Privacy policy

This policy applies to the Outstat app (iOS and Android) and to the website outstat.games. In short: Outstat needs no account, shows no ads, uses no tracking or analytics services and sells no data. The German version is legally binding.

Controller

Outstat GmbH, Oristalstrasse 44, 4410 Liestal, Switzerland
E-mail: support@outstat.games

Data the app processes

Anonymous sign-in and player ID

On first launch, the app signs in anonymously with Firebase Authentication (Google). This creates a random identifier, without name, e-mail address or phone number. With this identifier the app receives a short-lived access token and sends it with every request to our game server. This way only the app can use the server, and the server can match your games to you. Firebase Authentication stores the identifier and the time it was created and last used, and processes technical data such as your IP address. If you delete the app, it no longer knows the identifier; we delete the anonymous account itself after 12 months without use.

Games

The game rules run on our server. For each game we store: the player ID, the display name in the game, the chosen deck and difficulty, how the cards were dealt, the rounds played and timestamps. We use this data only to run the game. Games are deleted no later than 90 days after the last move.

Technical data when connecting

When the server is called, your IP address, date and time, the address requested, the device language (for the language of the card texts) and the app version are processed because this is technically necessary. This data ends up in our hosting provider's logs and is used for troubleshooting and to prevent abuse, not to analyse your behaviour.

Settings on your device

The app stores your language choice only locally on your device.

In-app purchases

Hypercars is free; more decks can be bought in the app. Payment is handled by Apple's App Store or Google Play; we never receive payment details. Apple's or Google's terms and privacy policy also apply to the purchase. So that our server can unlock a purchased deck, the app sends the receipt and the server checks it directly with the store. For each purchase we store: the store, the product, the transaction or order number, the time of purchase, the status (valid or refunded) and the anonymous identifier the deck is unlocked for. When you buy, the app also passes a random purchase identifier to Apple or Google so we can match refunds to the right account. We delete purchase data together with the anonymous account; “Restore purchases” keeps working through your store account afterwards.

Hosting and storage location

The game server and database run on Google Cloud (Google Cloud Run and Firestore) in the region europe-west6 (Zurich, Switzerland). For the anonymous sign-in we use Firebase Authentication; Google may also process this data outside Switzerland and the EU, in particular in the USA, and relies on the Swiss-U.S. and EU-U.S. Data Privacy Framework and standard contractual clauses. Google processes all of this data as a processor on our behalf. This website is delivered via Firebase Hosting (Google); to do so, Google processes your IP address and technical details of your browser.

This website

The website sets no cookies, loads no fonts, scripts or videos from third parties and uses no analytics tools. The videos and images are on our own hosting.

What we don't do

• No account, e-mail address or phone number required
• No ads and no advertising IDs
• No tracking across other apps or websites
• No sharing or selling of data to third parties
• No location data, no contacts, no access to photos, camera or microphone

Children

Outstat is suitable for all ages. Since the app does not ask for any personal details, we do not collect such data from children either.

Your rights

You can request information about your data, ask for it to be corrected or deleted and object to its processing. As we only know you by the random identifier, we need it for a request; you can find it in the app under the rules. Write to us at the address above. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or with the supervisory authority of your country of residence in the EU.

The legal basis is the Swiss Federal Act on Data Protection (FADP) and, where applicable, the GDPR (Art. 6(1)(b), performance of a contract: running the game, and (f), legitimate interest: secure operation).

Changes

If new features are added, such as a login or multiplayer games, we will update this policy before the update and list the new data and services here.