Privacy policy

A courtesy translation of the German privacy policy, which is the binding version.

1. In short

You can use Dartile without an account and without a network connection. Games, statistics and the camera analysis stay on your device. Personal data reaches us only if you create an account to play against other people, if you write to us, or if you take out Dartile Plus on this website.

There is no advertising, no tracking, no profiling and no sale of data. There is no analytics tool on this website.

2. Controller

Domenic Moran, Heidelberger Str. 36, 12059 Berlin, Germany.
dartile@menucloud-berlin.de · +49 30 767 645 46

We have not appointed a data protection officer; the statutory thresholds of § 38 of the German Federal Data Protection Act are not met. Enquiries go to the address above and are answered by a person.

3. Categories of data

• On the device only: your games, throws, statistics, settings and camera calibration. This data is not transmitted.
• Account: e-mail address and the display name you choose.
• Online matches: the individual darts with a sequence number, the match and the accounts taking part.
• Enquiries: whatever you write to us.
• Subscription on this website: name, billing address and payment data, processed by Stripe.
• Server logs: IP address, time, requested address.

4. Legal bases

Art. 6 (1) (b) GDPR for everything needed to perform the contract — account, online play, subscription. Art. 6 (1) (f) GDPR for the secure operation of the servers. Art. 6 (1) (c) GDPR where the law requires retention, in particular for invoices. Art. 6 (1) (a) GDPR wherever we ask for consent; you can withdraw it at any time with effect for the future.

5. Camera

The camera scoring runs entirely on your device. Frames are evaluated in memory and discarded. No image and no video is stored, transmitted or passed on, and there is no upload of camera data of any kind.

The app asks for camera permission only when you use that function, and you can refuse or withdraw it at any time. Manual input remains available everywhere.

6. Playing online

An online match needs an account, because the throws have to be attributed to someone and your opponent sees a name. What travels between the phones are the individual darts with a running number, not the score.

Your opponent sees your display name and your throws in that match. Nothing else — not your e-mail address, not your other statistics.

7. Processors

These are all the services that receive personal data. We use no others.

7.1 Database and accounts (Supabase)

Provider: Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992
Purpose: Accounts and the matches played against other people over the network.
Data: E-mail address, the display name you choose, the darts and the course of online matches, sign-in timestamps, technical access data. No password is processed, because there is none: signing in uses a one-time code sent to your address. Games you play on your own are not stored here; they never leave the device.
Legal basis: Art. 6 (1) (b) GDPR — performance of the user contract.
Storage location: EU only: AWS region Frankfurt am Main (eu-central-1).
Retention: Until the account is deleted, then within 30 days.
Third country: Processing takes place in the EU. For support access from the USA, the EU standard contractual clauses apply. A data processing agreement under Art. 28 GDPR is in place.
Their policy: supabase.com/privacy

7.2 Hosting of this website (Vercel)

Provider: Vercel, Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA
Purpose: Delivering this website and its forms.
Data: IP address, browser type and version, requested address, referrer, time of access.
Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in secure, fast operation.
Storage location: Delivered preferentially from the EU region Frankfurt (fra1).
Retention: Access logs per the provider's schedule, at most 30 days.
Third country: USA, safeguarded by the EU standard contractual clauses and the EU-U.S. Data Privacy Framework, in which Vercel is listed. A processing agreement under Art. 28 GDPR is in place.
Their policy: vercel.com/legal/privacy-policy

7.3 Sending e-mail (Resend)

Provider: Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA
Purpose: Sending the messages that arise from forms on this site and account confirmations.
Data: E-mail address, message content, delivery metadata (time, delivery status).
Legal basis: Art. 6 (1) (b) GDPR for contract-related messages, Art. 6 (1) (f) GDPR for answering enquiries.
Storage location: EU sending region (Ireland).
Retention: Delivery logs per the provider's schedule, at most 30 days.
Third country: USA, safeguarded by the EU standard contractual clauses. A processing agreement under Art. 28 GDPR is in place.
Their policy: resend.com/legal/privacy-policy

7.4 Payments on this website (Stripe)

Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, D02 H210, Ireland
Purpose: Handling the Dartile Plus subscription when it is taken out on this website rather than through an app store.
Data: Name, e-mail address, billing address, payment data, amount, time. We neither see nor store complete card details; they go straight to Stripe.
Legal basis: Art. 6 (1) (b) GDPR — performance of the contract — and Art. 6 (1) (c) GDPR — statutory record-keeping duties.
Storage location: Ireland (EU).
Retention: Invoice and payment data for 10 years under § 257 of the German Commercial Code and § 147 of the German Fiscal Code, then deleted.
Third country: The contracting party is the Irish company. For access by the US parent, the EU standard contractual clauses apply. Stripe is certified to PCI-DSS Level 1.
Their policy: stripe.com/privacy

7.5 App distribution (Apple)

Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland
Purpose: Distributing the app through the App Store and delivering notifications.
Data: Device token for notifications. Which Apple account downloaded the app is not disclosed to us.
Legal basis: Art. 6 (1) (b) GDPR — performance of the contract.
Storage location: Ireland (EU) and further Apple locations.
Retention: Push tokens until the device stops renewing them.
Third country: Transfers to the USA are safeguarded by the EU standard contractual clauses and the EU-U.S. Data Privacy Framework. For distribution through the App Store, Apple is an independent controller.
Their policy: apple.com/legal/privacy

7.6 App distribution (Google)

Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Distributing the app through Google Play and delivering notifications.
Data: Device push token.
Legal basis: Art. 6 (1) (b) GDPR — performance of the contract.
Storage location: Ireland (EU) and further Google locations.
Retention: Push tokens are deleted once the device stops renewing them.
Third country: Transfers to the USA are safeguarded by the EU standard contractual clauses and the EU-U.S. Data Privacy Framework. For distribution through Google Play, Google is an independent controller.
Their policy: policies.google.com/privacy

7.7 Mailbox for enquiries (our own mail server)

Provider: Hetzner Online GmbH (data centre), operated by us, Industriestr. 25, 91710 Gunzenhausen, Germany
Purpose: Running the mailbox that receives support requests, deletion requests, withdrawals and access requests.
Data: Everything you write to us or enter in a form: e-mail address, subject, message text, time and the technical headers of the message.
Legal basis: Art. 6 (1) (b) GDPR for contract enquiries, Art. 6 (1) (c) GDPR for handling statutory claims such as deletion or access.
Storage location: Finland (EU).
Retention: Messages are deleted once the matter is settled, at the latest after six months. Matters with legal relevance are kept until the respective statutory period ends.
Third country: No transfer to a third country.
Their policy: hetzner.com/legal/privacy-policy

8. Cookies

This website sets no cookies for analytics or advertising. What it stores is what is technically necessary: your consent decision and, if you sign in to buy a subscription, your session. Both are stored under § 25 (2) of the German Telecommunications Digital Services Data Protection Act, which does not require consent for what is strictly necessary.

9. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). Write to dartile@menucloud-berlin.de; we answer within one month.

10. Deleting your account

Use the form at Delete account. It works without signing in. Your account and the matches attributed to it are deleted within 30 days; anything stored only on your device disappears when you uninstall the app.

11. Complaints

You may lodge a complaint with a supervisory authority, in particular in the member state of your residence. Ours is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin, mailbox@datenschutz-berlin.de.

All traffic to this site and to our servers is encrypted with TLS. You can tell by the padlock in the address bar.