The game CoCo

Privacy Policy

Last updated: 26 September 2026

The short version

CoCo needs no account. You play without signing in, and your progress stays on your device. Personal data leaves your device only when you tap SUBMIT at the end of a round — then we send the name, the score, the duration and a screenshot of that round to the leaderboard. You can delete an entry yourself in the game at any time. There is no advertising, no analytics and no tracking SDK in the game.

1. Controller

The controller for the processing of personal data within the meaning of the GDPR is:

Judith Perl – Sole Proprietorship
Josef-Steinberger-Weg 17
8054 Graz
Austria
Email: gaistnet@gmail.com

If you have questions about this policy or about your data, write to that address at any time.

2. What stays on the device

CoCo stores the following only locally, in your device's app preferences (PlayerPrefs):

the player name you last entered,
the code by which you recognise your leaderboard entry,
your local high scores (the scores of your own rounds),
the selected game mode,
whether you have already seen the explanation screen.

We do not transmit any of this. You remove it by clearing the app's data or uninstalling CoCo. Whether a backup of your device (for example Google Backup) includes it depends on your system settings.

3. What goes to our server

CoCo talks to exactly one server: gaistnet.com. There is no other destination.

When	Where to	What is sent
When a round starts	`/api2/run/start`	the selected game mode. As a technical matter, the server sees your IP address.
When the leaderboard is shown	`/api2/top`	the query itself only (mode, number of places). As a technical matter, the server sees your IP address.
Only when you tap SUBMIT	`/api2/run/submit`	the name you typed, the score, the duration in seconds and a screenshot of the finished round.

Nothing else. So the app already connects to the server while you play, not only when you submit — but nothing about you is sent then, only the game mode.

About the IP address

The IP address is not stored with your leaderboard entry. The leaderboard service uses it only transiently, in memory and in salted hashed form, to count how many requests arrive from the same connection in quick succession (protection against overload and mass submissions). That counter is discarded when the service restarts and is never written to disk. In addition, as with any web server, connection logs are produced (see section 7).

4. The name you enter

The name field is free text — you decide what goes in it. The game says so right at the field: nickname, not your real name. The name appears publicly in the leaderboard and is visible to everyone playing. Please use a nickname rather than your real name, and nothing else that identifies you (no email address, no phone number). We remove entries that are abusive or that obviously contain other people's personal data.

5. The screenshot

When you submit, CoCo sends an image of the playfield at the end of the round. It shows the game content only and serves to make the result verifiable. The image is stored with the leaderboard and may be shown there together with your entry. It is produced inside the game; CoCo accesses neither your camera nor your photos for it.

6. Purposes and legal bases

Leaderboard entry (name, score, duration, screenshot) — purpose: publishing your result in the leaderboard. Legal basis: your consent, Art. 6(1)(a) GDPR. You give it by tapping SUBMIT; without that tap nothing is transmitted.
Showing the leaderboard and operating the game — purpose: providing the function you asked for. Legal basis: legitimate interests, Art. 6(1)(f) GDPR.
Protection against abuse and overload (transient hashed IP counter, connection logs) — purpose: security and stability of the service, protecting the leaderboard against manipulation. Legal basis: legitimate interests, Art. 6(1)(f) GDPR.

7. Retention

Leaderboard entries: until you delete them — in the game itself or by asking us (see section 8). Only the best results are kept per mode; older, weaker entries drop off the list over time and are deleted together with their screenshot.
Rounds in progress: records of rounds that were started but never submitted expire automatically and are deleted shortly afterwards.
Web server connection logs (IP address, time, requested address): only for as long as operation and security require. They are not linked to your entry, not analysed and not passed on.
Hashed IP counter: in memory only, at most until the service restarts.

8. Deleting an entry

When you submit, the server generates a code which the app stores on your device. That code is your handle on the entry — we store nothing else that could show the entry is yours.

In the game

As long as the code is on your device, the start screen shows your entry and, next to it, Delete entry. Tapping it removes the row from the leaderboard and the screenshot file from the server, immediately and without asking us. The app then deletes the code from your device as well: it would be worthless.

If the code is gone

If you reinstalled the app, cleared its data or changed device, the code is gone and the button in the game can no longer find your entry. In that case write to gaistnet@gmail.com and give the name, the mode and the score (a screenshot of the list helps) — we will delete the entry by hand. The same applies if the name you chose now feels too personal. You need no account for this, and we do not ask for a copy of any ID.

9. What CoCo does not do

no advertising, no advertising ID, no profiling,
no analytics or crash-reporting services (Unity Analytics, Ads, Purchasing and Cloud Diagnostics are disabled in the project),
no user accounts and no sign-in,
no access to location, camera, microphone, contacts or files,
no device or installation identifiers that we store,
no sharing or selling of data to third parties, and no automated decision-making.

10. Recipients and hosting

The leaderboard runs on a server operated by us in a data centre in the European Union; the hosting provider processes the data on our behalf (Art. 28 GDPR). Beyond that we do not pass the data on unless we are legally obliged to. No transfer to third countries takes place.

Distribution of the app through Google Play is handled by Google; which data Google processes as its own controller (for instance about installation and account) is set out in Google's privacy policy. We have no influence over that.

11. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw consent at any time with effect for the future (Art. 7(3)) — for a leaderboard entry the delete button in the game or a message to us is enough, see section 8. To exercise your rights, contact the address in section 1.

Because we store nothing about an entry beyond name, score, duration, screenshot, timestamp and code, we can only answer requests on the basis of those details — in particular, we cannot link an entry to a person or a device.

12. Right to lodge a complaint

If you believe the processing of your data infringes the GDPR, you may lodge a complaint with a supervisory authority. In Austria that is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42
1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at · www.dsb.gv.at

13. Children

CoCo is not directed at children under 13. We do not knowingly collect data from children. If we learn that a leaderboard entry came from a child without the consent of a parent or guardian, we delete it.

14. Changes

We update this policy when features of the game or legal requirements change. The current version is always available at this address.