Privacy Policy

1. Who is responsible

OneIsFake ("we", "us") is the controller for the personal data described here. For any privacy request, write to privacy@oneisfake.com. Postal and company details are listed on our Imprint page.

2. Data we process

• Account data (if you create an account): display name, email address, hashed password or third-party sign-in identifier.
• Gameplay data: rounds played, answers given, scores, streaks and leaderboard placement.
• Technical data: IP address, browser and device type, operating system, referring page, and timestamps, collected in server logs for security and abuse prevention.
• Preferences: theme (light/dark) and cookie-consent choices, stored locally in your browser.
• Analytics data: aggregated, pseudonymised usage statistics — only if you consent.

We do not knowingly collect data from children under 13, and we never sell your data.

3. Why we process it, and on what legal basis

• To provide the game and your account — performance of a contract (Art. 6(1)(b) GDPR).
• To keep the service secure and prevent cheating or abuse — legitimate interests (Art. 6(1)(f) GDPR).
• To measure and improve the product with analytics — your consent (Art. 6(1)(a) GDPR), withdrawable at any time.
• To meet legal and accounting obligations — legal obligation (Art. 6(1)(c) GDPR).

4. Cookies and similar technologies

We set strictly necessary cookies and local storage entries to run the site. Optional analytics cookies are only used after you agree. Full details and how to change your choice are in the Cookie Policy.

5. Sharing and processors

We share data only with service providers acting on our instructions under a data processing agreement: hosting and content delivery, database and authentication, error monitoring, and (with consent) privacy-friendly analytics. Where a provider is outside the EEA, transfers rely on the EU Standard Contractual Clauses or an adequacy decision.

6. Retention

Account and gameplay data are kept while your account is active and deleted within 30 days of an account deletion request. Server logs are retained for up to 90 days. Aggregated, non-identifying statistics may be kept indefinitely.

7. Your rights

You may request access, rectification, erasure, restriction, data portability, and object to processing based on legitimate interests. You can withdraw consent at any time. Send requests to privacy@oneisfake.com; we reply within one month. You may also lodge a complaint with your local data protection authority.

8. Security

We use encryption in transit (TLS), access controls, hashed credentials and least-privilege database rules. No system is perfectly secure, but we notify affected users and regulators about qualifying breaches without undue delay.

9. Changes

We may update this policy as the service evolves. Material changes are announced on the site, and the "last updated" date above always reflects the current version.