Privacy Policy

Last updated 2026-10-02

This policy explains what personal data the browser game Nothing 2 Lose at nothing2lose.eu collects, why, and what your rights are under the EU General Data Protection Regulation (GDPR). We collect as little as we can: no ads, no analytics, no trackers.

Controller: Erik Čermák, Czech Republic (an individual developer)

Contact: erikcermak1407@gmail.com

1. Playing as a guest

You can play without an account. As a guest, your progress and settings stay in your own browser (localStorage / IndexedDB) and are never sent to us. Clearing your browser data deletes them.

2. What we store when you create an account

Data	Why
Username	Your name in the game and in multiplayer rooms.
Email address	To log in, verify your account and reset your password.
Password hash	To check your password. We never store the password itself. Accounts that only use Google sign-in have no password.
Google account ID, email and "email verified" flag	Only if you choose "Continue with Google", to link and log in to your account (see section 3).
Game progress / profile	To save your progress (unlocks, stats, loadouts) so you can play on any device.
Session tokens	To keep you logged in. Stored on our side only as a hash; expire automatically.
Login security data	A failed-login counter and a temporary lock time, to protect your account from password guessing.

Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR) for running your account, and our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR) for abuse protection.

3. Sign in with Google

If you choose "Continue with Google", Google shares your basic profile with us. We request the scopes openid, email and profile, but we only use and store your Google account ID, your email address and whether Google has verified that email. We do not store your name or profile picture, we do not access any other Google data, and we never sell or share Google user data.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google's own handling of your data is covered by the Google Privacy Policy. You can remove our access at any time in your Google account under "Third-party apps & services".

4. Emails

We send only two kinds of email: account verification and password reset. They come from our own mail server. We use no mailing lists, no newsletters and no third-party email provider.

5. IP addresses and logs

Your IP address is used only in memory for rate limiting and abuse protection, and is not written to disk. Our web server logs keep no IP addresses and no query strings. Game server logs contain no IP addresses, tokens, player names or chat text.

6. Multiplayer and chat

When you join a multiplayer room, your username, your in-game actions and your chat messages are sent live to the other players in that room. We do not store or log chat messages.

7. Cookies and browser storage

We set one first-party session cookie (HttpOnly) when you log in, so the game knows it is you. It is strictly necessary and needs no consent. The game also uses your browser's localStorage / IndexedDB for settings and guest progress. There are no third-party cookies, no ads, no analytics and no trackers.

8. Who else gets your data

Hosting: our own server rented from Skrime in Germany (EU). The hosting provider runs the hardware only and processes data on our behalf.
Google: only if you choose "Continue with Google" (section 3). Google may process data outside the EU under its own safeguards.

Nobody else. We never sell your data.

9. How long we keep it

Account data and game progress: until your account is deleted.
Unverified accounts, expired sessions and expired verification / reset links are purged automatically.
IP addresses: only in memory, for as long as a rate limit needs them.

10. Your rights

Under the GDPR you have the right to:

access the data we hold about you,
correct inaccurate data,
delete your account and data,
export your data in a portable format,
object to or restrict processing based on legitimate interest,
complain to a data protection supervisory authority, in particular in the EU country where you live, or with the Czech Office for Personal Data Protection (ÚOOÚ).

To delete your account or use any of these rights, email erikcermak1407@gmail.com from the address linked to your account. We answer within one month.

11. Children

Nothing 2 Lose is not directed at children under 13, or under 16 where national law requires it. Children below that age should not create an account. If you believe a child has given us personal data, contact us and we will delete it.

12. Security

All traffic uses HTTPS. Passwords and tokens are stored only as hashes, and access to the server is restricted.

13. Changes

If this policy changes, we update the date at the top. Important changes will be shown in the game.