)(b)): email address, a hash of your password (Argon2id; we never know the password itself), language, when the account was created, confirmed and last used. We send account and security emails to this address. An account cannot be created without an email address.
- Rules (contract): when you accepted which version of the Rules.
- News and offers (your consent, GDPR art. 6(1)(a); Lithuanian Law on Electronic Communications): only if you separately agreed, we email you Satido news and offers. As proof we keep when, where (sign-up, the Rules acceptance page, settings, unsubscribe link) and for which version you gave or withdrew consent, with a pseudonymised IP address. You can withdraw at any time with one click (link in every newsletter) or in settings; this doesn't affect processing done before. Newsletters only go to confirmed addresses.
- Public profile and leaderboard (contract): your nickname, avatar and best game score are visible to everyone. The default nickname is "Viking" plus a number; you can change it and your avatar at any time. An uploaded picture is shown to others only once you're on the leaderboard; until then they see a pixel avatar. Your email is never shown. Uploaded pictures are cropped, resized and re-encoded on our server, which removes hidden data such as location.
- Security (legitimate interest in protecting accounts, art. 6(1)(f)): a security event log (e.g. sign-up, failed password check) with a pseudonymised (keyed hash) IP address, kept 180 days; attempt counters against password guessing, kept 1 day; one-time links in emails, valid 1 to 24 hours. When you sign in from a new device, we email you the time, IP address and browser so you can spot a sign-in that wasn't you.
- Password check (legitimate interest): when you choose a password, our server sends only the first 5 characters of its SHA-1 hash to the Have I Been Pwned service. Your password, email and IP address are not sent.
Cookies and browser storage. We use only strictly necessary first-party cookies, so we don't ask for consent. No ads, no analytics, no tracking, and no tracking pixels in emails.
__Host-satido: keeps you logged in and protects forms; deleted when you close the browser (the session ends after 2 h of inactivity, at most 7 days).__Host-satido-dev: a random browser ID used for new-sign-in alerts; 400 days. The server keeps only a hash of it, deleted after 400 days unused.satido_lang: your chosen language; 1 year.__Host-satido-pending: a guest's best score, so it can be added to the leaderboard when they log in; 400 days from the last game.- Browser storage (
localStorage) keeps your language, popped-bubble count, sound setting and best score on your device; this is never sent to us.
Who else handles data. The site, database and email sending run at our hosting provider serveriai.lt (UAB "Interneto vizija", Lithuania), which processes data on our behalf. Server logs (IP address, request, time) are kept per the hosting provider's schedule. We don't sell data or share it with anyone else, and we don't transfer it outside the EU.
How long. Account data and consent records are kept until you delete the account. Unconfirmed accounts are deleted after 7 days. When you delete your account, its data, score and picture are removed from our server immediately (a picture already loaded can stay in a browser's cache for up to 1 hour); only pseudonymised security log entries no longer linked to the account remain, deleted within 180 days, and the hosting provider's backups roll over on its own schedule.
Age. You must be 14 or older to create an account. Younger players can play without one.
Your rights. You can access and get a copy of your data, correct it, delete it (on your account page), restrict its use, object to processing based on legitimate interest, withdraw your newsletter consent at any time, and get your data in a machine-readable format. You can download a copy of your account data as a JSON file yourself: Account → Download my data. We don't use automated decision-making or profiling. Write to info@satido.lt from your account email; we reply within one month. You can also complain to the Lithuanian data protection authority, Valstybinė duomenų apsaugos inspekcija (vdai.lrv.lt).