Privacy notice

1. Who is responsible

The controller for the personal data processed on aquinium.com is Aquinium, a company registered in Denmark (CVR 38124382), Vesterbro 23, 5000 Odense C, Denmark. Contact: ulrik.nash@gmail.com.

2. What data we collect

Account data: first and last name, email address, username, password (stored only as a one-way hash), gender, year of birth and, if you upload one, a profile photo. For players under 13: a parent or guardian’s email address and when they agreed. Lab accounts created by us have placeholder details and a one-click sign-in link.
Gameplay data: for every round, the stimulus you saw, your estimate, your trade volume, your role, the price, your profit and ratings, whether the opponent was a person or a computer opponent, and whether it was a training round.
Timings: how long each decision took (in milliseconds), how long you waited for an opponent, whether you disconnected, and when each round was played.
3D view traces: when the stimulus is an interactive 3D object, we record how you rotated and zoomed it during the judgment: about ten samples per second of the viewing angle and zoom level, plus the number of drag gestures and key presses. No video, camera, microphone or screen recording is involved.
Agreement records: which version of the player information you agreed to and when, and when you asked to delete your account.
Technical data: your IP address and the sign-in name you typed are counted for 15 minutes after a failed sign-in, to block password guessing. Our hosting provider keeps server logs with IP addresses and requested pages for security and troubleshooting.

Other players see your username, profile photo and ratings on leaderboards and as an opponent (except in anonymous rounds). We don’t use third-party analytics, advertising or tracking tools: our own analyses run on the gameplay data above, on our own servers.

3. Purposes and legal basis

Purpose	Legal basis
Running your account and the game: sign-in, matchmaking, scores, ratings and leaderboards	Providing the service you signed up for (contract, Art. 6(1)(b) GDPR)
Improving Aquinium and product analytics: analysing how players play (decision times, view traces, results) to improve the game, its opponents, stimuli and difficulty	Our legitimate interest in developing our service (Art. 6(1)(f) GDPR). We use a code instead of your name or email, and you can object at any time.
Security: preventing abuse and password guessing, server logs	Our legitimate interest in a secure service (Art. 6(1)(f) GDPR)
Parent or guardian agreement for players under 13	Required by Art. 8 GDPR and § 6(2) of the Danish Data Protection Act (Databeskyttelsesloven)
Keeping a record of what you agreed to and of deletion requests	Our legitimate interest in being able to document how we handle your data (Art. 6(1)(f) GDPR) and our accountability duty (Art. 5(2) GDPR)

We do not make automated decisions that have legal or similarly significant effects on you, and we do not sell your data.

We don’t share your personal data with third parties other than the service providers below, which store and process it in the European Union (Frankfurt, Germany) on our instructions under data processing agreements:

Fly.io (Fly.io, Inc.): hosts the application servers.
Supabase (Supabase, Inc.): database and file storage (stimuli and profile photos; profile photos are publicly accessible by their address).
Upstash (Upstash, Inc.): short-lived real-time data in Redis, such as the matchmaking queue, messages between servers and failed sign-in counters.

These companies are based in the United States. Where they could access data from outside the EU, the transfer is covered by the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses. We would only disclose data to others if the law requires it.

5. How long we keep it

Your personal data (account details, guardian email, and gameplay linked to your account): for as long as your account exists.
When you delete your account, we anonymise it within one month: your name, email, username, password, photo and guardian email are overwritten, your year of birth is rounded to the decade, and you are signed out everywhere.
Your game rounds are kept indefinitely, in anonymous form. Once your account is anonymised, the rounds can no longer be linked to you, so they are no longer personal data. We keep them so that other players’ results, ratings and history stay correct, and to improve the game.
Backups: database backups are kept for up to 30 days and then deleted, so deleted data may remain in a backup until then.
Failed sign-in counters: 15 minutes. Hosting logs: as set by Fly.io, typically a few weeks.

6. Children

You must be at least 10 years old to play. In Denmark, children under 13 cannot agree to online services on their own (§ 6(2) of the Danish Data Protection Act), so a parent or guardian must agree for players under 13. We ask for their email address and their confirmation when the player signs up. We check age from the year of birth only, and we don’t verify the guardian’s identity. If you are a parent and believe your child is playing without your agreement, write to ulrik.nash@gmail.com and we will delete the account.

7. Your rights

You have the right to:

access the data we hold about you and receive a copy in a common format (portability);
have inaccurate data corrected (most account details can be changed in your account settings);
have your data deleted: request this in your account settings or by email;
have its processing restricted;
object at any time to processing based on our legitimate interests, including product analytics.

Parents or guardians can exercise these rights for players under 13. Write to ulrik.nash@gmail.com and we will reply within one month.

8. Cookies

Aquinium sets only cookies that are strictly necessary for the site to work, so we don’t ask for cookie consent and there is no cookie banner:

Cookie	Purpose	Duration
aquinium_session	Keeps you signed in (a signed token with your account id).	7 days, or until you sign out
aquinium_machine	Routes the live game connection to the same server; only sent with game connection requests.	Until you close the browser

We don’t use analytics, advertising or third-party cookies, and fonts are served from our own servers.

9. Contact and complaints

For questions about this notice or your data, contact Aquinium at ulrik.nash@gmail.com. You can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk), or to the supervisory authority in the EU country where you live or work.