Privacy and data protection

Controller and contact

The data controller is Vasile Nechifor, an individual. For privacy questions or requests, contact [email protected].

Data and purposes

• Account data: username, email, display name, password hash and privacy-notice acknowledgment, used to create and secure your account and provide tournament services.
• Organizer content: public profile, contact details, announcements, events and uploaded images, published only when the organizer enables the public page.
• Tournament data: tournament settings, player names, pairings and results entered by organizers. Public results remain available until the organizer deletes the tournament.
• Technical data: session, CSRF, IP and server-security information needed to operate and protect the service.
• Optional analytics: Google Analytics loads with analytics storage denied by default. Before consent, it sends limited cookieless measurement signals to Google; after consent, it may use analytics cookies and provide full measurement.

Legal bases

Account and tournament processing is necessary to provide the requested service. Security and abuse prevention rely on the controller's legitimate interest in protecting the platform. Analytics cookies and full measurement rely on consent and can be refused or withdrawn at any time. Limited cookieless traffic measurement is used to estimate aggregate use of the service. Data may also be retained where required by law.

Public data and organizers

Public organizer pages, announcements, events, tournament player names and results can be viewed by anyone. Organizers decide which player information they enter and publish and must inform players before doing so. Avoid entering unnecessary personal data.

Organizer responsibility for submitted data

Tournament organizers determine which player names and other tournament information they collect, enter, and make public. Each organizer is responsible for having a lawful basis, giving players the required privacy information, keeping data accurate and limited to what is necessary, obtaining any required permissions, and handling requests concerning the tournament content they control. Organizers must not submit sensitive, unlawful, misleading, or excessive personal data, or information about another person without authority.

The service does not pre-screen organizer-entered content and, to the extent permitted by law, is not responsible for an organizer's independent decision to collect or publish that content. This does not limit the platform operator's own obligations for operating and securing the service or any rights available under applicable law.

Recipients and international transfers

Data may be processed by hosting and infrastructure providers, Cloudflare for registration protection, jsDelivr for interface assets, Buy Me a Coffee where its support button is displayed or opened, and Google for limited cookieless measurement before consent and full analytics measurement after consent. Some providers may process data outside the European Economic Area using applicable transfer safeguards. Current provider information is available from the privacy contact.

Retention

Account and organizer data is kept until the account holder requests deletion. Tournament data is kept until the organizer deletes the tournament. Security logs are normally kept for up to 90 days. Residual backup copies are removed according to the hosting provider's backup replacement cycle and are not used for other purposes.

Cookies

Essential session, language and security storage is used to authenticate users and protect forms. It cannot be disabled while using account functions. Analytics storage is denied by default. Before consent, Google Analytics may send cookieless signals that can include the page URL, referrer, timestamp, browser information and IP address transmitted with the request; Google states that Analytics does not log or store the IP address. Analytics cookies are used only after consent. Cookie preferences can be changed from the Cookie settings link.

Your rights

You may request access, correction, export, deletion, restriction or objection and may withdraw analytics consent at any time. Requests are normally answered within one month. Contact [email protected].

Automated decisions

The platform calculates tournament standings from submitted game results. It does not make decisions that produce legal or similarly significant effects.

Automated content moderation

To protect visitors and keep public pages limited to Catan-related activity, organizer-submitted text and images may be checked for prohibited or harmful content before publication. Basic relevance and abuse checks are performed by this service. When remote image or text moderation is configured, the submitted content is also transmitted to OpenAI for classification solely for abuse-prevention and platform-safety purposes. Moderation logs store the decision, detected category names, user identifier, publishing surface, timestamp, and a one-way content fingerprint; they do not store a second copy of the submitted text or image.

Content may be blocked automatically, reviewed manually, or removed after publication. Automated decisions can produce errors. An organizer who believes content was blocked incorrectly may contact the operator using the privacy contact address shown in this notice.

Hex Strategist Android application

Hex Strategist is an independent Android board-setup utility published by Vasile Nechifor and powered by catan.soft2u.ro. The app does not require an account and does not include advertising or mobile analytics SDKs.

When a user requests a board, Hex Strategist sends only the selected generation rules to the catan.soft2u.ro Classic board API over HTTPS. The optional Scan physical board feature requests camera access only after the user opens it. A captured photo is processed on the device from the app's private temporary cache to suggest terrain, number-token, and harbor values; the photo is not uploaded, shared, added to the media library, or stored in the service database. During normal operation, the app deletes that temporary photo after confirmation, cancellation, recognition failure, or retake; Android may also clear app cache. The user must review and confirm the suggested values before they become the current locally stored board. When the user chooses board analysis, the app sends the current terrain, number-token, and harbor configuration to the analytics API so settlement scoring can be calculated. In interactive analysis mode, each recalculation also sends the selected player count and seat, the ordered intersection IDs of the settlements entered by the user, and the destination-intersection ID selected for each initial road. These requests are processed statelessly to produce the response; the board, selected player count and seat, settlement sequence, and initial-road choices are not written to the application database, published, or saved as shared maps. The service and its hosting infrastructure process the IP address, request time, user agent, response status, and security information needed to deliver and protect the service. These technical logs follow the retention rules stated above. The app does not send an advertising identifier, contacts, photos, precise location, or board-game account information.

The most recently generated board is stored in the app's private device storage so it can remain visible if the service is temporarily unavailable. Clearing the app's storage or uninstalling it removes this local copy, subject to any Android backup or device-transfer copy controlled by the user and platform. Opening the website or privacy policy leaves the app and uses the user's browser, where the website's separate cookie choices apply.