Privacy Policy

1. Controller

The data controller for rantotthus.com is Magic Pulpo Kft., 1122 Budapest, Széll Kálmán tér 15., Hungary (company registration number 01-09-392254, tax number HU24077849). Contact: hello@magicpulpo.com.

2. The short version

No accounts, no advertising profiles, and nothing sold to anyone. Our always-on analytics is cookieless: it counts page views and a few in-game events (a run started, a run finished, a score shared) without identifying you or following you across other sites. We additionally offer Google Analytics and Microsoft Clarity, which do set cookies and record how pages are used — those load only if you opt in on the banner, and never otherwise. The personal data we store on our servers is what you put on the leaderboard — a nickname you choose, your score, and a random device identifier — plus, if you enter the 3D contest, the name and email address you send with your entry. Payments happen on Stripe; we never see your card details.

3. What we process and why

• Leaderboard entries: nickname, score (time and clicks), date, and a randomly generated device ID created in your browser (it identifies your browser, not you). Purpose: running the public leaderboard. Legal basis: your consent, given when you choose a nickname and join. Entries are visible to everyone.
• Data stored only on your device (browser localStorage, never sent to us except as part of a leaderboard submission): your personal best, lifetime schnitzel count, nickname, your passport of dishes tasted, your chosen tool, and your analytics choice from the banner. See the Cookie Policy. Your “kitchen pass” save link is generated in your browser from exactly this data and is never sent to us — anyone you give it to can play as you, so treat it like a password.
• Menu alerts (push notifications): only if you switch them on. We store the push subscription your browser generates — a delivery endpoint URL issued by your browser vendor plus two encryption keys — and, if you have joined the leaderboard, your device ID. No email address, no name. Purpose: telling you when a new dish reaches the menu, roughly once a month. Legal basis: your consent, given when you enable alerts. Withdraw it at any time by switching alerts off in the game or revoking notification permission in your browser; the record is deleted immediately.
• Donations: processed by Stripe on their hosted checkout page under Stripe’s own privacy policy. We receive confirmation of the payment and limited receipt data (amount, time, and the email you give Stripe, if any). Purpose: processing your donation and handling refund requests. Legal basis: performance of the donation transaction and our legitimate interest in record-keeping.
• 3D contest entries: only if you submit one. We store the name you want credited, your email address, the dish name, the link to your model, any notes you add, and — if you have joined the leaderboard — your device ID. Purpose: reviewing your entry, asking you for the model file if it is shortlisted, and crediting you if it is served in the game. Your email is never shown in the game, never published and never shared. Legal basis: your consent, given when you submit the entry, and our legitimate interest in running the contest. Ask us at any time and we will delete your entry.
• Technical logs: our hosting provider processes IP addresses and request metadata to deliver the site securely. The game itself also keeps your IP address in memory for a short time to limit how many new players one connection can create in a day, which is how we stop one person filling the whole leaderboard. It is never written to our database and never linked to your score. Legal basis: legitimate interest in operating and securing the Service.
• Email: if you write to us, we process your address and message to reply. Legal basis: legitimate interest in answering you.

4. Who receives data (processors)

• Vercel Inc. (USA): hosting, serverless functions, and cookieless Web Analytics (aggregate visit and event counts).
• Google Ireland Ltd (Analytics) and Microsoft Ireland Operations Ltd(Clarity): optional usage analytics and session replay, processed on the basis of your consent and loaded only after you give it. Withdraw it at any time by clearing this site’s data, which makes the banner ask again.
• Supabase (database hosted in the EU, eu-west-1): stores leaderboard entries and, if you enable them, menu-alert push subscriptions.
• Your browser vendor’s push service (e.g. Apple, Google, Mozilla): if you enable menu alerts, the notification is delivered through the push service your own browser chose. We send it only the alert text, encrypted to your device.
• Stripe, Inc. (USA/Ireland): payment processing.

Where data is transferred outside the EEA (Vercel, Stripe), the transfer is safeguarded by the EU Standard Contractual Clauses and, as applicable, the EU-US Data Privacy Framework. We do not sell personal data or use it for advertising.

5. Retention

• Leaderboard entries: kept while the leaderboard exists, or until you ask us to remove yours.
• Hosting logs: kept for a short period set by the provider (typically up to 30 days).
• Donation records: kept as long as required by tax and accounting law.
• Contest entries: kept while the contest is running and for up to 12 months afterwards, so a served dish can stay correctly credited. Deleted sooner on request.
• localStorage data: stays in your browser until you clear it.

6. Your rights

Under the GDPR you can request access to, correction of, or deletion of your data, restriction of or objection to processing, and data portability, and you can withdraw consent at any time (this does not affect processing that already happened). To have your leaderboard entries deleted, email us your nickname and the approximate date you played. You can also complain to a supervisory authority; in Hungary that is the NAIH (naih.hu).

7. Children

The game is suitable for everyone, but the leaderboard and donations are not directed at children under 16. We do not knowingly collect personal data from children; if you believe a child has submitted data, contact us and we will delete it.

8. Changes

We may update this policy; the date above shows the current version. Material changes will be flagged on the site.

9. Contact

Privacy questions and requests: hello@magicpulpo.com.