Privacy

In short

Eyeball is a free game. We only store what the game needs: your game data, your account and your settings. There are no ads, no third-party tracking services, and we don’t sell any data. You can download your data or delete it together with your account at any time in the settings.

Last updated: October 20, 2026. This translation is provided for convenience; the German version is binding.

Controller

Niklas Trapp, Mooswaldstrasse 11, 79576 Weil am Rhein, Germany

Email: support@eyeballit.app

More ways to reach us are listed in the imprint.

Hosting and server

Eyeball runs on a server at [LEGAL_HOSTING]. We have a data processing agreement with the provider (Art. 28 GDPR).

When you open the app, the server processes technically necessary data: IP address, time, the address requested and the browser identifier. They are needed to deliver the page and to limit abuse (for example too many sign-in attempts). The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

Fonts are loaded from our own server, not from Google or other providers.

Playing as a guest

On your first visit Eyeball automatically creates a guest account with a random identifier. It is bound to your device by a session cookie (httpOnly, 90 days, renewed when used). With the session we store the IP address and browser identifier it was created with.

A guest account whose last session expired more than 30 days ago is deleted automatically with all its data.

Legal basis: providing the game you open (Art. 6(1)(b) GDPR). The cookie is strictly necessary for it (Section 25(2) no. 2 TDDDG).

Account

When you create an account we store:

• username, email address and your password – only as a secure hash, never in plain text
• with “Sign in with Google” also your Google account’s identifier and the name, email address and profile picture address Google sends (only your username is shown)
• previous usernames for 14 days (so you can take them back)

Legal basis: the contract for using Eyeball (Art. 6(1)(b) GDPR).

Game data

For the game to work we store:

• your answers and results in every mode (daily round, challenges, duels, practice etc.) with timestamps
• Linsen bookings, bought items, achievements, daily quests, casino rounds with their verification data (seeds)
• friendships, friend requests and invitations
• your online status (“online” / “last online”) – visible to your friends only
• your playtime (seconds per day) while the app is visible and you use it
• your bio and your look (eyeball)

Publicly visible: your username or nickname on leaderboards and, for accounts, the public profile (eyeball, name, level, bio, stats, playtime, achievements).

Legal basis: contract (Art. 6(1)(b) GDPR).

Fair play (anti-cheat)

With every answer we store how many inputs (taps, drags, keys) there were and how long they took – not what else you do. This produces hints such as “unusually fast”. They never change your points automatically; a human reviews them before anything happens.

Legal basis: legitimate interest in fair leaderboards and bets (Art. 6(1)(f) GDPR).

Notifications

If you turn on notifications, we store your browser’s subscription (an address at your browser’s push service, keys and language). Messages are delivered encrypted through the push service of your browser’s maker (for example Google for Chrome, Mozilla for Firefox, Apple for Safari).

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the settings.

Contact form and reports

When you write to us, we store your message, the chosen type, the language and the browser identifier (helps with bugs). When you report a player, we store the reason, your message and whom you reported.

Legal basis: legitimate interest in handling your request and in a safe game (Art. 6(1)(f) GDPR).

Moderation

Bans and other measures are decided by a human. We log them (what, when, against which identifier), also beyond a deletion, so we can prove them (Art. 6(1)(f) GDPR).

Our own analysis

To understand where new players get stuck, we count on our own server: the first visit per day (device type, whether the app is installed, language) and first steps (introduction, first task, first daily round, account). Only the random identifier is stored, no other data. There are no extra cookies and no third-party services for this. After a deletion only the identifier remains, which can no longer be linked to anyone.

Legal basis: legitimate interest in improving the game (Art. 6(1)(f) GDPR). You can object (see “Your rights”).

Storage on your device

Eyeball stores on your device: the session cookie, a cookie with your language (eyeball-locale) and, in local storage, your settings (theme, sounds, music, vibration), which hints you closed and a copy of your history for fast display. All of this is needed for features you use (Section 25(2) no. 2 TDDDG); there are no advertising or tracking cookies.

Google sign-in

Only if you choose “Sign in with Google”: sign-in runs through Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Data may be transferred to Google LLC in the USA; for certified companies such as Google there is an EU adequacy decision (EU-US Data Privacy Framework). Google’s privacy policy also applies.

Retention

• account and game data: until you delete your account
• guest accounts: 30 days after the last session expired
• sessions: 90 days after the last use
• messages and reports: as long as needed to handle them, at the latest with your account
• moderation log: as long as needed as proof

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time for the future.

The fastest way is in the app: Settings → Account → “Download my data” (all stored data as a file) and “Delete account” (guests: “Delete guest data”). For anything else, write to support@eyeballit.app.

You can also lodge a complaint with a data protection supervisory authority, for example the one where you live.

Age

Eyeball is for ages 16 and up. Younger players need their parents’ permission.

Security

The connection is encrypted (HTTPS), passwords are only stored as hashes and the session cookie can’t be read by scripts.

Changes

When Eyeball changes, we update this policy. We announce significant changes under “What’s new”.