Privacy policy

Last updated: 14 October 2026

In short: Gockel Party needs no account, sets no cookies, shows no ads and uses no analytics or tracking services. We only process what is needed for the site to load and for you to play with your friends in a room. Here is exactly what that is. The German version is the authoritative one.

1. Controller

The controller responsible for data processing on gockelparty.app within the meaning of the General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer because there is no legal obligation to do so. For any privacy question, reach us at the contact details above.

2. Visiting the site and server logs

When you open gockelparty.app, your browser sends technically necessary data to our servers: your IP address, date and time, the requested address, browser and system details (user agent) and, where applicable, the page you came from (referrer). Without this data the site cannot be delivered.

• Cloudflare sits in front of our server: it answers name lookups (DNS), sets up the encrypted connection (TLS), forwards requests, protects against attacks and overload, and redirects our secondary domains (for example www.gockelparty.app) to gockelparty.app. Cloudflare may also instruct your browser to report connection errors to Cloudflare (Network Error Logging).
• Railway runs our game server in a data centre in Amsterdam (Netherlands) and routes requests to it through its own network.

Both providers process this connection data on our behalf and may keep it in their own logs for operations and security, each for the short period the provider sets. Our own server writes technical logs (start-up, errors, load, room events such as "room opened", "kick" or "room expired") with the room code and a random player ID, but without IP addresses and without player names. To check that it recognises where connections come from, the server notes a short keyed tag (a hash) once per connection path, never the address itself. These logs are stored at Railway and deleted automatically according to the provider's retention period.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest: delivering the site securely, reliably and quickly and fending off attacks.

3. Playing in a room

When you create a room, join one through an invite link or code, or start a practice round with bots, our server processes:

• your player name (chosen by you or a random name such as "Hen Brawler"), your player colour and your locker picks (hen, farmer, paddle, farm, victory move, title, emotes),
• the game language (to pick random names),
• a random player ID and a secret key that give you your seat back after a reload,
• a room-scoped network hash: a tag computed with a secret key (HMAC) from the IP address of your connection and the room code. It only applies in that room, cannot be turned back into the address and cannot be linked across rooms. If the host kicks someone, nobody new from that network can join that room for 15 minutes,
• game state: seat, ready status, points, round winners, match statistics, your inputs during a round and the emotes you send,
• who was kicked from the room (player ID and key, so the kick sticks) and whether the host locked the room.

The server checks player names against a list of banned words; a blocked name is replaced by a random one. The data lives in the room on our game server at Railway in Amsterdam, in a database on a storage volume, so a running game survives a server restart. Other players in the room see your name, colour, locker picks, score and emotes. Anyone who knows the room code sees the names of the players in it before joining. So please do not use your full real name or any other personal details as your player name.

Deletion: if you leave a room in the lobby, your seat is released after about 90 seconds. A room and all its data are deleted automatically once nobody is connected: in the lobby and after a match after 2 minutes (practice rooms after 1 minute), during a running match after 30 minutes so you can come back after a dropped connection. When a new game version goes live, all running rooms are deleted when the server starts.

Legal basis: Art. 6(1)(b) GDPR. Without this data we cannot provide the game you start. For the network hash, the name check and the kick ban it is Art. 6(1)(f) GDPR: our legitimate interest is protecting players from trolls and offensive names.

4. Quick match ("Play")

When you search for players via "Play", your browser creates a random search ID with a secret key. For the search, our server keeps this ID, the time and a daily rotating pseudonymous network hash: a shortened tag computed with a secret key (HMAC) from the IP address of the connection and the current day. The IP address itself is not stored, the hash cannot be reversed without the key, and it cannot be linked to the previous day's. It is only used to limit abuse (too many searches from the same network).

A search is deleted once your browser has not checked in for 20 seconds or the group has reached its room, at the latest after about two minutes. Abuse counters are deleted after one minute.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest: fair queues and protection against overload.

5. Connection quality, error reports and statistics

Connection quality: during a round the game sends technical measurements to the server about every ten seconds: frame rate and stutter, connection latency and jitter (ping), timing of game state updates and how quickly your paddle responds. The server logs these values together with the room code and a random player ID, along with its own connection measurements for each player. Names and IP addresses are not included. We use the values to find and fix lag and stutter.

Error reports: if something in the game crashes, your browser sends a short technical report to our own server (no third-party service): type and text of the error, program file and line, a short excerpt of the call stack, the game version, the browser and operating system family (for example "Chrome 141 Android", not the full user agent), the current screen (for example "lobby") and how long the page has been open. Addresses are sent without query strings, room codes and IDs are masked; player names, room codes, IDs and keys are never sent. At most five reports per page load. The server writes each report as one log line. To slow down floods of reports it counts them for one minute per network under a randomly salted hash that only lives in memory and is never stored or logged.

Cookieless statistics: the server counts aggregated figures, for example how many rooms and matches there were, how long matches last, how many seats bots filled, how many searches succeeded and how many players were online at the same time. These figures only exist in the server's memory, without cookies, browser identifiers, player IDs, names, room codes or IP addresses, and are written to the log as totals at regular intervals. They do not allow conclusions about individuals.

Logs are stored at Railway and deleted automatically according to the provider's retention period. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest: a stable, smooth game without crashes.

6. Storage in your browser (no cookies)

Gockel Party sets no cookies. So you do not have to set everything up again on every visit, the game keeps a few entries in your browser's storage (localStorage, one sessionStorage entry). They stay on your device and are only sent to the server as described above (for example your name and locker picks when you join a room).

The localStorage entries stay until you delete them (clear browsing data or site data for gockelparty.app). Storing and reading them is based on § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), because they are strictly necessary for the functions you explicitly asked for; further processing is based on Art. 6(1)(b) GDPR.

7. No ads, no tracking, no third-party content

We embed no advertising, no analytics or tracking tools, no social media plugins and no content from third-party servers. Fonts, graphics, music and voices come from our own server. Your browser draws the QR code for invites itself. If you send an invite link through your device's share menu, the privacy policy of the app you choose applies.

8. Recipients and processors

We use two service providers as processors under Art. 28 GDPR:

• Railway Corporation, San Francisco, USA: hosting of the game server and its logs (server location Amsterdam, Netherlands).
• Cloudflare, Inc., San Francisco, USA: DNS, encrypted connection, routing and protection against attacks (global network, processing in the data centre near you).

Both companies are based in the USA, and access from the USA (for example by support staff) cannot be ruled out. For Cloudflare there is an adequacy decision of the European Commission (EU-US Data Privacy Framework, Art. 45 GDPR) to the extent the company is certified under it; the EU Standard Contractual Clauses apply in addition. For Railway, the transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). There are no other recipients; we do not sell data and only disclose it where the law requires us to.

9. Your rights

Under the GDPR and the Austrian Data Protection Act (DSG) you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object at any time to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR). Just write to us at the address above.

Because we have no accounts and do not link names to IP addresses, we often cannot find you in our data (Art. 11 GDPR). The room code and the approximate time help. You can delete the entries in your browser yourself at any time.

If you believe we process your data unlawfully, you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). In Austria that is:

10. Other

You are not obliged to give us any data. Without the technical connection data the site cannot load, though, and without a player name (or the random one) you cannot join a room. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR; the name check only replaces blocked names with a random one.

If the game changes, we will update this policy. The version published here applies.