Privacy Policy

Last updated: May 2026

1. Data Controller

The data controller for Suplay Games & Tools is suPlay B.V., Ruwerstraat 9, 7545 SM Enschede, The Netherlands. For general questions email info@suplay.nl; for privacy or data-subject requests email privacy@suplay.nl.

2. What we collect

Suplay Games & Tools is designed for anonymous play. The data we may collect:

• An anonymous player identifier — a random UUID generated in your browser and kept in localStorage. We never link it to your real identity.
• An optional display name — only if you type one in the “What should we call you?” box after joining a class. You can skip this and stay anonymous.
• An optional class code — if your teacher gave you a short code (e.g. TIGER-42) and you joined that class.
• Game attempts — your score, the maximum possible score, how long the play took, and a JSON payload of the choices you made in that specific game (e.g. which option you picked in Anchor!, how you placed cards in Kraljic). Used to show your debrief and, if you joined a class, to populate the teacher’s dashboard.
• Standard server logs — your IP address, browser user-agent, and the URL you requested. Retained for at most 14 days and only used to diagnose abuse or technical failures.

We do not collect: your email address, your password (there are no accounts), payment information (the service is free), precise location, social-graph data, or anything else not listed above.

3. Legal basis

• Legitimate interest (Art. 6(1)(f) GDPR) for the anonymous player identifier and game attempts — these are necessary to run the games and show debrief feedback.
• Consent (Art. 6(1)(a) GDPR) for the optional display name — you choose whether to provide it and can revoke at any time by clearing your browser’s storage.

4. How data is stored

The anonymous identifier and display-name preference live only in your own browser’s localStorage. They leave your device only when attached to a game attempt you submit.

Game attempts are stored in a PostgreSQL database hosted by TransIP / team.blue on servers in the Netherlands. All transport uses HTTPS/TLS with HSTS enforced.

5. Cookies

We do not set any cookies — not for tracking, not for analytics, not for advertising, and not even for sessions (the anonymous identifier is in localStorage, not a cookie).

6. Who has access

• Your teacher, if you joined a class, can see the play results submitted under that class code: your display name (or “anon” if you skipped), score, duration, and the game-specific payload. They cannot see anything you submitted in another class or in anonymous individual play.
• suPlay B.V. operations staff can access the underlying database for maintenance, backup, and abuse-handling. Access is logged and limited to what is necessary.
• No data is sold, rented, or shared with marketers or advertisers.

7. Retention

• Game attempts are retained for the lifetime of the class code (30 days from creation) and then deleted with their parent class.
• Class sessions are deleted automatically 30 days after they’re created. A teacher can clear all attempts in a class earlier from the dashboard.
• Standard server logs are rotated after 14 days.
• Encrypted database backups are kept for 14 days locally and 30 days off-site.

8. International transfers

All processing takes place in the European Union. We have no third-country subprocessors for this service. See our subprocessors page for the full list.

9. Your rights under the GDPR

You have the right to:

• Access the data we hold about you (in practice, attempts linked to your anonymous identifier or display name);
• Rectify any inaccurate display name (simply edit it in your browser);
• Erase your data — clear your browser’s localStorage to forget the anonymous identifier, and email privacy@suplay.nl with the class code(s) you played under if you want server-side records deleted;
• Restrict or object to processing;
• Data portability — export of your attempts on request;
• Complain to your supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

10. Children

Suplay Games & Tools is intended for university-level and adult professional education. We do not knowingly process data of children under 16. If you believe a child under 16 has used the service in a way that resulted in identifiable data being processed, please contact us and we will delete it.

11. Security

For the technical and organisational measures we apply to protect data, see the security summary.

12. Changes

If we change this policy materially we will update the “Last updated” date at the top. For substantial changes affecting customers with a signed agreement, we will notify them by email.