This is a courtesy translation. The German version is legally binding.
Quick version: The app runs without ads, without tracking or analytics SDKs,
and without selling any data. On our website we use a TikTok measurement pixel — but
only if you consent first (notice on your first visit, declining is equally easy; see
section 4). We only process the data the app needs to work — stored in the
EU (Render/Postgres, Frankfurt region). You can fully delete your account in the app at any
time.
1. Controller
Jürgen Ertl — Einzelunternehmer (sole proprietor), business name „WannaPlay"
Lohwaggasse 6/3/3
1220 Wien, Österreich (Vienna, Austria)
Email: office.wp@gmx.at
Support inquiries: wannaplay.support@gmail.com
See also the Imprint. A data protection officer has not
been appointed (not required).
2. What data we process
Account data: gamertag (required) and, optionally: email address and password
(stored exclusively as an scrypt hash, never in plain text), date of birth or a rough age
range, gender, motto, and profile decoration settings.
Steam link (optional): When you sign in with Steam (Steam OpenID), we receive
your public SteamID as well as your public display name and avatar. We never see your Steam
credentials. Requests to the Steam Web API (e.g. game library, friends list — only if your
Steam profile is public) run exclusively server-side; the Steam API key never leaves our
server.
Twitch (optional, only if you link a channel in Settings › Streamer): When you
link a channel (OAuth) we receive its channel ID, channel name, display name, profile image
URL, follower count, partner status and creation date, in order to check and display your
streamer status (from 1,000 followers). We revoke the access token immediately after the
check; the monthly re-check only needs the public follower count. Legal basis: Art. 6(1)(b)
GDPR (a feature you requested). Retention: until you remove the link in Settings › Streamer or
delete your account. Provider based outside the EU — Standard Contractual Clauses.
TikTok / YouTube / Kick (optional, manual review): You only give us the link to
your channel and temporarily put a verification code in your channel bio; our team reviews the
public channel and enters the public follower count. There is no automated data retrieval
and no data is transmitted to these providers. Legal basis: Art. 6(1)(b) GDPR (a feature
you requested). Retention: until you remove the link in Settings › Streamer or delete your
account.
Login sessions: Auth tokens are stored only as sha256 hashes (rolling session
lifetime of approx. 180 days). One-time links for email verification (valid for 7 days) and
password reset (valid for 1 hour) are likewise stored only as hashes and can be used only
once.
Content you create: chat messages (1:1), posts, comments, reactions, ratings and
likes/commends, including timestamps.
Images: profile pictures and post images. These are currently stored directly in
our database (base64, Render Postgres, Frankfurt/EU); a migration to Cloudflare R2 (EU
region) is planned and will be noted here as soon as it happens.
Push notifications (optional): If you allow notifications, we store your Expo
push token in order to deliver notifications to you (e.g. messages, invitations). You can
turn this off per category in the settings.
IP addresses: are processed briefly and exclusively in the server's working
memory to prevent abuse (rate limits, e.g. for registration and login). We do not store them
permanently; our hosting provider may, for technical reasons, log connection data for a
short time.
Blocking & reporting: We store blocks and reports in order to enforce them
and to have them reviewed by our moderation team.
3. Purposes and legal bases (Art. 6 GDPR)
Performance of contract (Art. 6(1)(b)): account, login, chats, posts, matching,
friends list, push delivery — in other words, operating the app features you use.
Consent (Art. 6(1)(a)): optional information (e.g. date of birth, gender, Steam
link). You can withdraw consent at any time by removing the information or deleting your
account.
We do not sell your data. Nothing is shared for advertising purposes from within
the app. To operate the service we use the following providers (processors or recipients):
Render — hosting of the server and the Postgres database, Frankfurt region (EU).
This is where account data and content are stored.
Resend — delivery of system emails (email verification, password reset);
processes the recipient address and the email content. Provider based in the USA — transfer
on the basis of EU Standard Contractual Clauses (SCC).
Expo — delivery of push notifications (push token). Provider based in the USA —
transfer on the basis of EU Standard Contractual Clauses (SCC).
Valve / Steam — only if you sign in with or link Steam: OpenID sign-in and
retrieval of your public Steam profile data via the Steam Web API (server-side).
Twitch (Amazon) — only if you link a Twitch channel: OAuth linking and retrieval of
the public channel data (server-side). For TikTok/YouTube/Kick we review the public channel
manually — no data flows from us to those providers.
Cloudflare R2 (planned, EU region) — future storage of images.
TikTok (website only, consent only) — on our public pages (home, quiz pages,
shared links, legal pages) we may measure which ad led to a visit ("TikTok pixel"). The pixel
is only loaded after your active consent; if you decline or do not choose, no
request is made to TikTok at all. Data transferred in that case: IP address, page visited,
browser/device data. Legal basis: consent (Art. 6(1)(a) GDPR), withdrawable at any time.
Provider based outside the EU — transfer on the basis of EU Standard Contractual Clauses
(SCC). Withdrawal: the choice is stored locally in your browser
(wp.consent) — clear this site's data and we will ask again. The pixel is
not used in the app.
5. Storage periods and deletion
We store account data and content until you delete your account.
Login sessions: approx. 180 days (rolling); email verification links 7 days, password
reset links 1 hour — each usable only once.
IP-based rate-limit data: transient in working memory only, no permanent storage.
Account deletion: at any time in the app (Profile → ⚙️ Settings → Delete
account). Deletion takes effect immediately and cascades: profile, chats, posts, comments,
reactions, ratings, likes, images, sessions and account links are deleted along with it.
6. Moderation
Reported content and rule violations are reviewed by our moderation team. It may remove
content and suspend accounts temporarily or permanently; you will be notified in the app
about such measures. Details in the
Terms of Use.
7. Your rights (Art. 15–21 GDPR)
You have the right of access (Art. 15), rectification (Art. 16),
erasure (Art. 17), restriction of processing (Art. 18),
data portability (Art. 20) and objection (Art. 21). You can withdraw any
consent you have given at any time with effect for the future. To do so, contact the email
address stated above. You also have the right to lodge a complaint with a data protection
supervisory authority — in Austria, the Datenschutzbehörde (Austrian Data Protection
Authority, dsb.gv.at).
8. Minimum age
Wanna Play? is intended for persons aged 16 and older. Persons under 16 may not
use the app.
9. Changes
We will update this policy when the app or the services we use change (e.g. moving images
to Cloudflare R2). The current version can always be found at this address; the effective
date is shown at the top.