Privacy Policy

In short

Scitch works without ads, without tracking and without analytics services. We only store what the game needs: your player profile, your results and – if you sign in – your email address. We do not sell any data and do not share it for advertising purposes. Fonts, images and the game itself are served exclusively from our own server.

Controller

Andy Kucera, 1210 Wien, Austria – email: andy@dercoder.com (see imprint).

Playing in the app (guest account)

When you first start the app, it automatically creates a guest account – no registration required. For this we process:

• Device identifier: a randomly generated identifier that is stored only in the app on your device. It is neither an advertising ID nor a hardware identifier of your device.
• Player name and avatar: random at first (“Player1234”), can be changed at any time.
• Sign-in token: so that the app recognizes you the next time you start it.

Game data

To make matches, leaderboards, the Season Pass, the Daily Challenge and the map work, we store for each game: queue, placement, points, hits, mistakes, average reaction time, ranked points (RP), experience points, stars on the map, Daily results and your cosmetic items.

During a match, the app sends every tap with its timestamp to our game server, which evaluates it. Individual taps are not stored permanently – only the summary of each game.

Your player name, rank and avatar frame are visible to other players: in the lobby, during the match, in the results and on the leaderboards.

The legal basis is the provision of the game (Art. 6(1)(b) GDPR).

Fair play & anti-cheat

The server checks every tap for plausibility, for example inhumanly fast or suspiciously even reaction times. Suspicious participations are flagged and reviewed manually by us; flagged runs do not earn stars on the map. A ban is always issued by a human, never by the system alone.

The legal basis is our legitimate interest in fair competition for all players (Art. 6(1)(f) GDPR).

Account with email address (optional)

When sign-in is available, you can secure your account with an email address – without a password: we send you a six-digit code. We store your email address and the code; the code is stored only in encrypted (hashed) form, is valid for a maximum of 10 minutes and can be used once. We limit requests per address and per network (IP address) to prevent abuse.

We send the codes via our own mail server.

Scitch Live (teams, streams, events)

When Scitch Live is available, we store the email address of organizers as well as the names and settings of their lobbies. Players take part with a display name of their choice. During an event, the score, placements and names are visible to everyone present on the organizer's presentation view.

Website, cookies & server logs

Our website does not set any cookies for advertising or statistics. It only uses a technically necessary session cookie and a security cookie that protects against forged form requests (CSRF). No consent is required for this (§ 165(3) of the Austrian Telecommunications Act, TKG 2021).

When you visit the website and when the app sends requests, the server briefly stores technical data (IP address, time, requested address, browser or app identifier) to keep the service running and to fend off attacks. These log files are deleted automatically after eight weeks at the latest; application logs after 14 days.

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Hosting & recipients

Scitch runs on its own server in a data center in Germany. The hosting provider is STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Deutschland, with whom a data processing agreement is in place. The game server, database and mail delivery run on this server – there are no other service providers that receive game data, and no data is transferred to countries outside the EU.

If you download the app from the App Store or Google Play, Apple or Google process their own data for downloads, updates and – if you agree – crash reports in accordance with their privacy policies. We have no influence on this.

Retention & deletion

• Your account and game data are stored until you delete your account. In the app: Profile → Delete account – the account is deleted immediately and completely.
• Sign-in codes expire after 10 minutes and are cleaned up daily.
• If you delete the app, the guest account remains on the server but is no longer linked to your device. We will delete it on request – just send us your player name.

Children & teenagers

From the age of 14, you can consent to the processing of your data yourself (§ 4(4) of the Austrian Data Protection Act, DSG). Anyone younger needs the consent of a parent or another legal guardian.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. To exercise them, write to us at andy@dercoder.com.

If you believe that we are not processing your data lawfully, you can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, Austria, dsb.gv.at.

Changes

When Scitch gets new features, we update this policy. You can always find the current version here.