PRIVACY POLICY

In short: To play on couch-games.com and in our apps you don't need an account with us; we use no cookies, trackers or advertising. During a multiplayer session your IP address, player name and inputs are transmitted between the players; beyond the session we store no game data. Playing via the third-party platform AirConsole is also subject to its terms (see below).

This privacy policy applies to the Couch Games offering: the couch-games.com website, the web games provided through it (currently HexStacker at hexstacker.com), the Couch Games app (Android and iOS) and the associated TV apps (Android TV and Apple TV). It also covers future Couch Games titles insofar as they use the same infrastructure (in particular the game and helper servers described below) – regardless of the domain or subdomain under which they are provided. Playing a game via a third-party platform is described separately under "Use via AirConsole".

Controller

The controller within the meaning of the GDPR is:

Tim Vogel

info@couch-games.com

Postal address: see Imprint

Data

IP addresses are processed by the web server when you access our websites. Web server access logs are stored for security and operational purposes for a maximum of 7 days and then automatically deleted.

During a multiplayer session, our game server processes your IP address and merely relays the data required for gameplay (e.g. player names and inputs) between the devices; it is not stored beyond the session. When you join via the Couch Games app, the scanned or entered room code is transmitted to the game server in order to find the corresponding game room. To reduce input latency, individual inputs may, where technically possible, be transmitted directly between the participating devices; the devices exchange their IP addresses for this purpose. The game server itself does not store any connection data; to the extent that infrastructure-side logs are generated at our processor for technical reasons, the information under "Hosting" applies.

For direct connections between game devices, a helper server (STUN server, see "Hosting") is additionally involved, which helps the devices establish the connection. No game data is transmitted via it, and it stores no data.

The TV apps open a game room and connect to the game server for this purpose, and – for direct controller connections – also to the helper server. As with any device, their IP address is processed in doing so. They do not access any website.

Besides the controller, the recipient of the connection data is the processor named under "Hosting", who may in turn engage sub-processors; these are contractually bound to the same level of data protection (Art. 28(4) GDPR). No further disclosure takes place. The processing is carried out on the basis of the legitimate interest in operating the service (Art. 6(1)(f) GDPR). Providing your IP address is technically necessary in order to access our websites and take part in the game; without this data, use of the service is not possible. There is no further statutory or contractual obligation to provide it.

Tracking and local storage

No cookies, no analytics or advertising services and no third-party trackers are used. Only a few game settings are stored locally in the device's browser (e.g. player name, player colour, mute state and further settings, plus a reconnection ID that applies only to the current game room) to retain them for the next session. This local storage is strictly necessary for game operation within the meaning of § 25(2) no. 2 TDDDG and does not serve tracking purposes.

The Couch Games app displays the game controller in an integrated browser (WebView); the browser storage described above therefore also applies in the app. In addition, the app itself stores the last used player name locally on the device only, in order to suggest it at the next start; the last joined game room (room code and link) is not stored permanently. The TV apps store no data on the device at all: settings such as mute state exist only for the current session.

Camera and QR scan (App)

The Couch Games app can use your device's camera to scan the QR code of a game room shown on the TV or screen. Camera access occurs solely at your active initiative, when you tap the scan function; before first access, the operating system asks for your permission, which you can revoke at any time in the device settings. The camera image is processed entirely locally on the device; only the room link contained in the QR code is evaluated. No images are stored or transmitted to third parties, so no personal data is collected in the process.

App Stores

The Couch Games app and the TV apps are distributed via the Apple App Store and Google Play. When downloading and using them, these platforms process their own data (e.g. download data and – depending on your operating-system settings – diagnostic and crash data) on their own responsibility in accordance with their respective privacy policies. The apps themselves contain no analytics, advertising or tracking services, no crash reporting of their own to third parties and no device or advertising identifiers.

Use via AirConsole

Some of our games (currently HexStacker) can also be played via the third-party platform AirConsole (N-Dream AG, Werdstrasse 36, 8004 Zurich, Switzerland). When a game is played via AirConsole, the game connection does not run via our infrastructure but via AirConsole's platform. In this respect AirConsole is an independent controller and processes the data arising from use of the platform in accordance with its own privacy policy (such as profile or account data including the name chosen there, connection data, usage statistics and, where applicable, advertising delivered via the AirConsole interface). For Switzerland, an adequacy decision of the EU Commission is in place. Our own processing of game data is likewise limited to what is necessary in this case (no storage beyond the session, data minimisation); no account with us is required for it.

Hosting

The websites and the helper servers (including stun.hexstacker.com and stun.couch-games.com) are hosted on the controller's servers in Germany. The game servers used for multiplayer and room search (including ws.hexstacker.com and ws.couch-games.com) are operated for us by Fly.io, Inc. (Chicago, USA) as a processor pursuant to Art. 28 GDPR. Because the game servers run across multiple regions, data traffic may also be routed via locations outside the EEA; such transfers are safeguarded by the EU Standard Contractual Clauses (Decision (EU) 2021/914, Module 2 pursuant to Art. 46(2)(c) GDPR) as well as supplementary technical measures (TLS encryption in transit). Fly.io, Inc. is additionally certified under the EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795). We provide a copy of the Standard Contractual Clauses on request.

Rights of data subjects

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18). A right to data portability (Art. 20 GDPR) does not exist, as we do not store any data on the basis of consent or a contract. To exercise these rights, please contact the controller at the email address given above. Your separate right to object under Art. 21 GDPR is set out below. Automated decision-making, including profiling (Art. 22 GDPR), does not take place.

Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.

www.lda.bayern.de

Last updated July 2026 · English translation for convenience; the German version prevails. Deutsch