Privacy Policy

Last updated: 18.10.2026

1. Controller

spoboo GmbH, Kirchsteig 14, 78647 Trossingen, Germany, represented by the managing director Philip Junge. E-mail: info@spoboo.com (see the legal notice).

2. The essentials in brief

• Couch Clash needs no user account – an account is optional (e-mail address only, no password). Google Ads measures our ads only if you agree in the cookie banner; we use no analytics trackers – we count visits ourselves, only as anonymous daily numbers.
• A game room with names, answers and points is deleted after 24 hours at the latest.
• Photo figures are optional. The photo is deleted after the conversion.
• Payments go through Stripe. We never see card details.

3. Visiting the website and hosting

When you visit the site, our service providers process technically necessary data (IP address, time, browser information) to deliver the page and protect it against abuse. The website is run by Vercel Inc. (USA), the game server and storage by Cloudflare, Inc. (USA). The legal basis is our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR). Both providers are certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.

Visitor counting: to see how many people use Couch Clash and roughly where they come from, we count ourselves – without an analytics service, without a cookie and without storing anything on your device. When you open the website from elsewhere, the page sends our game server at Cloudflare the path of the page, the address of the previous page (we keep only its domain name, e.g. “google.com”) and, if present, the campaign tag from the link. When you join a game room, we count that too. Cloudflare derives the country and region (e.g. the federal state) from the request's IP address; we store only daily counters (“12 visits from Bavaria via Google today”) – no IP address, no device identifier, no name, nothing that can be linked to a person. The counters are deleted after two years. The legal basis is our legitimate interest in understanding and improving our service (Art. 6(1)(f) GDPR).

4. Playing

By “TV” we mean any big screen the game runs on in a browser – smart TV, laptop, PC or projector. Players enter a game name and pick an emoji. In the game room we process name, figure, answers and points to run the game (Art. 6(1)(b) GDPR). The room is deleted after 24 hours at the latest. To improve the questions we store statistics (e.g. how often a question was answered correctly) and a game log with times – both without names and without answer texts; the log is deleted after 180 days. How you liked a game (😴 / 🙂 / 🔥, too short / too long) is stored only as counts per game – not who voted how. The optional feedback page „How was tonight?“ (stars, which game was the most fun, where it dragged, a free text) is stored without names and without a player id to improve the games (Art. 6(1)(f) GDPR); please do not write names or contact details into the text. The text is deleted after 180 days.

Before games for adults run (🔞, e.g. in Party mode), everyone confirms on their own phone that they are at least 18. This answer (yes / no, no date of birth) is kept only in the game room, so the game only starts once everyone has confirmed, and is deleted with it after 24 hours at the latest; it is not sent to any other service. The legal basis is running the game (Art. 6(1)(b) GDPR) and the protection of minors.

In the game „Wer hat schon mal?“ (“Who Has Ever?”) you first answer a few statements with yes or no in secret – in Party mode some of them are very personal. We keep these answers only in the running game room and only as long as they are needed: statements that are not played are discarded right after the confession, each played one after its reveal, and everything is gone at the end of the round at the latest. Others only see how many said yes – names only if the host turns on “Reveal”, and never for 🌶️ questions. The answers never go to an AI, into statistics, the game log or an error report.

“📞 Remote Call” (optional): players at home can switch on a voice channel to the living room on their phone. We then transmit the voices of the devices in the call live through Cloudflare Realtime (Cloudflare, Inc., USA) – encrypted, never recorded and never stored; the service gets the devices’ IP addresses for this, but no player names. The microphone is only used after you allow it in the browser, on the TV only after a click on “Allow microphone”. The legal basis is providing the service you asked for (Art. 6(1)(b) GDPR); you can hang up or mute at any time, and the host can switch the call off. There is no call in the kids’ games.

“Versaut erklärt” – listening (optional): whoever explains can switch on “🎙️ Mithören” on their phone. The phone then uses the browser’s built-in speech recognition to notice whether a forbidden word is said. The speech goes directly from the browser to its provider – Google (Google LLC, USA) for Chrome and Edge, Apple (Apple Inc., USA; partly on the device) for Safari – not through our servers; their privacy terms apply. The phone itself matches the taboo words: the game room only learns whether the phone is listening and which taboo word fell – no text, no recording. The microphone is only used after you allow it in the browser; you can switch it off at any time, without listening it’s the honour system. The phone only remembers that listening was on and tries again the next time you explain. The legal basis is providing the service you asked for (Art. 6(1)(b) GDPR). The game exists only in the 18+ party mode, never in the kids’ games.

“Eat my …” (comeback round): whoever is in last place types a specialty as free text (up to 40 characters, e.g. “Pokémon”). The topic goes to an AI by OpenAI (OpenAI, L.L.C., USA) that checks whether it suits the game mode and writes and double-checks questions about it – without player names. We store the topic together with the questions written, not linked to any person, to review them and reuse them later. In “cache only” mode and in kids’ game rooms nothing goes to OpenAI. The legal basis is providing the service you asked for (Art. 6(1)(b) GDPR); the automatic comeback round can be switched off in the settings.

“🕵️ Secret missions” during the warm-up act: players of “Heckler” send short shouts (up to 60 characters). An AI by OpenAI (OpenAI, L.L.C., USA) rates these texts for wit and originality and – in kids and family mode – whether they may appear on the TV. Only the texts go to OpenAI, under anonymous keys, never player names. The TV shows good shouts with the player name. The texts are kept only in the game room (deleted at the latest 24 hours after the game), not in statistics or game logs. In “cache only” mode and in kids’ game rooms nothing goes to OpenAI – the game then estimates on its own and shows nothing in kids and family mode. The legal basis is providing the service you asked for (Art. 6(1)(b) GDPR); the missions can be switched off in the settings.

Welcome: before the first round the host welcomes everyone by name – for this each TV says whose living room it is in (e.g. “Philipp”), and he greets whoever is on the “📞 Remote Call”. We store the living-room name in the TV’s browser and in the game room (deleted after 24 hours at the latest); for the announcement it goes, like player names, to OpenAI (the host’s text) and ElevenLabs (the voice). The legal basis is providing the game (Art. 6(1)(b) GDPR).

Drawings from „Zeichnen“ (Drawing): we store every drawing as an image at Cloudflare, together with the term, the game name of the person who drew it and the date – so you can see it in the award ceremony and download it via the session's link (room code plus a key that can't be guessed, only for those who were there). In „Picture Post“ every revealed chain lands in the gallery this way: the original, the drawings, the typed guesses and the game names of those who drew; the wildest chain is also shown in the award ceremony. Without an account the drawings are deleted after 7 days. Whoever chooses „Keep in my account“ with the link gets a copy of the evening (images, terms, in Picture Post also the guesses, game names of those who drew, date) in their account; it stays until you delete it or the account (see Account). The legal basis is running the game or the service you asked for (Art. 6(1)(b) GDPR).

„Share my result“ (optional): during the game the room keeps, per player, the questions answered with their own answer and – when the host roasted an answer – his line (text and the audio clip that is stored anyway). Each phone only sees its own answers; everything is gone with the room after 24 hours at the latest. Only when you really share do we store a post at Cloudflare: your game name, your place („place 2 of 6“), exactly the one question you picked with your answer and the solution (or your drawing – in Picture Post your own drawing from a chain with what you meant to draw and whether the next player recognised it), the host's line, the card's picture and – if you leave „My avatar on the post“ on – your figure. Names or answers of other players never appear. The post is visible to anyone with the link (couchclash.com/r/…, not in search engines), is deleted automatically after 90 days and can be deleted earlier from your own phone. Where the link goes is up to you via your phone's share menu – we embed no third party for it. Visitors who guess only send us their answer; we count it without storing it. The legal basis is providing the service you asked for (Art. 6(1)(b) GDPR).

So that we notice when and how much is played, the first game of a room sends us a short message via WhatsApp (through the service CallMeBot) or e-mail: the host's game name (the player on the host phone, else the first player), the room code, how many play, the mode, the planned games and how the room came about (e.g. credit, the trial game or a Spoboo event). Other players' names, answers or contact details are never in it. We store none of it. The legal basis is our legitimate interest in keeping an eye on the game service (Art. 6(1)(f) GDPR).

5. Storage on your device

We store settings, your last used name, access to the game room and – after a purchase – your credit codes (at most 10, to tap them when joining) in the browser (local storage), so you can keep playing after a reload; if you sign in to an account, the device's sign-in key is stored there too. For „Share & recommend“ we add the delete keys of your posts. For rejoining we also set a cookie (cc_player_…, 24 hours). If you come through a partner's link (?ref=CODE) or enter a partner code, we remember that code for 30 days in the browser and in a cookie (cc_ref) so the discount applies when you buy – only the code, nothing about you. Your choice in the cookie banner („Accept all“ / „Only necessary“) is stored in the browser too. Only if you choose „Accept all“ do we also remember for 30 days which of our ads brought you here (see Google Ads). We also remember in the browser which channel the device first came through (e.g. „instagram“ from a campaign link, „google“ as a search engine, the name of a linking website or „gast“ after playing as a guest) – only that name, never the full address. It is sent to us when a game room is opened and with a purchase, so we see which ways lead to game nights; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). So nobody gets the same question twice, the phone remembers the numbers of the questions already played per player name (and the TV for itself) – numbers only, no answers. They go to the game room when joining and are deleted with it. This is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG); no consent is required.

Group memory. So your group gets no question twice, even with new phones or other names, the host's TV or laptop sends its random device ID to our game server. We store only an irreversible hash of it, plus the numbers of the questions played on this device with their date – no names, no answers, no player IDs. An entry is deleted once the question hasn't been played there for 12 months. Counts derived from it (how many fresh questions a group has left) help us write new questions in time. Legal basis: providing the game you use (Art. 6(1)(b) GDPR) and our legitimate interest in a varied game (Art. 6(1)(f) GDPR). If you clear the site data in the TV's browser, it gets a new ID and the old memory can no longer be linked to it.

6. Photo figures (optional)

If you like, you take a selfie that is turned into a cartoon figure. The photo is sent to OpenAI, L.L.C. (USA) for this and deleted after the conversion; we do not store it. The generated figures are stored at Cloudflare and deleted with the game room after 24 hours at the latest. If you “keep the figure for next time”, you find it again only on your own phone – with an optional account (see section 9) on your other signed-in devices too; it is deleted after 365 days without a game and you can delete it yourself at any time. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give before the first photo and can withdraw at any time. Children under 16 please use the photo feature only with their parents' permission.

7. Host and AI features

The host speaks with an AI voice from ElevenLabs Inc. (USA). For this, the texts he says – including your game names – are sent to ElevenLabs. Names spoken once are stored as an audio clip so they sound the same next time; no link to a person or room is stored. Some games have an AI (OpenAI) check or comment on answers; the answer texts are sent for this, and for comments also game names and points. For the “highlights of the evening” in the award ceremony the game room keeps, during the game, each player's most embarrassing wrong answers, the answers the host mocked and answers only one person knew (word for word). At the end up to 14 of them – with the question, game name, the host's line and the winner's score – are sent once to OpenAI, the AI picks at most three; their spoken text goes to ElevenLabs. Never in “Cache only” mode, never in class mode. For the comments on unsolved drawings the term and the guesses (without names) go to OpenAI. In „Draw It Back ✨ Live“ the original and every player's drawing with its likeness go to OpenAI once per picture – without game names (the AI only sees “Player A, B …”); in „Draw It Back“ the TV compares the drawings in its own browser and only numbers reach us. In „Picture Post ✨ Live“ every chain goes to OpenAI once after the last step: the original, all drawings of the chain, the typed guesses and the likeness values – also without game names; in „Picture Post“ everything stays in the room (the TV compares the drawings like in „Draw It Back“). Everything is deleted with the room after 24 hours at the latest. The legal basis is running the game (Art. 6(1)(b) GDPR). The providers process the data as processors or under the EU-US Data Privacy Framework and standard contractual clauses.

Special editions for companies, towns and clubs: for an edition our server fetches the client's website and sends its text to OpenAI to suggest the industry, locations, motto and topics; OpenAI also writes quiz questions from this, from the notes the client enters (“insider info”) and from the chosen topic, as well as terms, columns, statements and puzzles for standard games, which a second AI check reviews for correctness and youth protection. This concerns information about the organisation, not player data; we ask clients not to enter employees' names. The results are stored with the edition until it is deleted. The legal basis is carrying out the order (Art. 6(1)(b) GDPR).

Staff survey of a special edition: through a link from the client, colleagues can give short answers (at most 40 characters per question) for “We asked 100 people”. The survey is anonymous: we ask for no name and no e-mail address and store only the text of an answer – no IP address; on the phone we only remember that it was already answered. For the evaluation we send the answers without any other data to OpenAI, which groups identical answers; this becomes a game board with shares. The client only sees counts and the finished board, never single answers. We delete the answers right after the evaluation, otherwise together with the survey. Please don't write names into the answers. Taking part is voluntary; the legal basis is your consent by sending (Art. 6(1)(a) GDPR).

Stage, song and vouchers of a special edition: for its own show stage and voucher artwork we send the client's keywords, house colours, logo and pictures of our studio or host to OpenAI (image generation); for the edition's song the draft lyrics, written from the information about the organisation, to OpenAI (text). We produce the song itself by hand with Suno (Suno, Inc., USA): we only enter the lyrics and the client's music wishes there (style, mood, names and words wanted, a reference song) – no contact details, no player data. We store the wishes with the order. For personal vouchers the client may give the recipients' names (“For Maria Müller”): we keep these names only until the vouchers' one-time export and delete them then; they are never sent to AI services – the vouchers are drawn in the client's browser. The legal basis is carrying out the order (Art. 6(1)(b) GDPR); the client is responsible for the names, we process them on the client's behalf.

Own host of a special edition: instead of Lenny a real person (e.g. the boss) can host – only with their consent. For this we store the person's name, the date and the signed consent document (only we and the company that sets up its edition itself and uploaded the document can retrieve it), and the host's name and texts in the game. A photo of the person goes to OpenAI together with our host picture (image generation, USA, EU standard contractual clauses), which draws pictures in the Couch Clash style from it; we don't store the photo itself. The drawn pictures are kept by us and shown in this edition's games. For their own voice a voice recording goes once to ElevenLabs (USA, EU standard contractual clauses), which creates a voice from it (Instant Voice Clone); we don't store the recording, the created voice sits in our ElevenLabs account. The host speaks the game's lines with it, and we keep those lines like all host lines. When we delete the host, we delete the pictures, the consent, the voice at ElevenLabs and the lines spoken with it. If an edition is not extended after its runtime, it is archived; 30 days later we delete the host automatically. Legal basis: the person's consent (Art. 6(1)(a) GDPR), which they can withdraw at any time with the client or with us; for carrying out the order, performance of the contract (Art. 6(1)(b) GDPR).

8. Music and product pictures

In the music games the TV loads previews directly from Deezer or Apple (iTunes) – and so does a phone on which you switched on “Sound on this phone”. These providers receive your IP address (Art. 6(1)(f) GDPR).

The product pictures in “Price (Pi)rates” come from Open Food Facts, Open Beauty Facts and Open Products Facts (licence CC BY-SA). We download them once and serve them from our own servers (Cloudflare) – your device fetches nothing from Open Food Facts, and we send them no data about you.

The adults-only party game “Hot Prices?” shows products from ORION (Orion Versand GmbH & Co. KG), loaded every night from the product feed of the affiliate network Awin (AWIN AG, Berlin). Your TV or phone loads the product pictures directly from Awin’s or ORION’s servers, which receive your IP address and technical browser data (no referrer). Legal basis: our legitimate interest in offering the game with current products (Art. 6(1)(f) GDPR). At the reveal, products in stock show a link marked as an “ad” (“View at ORION”, a QR code on the TV). If you use it, we only store the product, the room code, the device (phone or QR code) and the time – no IP address, no name – and forward you via Awin to ORION; from there, Awin’s and ORION’s privacy notices apply (e.g. tracking cookies for the commission). Awin only sends us commission data with no link to you. For the automatic product selection, product names, descriptions and pictures (no data about you) are sent to OpenAI.

9. Purchase and payment

Payments are processed by Stripe Payments Europe, Ltd. (Ireland); depending on the payment method, PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) is also involved. You enter payment details directly at Stripe; we only receive the e-mail address, the amount, what was bought and the payment status. We store the purchase to unlock your credit and send you your codes and the link to your order (Art. 6(1)(b) GDPR), and keep invoice data for the statutory periods (Art. 6(1)(c) GDPR in conjunction with the German Commercial Code and Fiscal Code). We send the e-mail with the link via Resend, Inc. (USA).

Invoice: for the correct VAT, Stripe only asks for your country (and, depending on the country, your postcode) in the checkout; if you buy as a business you can enter your company name, billing address and VAT ID there. Stripe calculates the tax from this (Stripe Tax), checks a VAT ID with the responsible authorities (EU numbers via the EU Commission's VIES system), creates a customer record at Stripe for this and issues the invoice – and a credit note if a purchase is refunded. This data stays at Stripe; we only fetch the invoice when you open it with the „Download invoice“ button. Legal basis: performing the contract and our legal duty to issue invoices and charge the correct tax (Art. 6(1)(b) and (c) GDPR); it is kept as required by commercial and tax law (§ 257 HGB, § 147 AO).

Credit and vouchers: credit you buy sits on a code. We store the code only as an irreversible hash with its last characters; in plain text it only sits with your order (available through the secret link of the confirmation page and in the e-mail) and – if you add it there yourself – in your account. For each code we store the credit, its origin, its status and how much of it was used on which evening (player-minutes per price tier and room code – no names). So that a new game room on the same evening continues the discount, we link the evening to the random device ID of the host device (at most 6 hours back). The game room knows who pays for whom; amounts are only shown to the host and to each player for their own code. If a code runs empty and someone takes over, everyone in the game sees their player name. To stop anyone from guessing codes, we count attempts per shortened checksum of IP address and browser (not the IP address itself) and delete it after one day. The PDF and pictures of the vouchers are made in your browser. If we raise the rates, we e-mail account holders beforehand (via Resend). Legal basis: performance of the contract (Art. 6(1)(b) GDPR), the statutory retention periods for purchase data (Art. 6(1)(c) GDPR) and our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

Own design with AI: if you bought a voucher with „Eigenes Design mit KI“ (own design with AI), you describe your motif on the order page after paying. Your wish and – if you upload one or pick your saved figure – a photo or the figure go to OpenAI (image AI, USA, EU standard contractual clauses) together with our host picture, which paints suggestions from them. Before that, OpenAI's moderation service checks the wish, the dedication and the photo for content that is not allowed (such as nudity or violence). We don't store the photo; it is only sent for this check and this one call. Only upload a photo of people if you have the right to and the people shown agree (for children, their parents) – you confirm this with a tick. We store the wish, the dedication and the suggestions with the order; the pictures sit at a random address nobody can guess. When you choose a motif, we delete the other suggestions at once, otherwise after 30 days. The chosen motif and the dedication are printed on the vouchers (for „Zusenden“ we print the motif on the card) and shown when someone redeems the code – also as a greeting on the TV when the code is redeemed in a game. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and, for the people shown, their consent (Art. 6(1)(a) GDPR), which you obtained.

Gift set by post: if you choose „Geschenkset zusenden“ (gift set by post), you don't need an account. We store the delivery address (name, optional addition, street, postcode, town, country) with the order to print and post the gift set – for several vouchers sent straight to the recipients, each recipient's address. Only if you are signed in and tick „Adresse in meinem Konto merken“ (keep the address in my account) do we also store your address in your account, so you don't have to type it again. We delete the addresses from the order 90 days after shipping; in your account it stays until you change it or delete the account. The address goes to the postal or parcel service that delivers the item; a tracking number is stored with the order and sent to you by e-mail (via Resend). We notify ourselves of a new order (e.g. by WhatsApp via CallMeBot or ntfy) – without name or address. You don't see the gift set's code; it is only on the card and valid from shipping. Legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).

Account (optional): if you like, you can create an account at /konto so your own codes come along on every device. For this we store your e-mail address, when the account was created and last used, which credit codes you added yourself belong to it, which drawings you kept (a copy at Cloudflare, at most 50 evenings; like the gallery, the images can only be reached through a link that can't be guessed, the list only when signed in), your photo figures (every figure you make while signed in, at most 12; stored at Cloudflare as above and deleted after 365 days without a game), the name and avatar from the join form (emoji or self-built face – only the chosen parts such as hairstyle or glasses, no image), kids' profiles if you create any (a name for each child – a nickname is enough – and its avatar, at most 8; no photo, no age), your favourite games and which devices are signed in (only as a checksum of a random key kept in the browser). You sign in without a password via a link by e-mail; only your address and the link go to Resend, Inc. (USA). The link works once for 15 minutes. So nobody gets flooded with links, we keep a shortened checksum of IP address and browser (not the IP address itself) with each requested link and delete it with the link after one day at the latest. The legal basis is providing the service you asked for (Art. 6(1)(b) GDPR). You can delete single evenings, single figures, single kids' profiles and the whole account yourself at any time at /konto – the kept drawings and figures go with the account; your credit codes keep working (we keep purchase data as described above). A device unused for 180 days is signed out. After 24 months without signing in we send you a reminder; if nobody signs in within 30 days, we delete the account.

Company account and free preview for companies: whoever creates a preview of their own edition on /firmen/vorschau signs in by e-mail link like for the account (which confirms the address) and adds details about the company to the account: the contact's name, the company (or town, club), website, size, role and – optionally – a phone number. We only ask for these in this flow, never for a normal account. Our server reads the given website (public pages only) and sends its text to OpenAI (USA, EU standard contractual clauses) to create the preview; no personal details from the account go to OpenAI. We keep the previews with the account. We notify ourselves of new contacts, previews and requests for an offer by e-mail (via Resend) or by a push message without personal details. We use the details to show the preview and, on your request, to advise you and make an offer (Art. 6(1)(b) GDPR, pre-contractual steps); we don't send you advertising for it. Everything is deleted with the account (possible any time under /konto, otherwise after 24 months without use) or on a short message to us.

Personal advice for companies: with the form „Persönliche Beratung anfragen“ on /firmen you can write to us without an account. We then store your name, e-mail address, company (or town, club), website, size, role, – optionally – a phone number and your message with our host Cloudflare and notify ourselves by e-mail (via Resend) or by a push message without personal details. So nobody floods the form, we keep a shortened checksum of IP address and browser (not the IP address itself) with each request. We only use the details to advise you on your request and make an offer (Art. 6(1)(b) GDPR, pre-contractual steps); we don't send you advertising for it. We delete the request after one year, or earlier on a short message to us.

Company menu (ordering a special edition): if you order a special edition yourselves, we store the billing details with your account – company, optionally a contact person, address, country, optionally the VAT ID and the e-mail address for invoices – as well as your editions, booked modules and orders. We pass the billing details and VAT ID to our payment provider Stripe (Stripe Payments Europe Ltd., Ireland), which handles the payment, bills the runtime, writes the invoices and sends them by e-mail, and checks an EU VAT ID against the EU's VAT Information Exchange System (VIES). Through our e-mail service Resend we write only to the e-mail address of the account that created the edition: when playtime codes are ready, when the edition goes live, shortly before a runtime that won't renew ends and when the edition has been archived – with the edition's name and links to the company menu. Legal basis: performance of the contract (Art. 6(1)(b) GDPR); invoices and booking records are kept as long as commercial and tax law requires (Art. 6(1)(c) GDPR, § 257 HGB, § 147 AO).

Vouchers from your company by e-mail: if a company (e.g. your employer) sent you a voucher for its special edition by e-mail, it gave us your e-mail address and possibly your name for that. The company is the controller then; we process the details only on its behalf (Art. 28 GDPR), to send you the code and to show the company whether the e-mail was delivered, bounced or marked as spam by you – we don't track whether you open it or click links. We send the e-mail via Resend, Inc. (USA, EU-US Data Privacy Framework and standard contractual clauses). We delete the address, the name and which code it got 30 days after sending; only the number of e-mails sent stays. For access, objection or deletion, contact the company – or us, and we pass it on.

Offers and invoices for companies: for an offer for a special edition we store the company details the company gives us for it – company name, address, optionally a contact person, e-mail address and VAT ID – together with the offered items and prices. The details stay with us and are not passed on to anyone. Legal basis: pre-contractual steps and performance of the contract (Art. 6(1)(b) GDPR); accepted offers and invoices are kept as long as commercial and tax law requires (Art. 6(1)(c) GDPR, § 257 HGB, § 147 AO); offers not accepted are deleted on a short message to us.

Signing in with Spoboo (optional): instead of an e-mail link you can sign in with your account at Spoboo, a product of spoboo GmbH – and the other way round at Spoboo with your Couch Clash account. This only happens when you tap the button for it and confirm on the other side. A short-lived, signed link (2 minutes, valid once) carries only the confirmed e-mail address and the account's id on the other side – no names, no scores, no purchases. If you sign in here with Spoboo, we store the address in your account and the Spoboo id as the link (deleted with the account). So a link works only once, we keep a hash of its id for a day. The legal basis is providing the service you asked for (Art. 6(1)(b) GDPR). Spoboo and Couch Clash each have their own profile picture; nothing is matched automatically. If you want one of your Couch Clash figures as your picture at Spoboo, you pick it here at /konto/avatar-spoboo – only then does Spoboo get exactly that one picture (through a one-time code valid for 2 minutes), no other figures and no other data. The legal basis is your consent (Art. 6(1)(a) GDPR) by picking it.

Recommendations: share and recommendation links simply lead to Couch Clash, without a referral code. We do not store who recommended whom, and there is no discount or reward for it. For our statistics we only count events (shared, viewed, guessed, free round clicked) – without IP address, without personal reference, without third-party tracking. The legal basis is our legitimate interest in anonymous counting (Art. 6(1)(f) GDPR).

Partner programme: some partners (e.g. creators or clubs) have their own code and link. If you play with it, your game room gets a discount and the partner earns a commission on those purchases. For this we keep with the game room which partner code applies and store with every such purchase: partner, room ID, package, list price, discount, amount paid (gross and net), payment method, commission and its status – no names, no e-mail addresses of buyers. The partner learns nothing about you and only receives totals from us for their statement. The purchase screens in the room show “recommended by” with the partner's name. About our partners themselves we store name, code, terms and – for credit notes and bookkeeping – optionally e-mail address, postal address and whether they are a small business. Legal basis: performing the discounted purchase (Art. 6(1)(b) GDPR), for partners the partner agreement (Art. 6(1)(b) GDPR) and the statutory retention periods for accounting data (Art. 6(1)(c) GDPR in conjunction with German commercial and tax law).

10. Help and bug reports

You can write to us via „Help“ or „Report a problem“. We store your message, the topic you chose and – optionally – your e-mail address so we can reply. Technical details for troubleshooting are included automatically: room code, game phase and game, app version, browser, screen size and the latest error messages and events on the device – no player names and no answers. If the page crashes, we send the error text with the same technical details (without a message and without an e-mail address) even without your report. Everything is stored at Cloudflare; we send replies via Resend. We are notified of a new report by e-mail and short message – the short message only contains the topic, room code and report number, never your message or e-mail address. To fix bugs, we may copy the content without the e-mail address into our non-public development system (GitHub, Inc., USA). If you would like your money back, we refund via Stripe. The legal basis is handling your request (Art. 6(1)(b) GDPR) or our legitimate interest in a bug-free service (Art. 6(1)(f) GDPR). We delete reports after 12 months and automatic error reports after 90 days.

11. Game nights via Spoboo

When a host plans a game night in the Spoboo app (also spoboo GmbH), Spoboo sends us for that evening: date, mode, language, whether it is public or private, and for every invited person an identifier, the display name, their reply and whether they come over or play from home. From this we create a reserved room code and a personal join link for every invited person. We don't receive or store the host's name or any addresses. When someone joins the game, we tell Spoboo the game name, the time and – for invited people – their identifier, so the host sees in the event who is in. After the game we send Spoboo the ranking (game names, points and – for invited people – their identifier) so it appears in the event. The legal basis is running the game night you arranged via Spoboo (Art. 6(1)(b) GDPR). The data is stored at Cloudflare and deleted 30 days after the date. On the phone we remember the invitation for the room (local storage) so you get back in after a reload. With a game night's group link (e.g. shared in a WhatsApp group) you can also sign up yourselves: we then store the name you enter and whether you come over or play from home, create your personal link and tell Spoboo about the sign-up so you appear in the event. For kids' events a first name or nickname is enough. While you wait for the start on the waiting page of your personal link, we note when it last checked in; from this the host only sees how many people are waiting right now.

Funny profile picture for Spoboo (optional): If you have Spoboo create a profile picture in the Couch Clash style, Spoboo sends us your photo; we have OpenAI, L.L.C. (USA) draw the character from it and hand the picture straight back to Spoboo. We store neither the photo nor the picture and learn no name or identifier of the person. The legal basis is the consent you give in Spoboo before creating it (Art. 6(1)(a) GDPR).

Company events (Couch Clash Business): At a company event many teams play at the same time. You join through the link or the QR code on your table without an account – only with a nickname, a figure and, if you like, a group code (so colleagues end up in the same team). We store this with the event (Cloudflare) to put you into teams and to show the counter of people present; plus which questions your team played and when they began (to check that every team played the same). Legal basis: running the event your employer invited you to (Art. 6(1)(b) and (f) GDPR). An event is deleted 30 days after it was created, the game rooms as always after 24 hours. On the phone we remember your place in the event (local storage) so you get back in after a reload. The stage screen shows the nicknames of the best (when the individual ranking is on) and of the players in the semi-final and final; only there does the host speak, and he may read out nicknames (ElevenLabs, see section 7).

12. Kids' games and spelling words

In the free kids' games the host only says lines that are already stored – nothing goes to an AI service during the game, and there are no photo figures. For „Spelling words“ you can create your own word lists. We store the list's name, the words and the settings (seconds per letter, round length) at Cloudflare, plus a hash of the secret key of the device the list belongs to – no name, no e-mail. When you save, new words are sent to ElevenLabs once so they can be read aloud; we store the pronunciation without any link to your list and reuse it for the same word. Please don't enter names or other personal details as spelling words. The legal basis is providing the feature you use (Art. 6(1)(b) GDPR). A list that was neither played nor changed for a year is deleted automatically; you can delete it yourself at any time. A child's results (which words they got, which spellings were off) are stored only on the child's phone (local storage), not on our servers.

In kids mode and the kids' games a child types a game name like everyone else (a nickname will do) and builds its figure from fixed building blocks (hair, freckles, glasses … – no photo) or picks an animal. It also taps its age (4 to 12+) and its school year (nursery, pre-school, 1 to 6). We keep the game name, figure, age and year only in the running game room at Cloudflare – every screen of the room shows them so the games fit the children – and delete them with the room after 24 hours at the latest. Age and year go to no other service and not into statistics or game logs; the game name is handled like every player name (see above), no account needed. Your phone remembers the children who played on it (local storage) so next time they just tap – with „✕“ you can make it forget a child at any time. The legal basis is running the game (Art. 6(1)(b) GDPR).

In „Maths & German“ everyone picks their school year (1 to 6) or „grown-up“ on their phone. We keep the level only in the running game room so everyone gets fitting tasks; the TV never shows it. Your phone remembers the level you picked last (local storage) so it is preselected next time. When the host comments a task live, the AI (OpenAI) only learns whether a player name belongs to a child or a grown-up – never the school year and never the task. In the free kids' games not even that goes to an AI. The legal basis is running the game (Art. 6(1)(b) GDPR).

In class mode the teacher sees an evaluation after a round. Individual results with names are shown only on the teacher's own screen (not on connected TVs) and are not stored anywhere; a CSV download or printout is made only on the teacher's device. If the teacher creates a „Link to the results“, we store only the anonymous class overview at Cloudflare – per task how many children got it right, the most common mistake (only when at least two children wrote it the same way) and the mistakes per spelling pitfall or times-table row; no names, no identifiers of the children. Anyone with the link can open the overview. We delete it automatically after 30 days. The legal basis is providing the feature (Art. 6(1)(b) GDPR).

13. Google Ads (measuring our ads, only with consent)

We advertise in Google Search. To see which ads pay off we use Google Ads conversion tracking by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google“) – only if you choose „Accept all“ in the cookie banner. Without your consent we load no script from Google, no Google cookies are set and nothing goes to Google.

With your consent the page loads the Google tag (gtag.js). It sets cookies (e.g. _gcl_au, _gcl_aw, up to 90 days) and tells Google when, after a click on one of our ads, a trial round starts or a purchase is completed – with the amount, the currency and an id of the purchase (the Stripe order number), no names, no e-mail addresses, no payment details. Technically Google receives your IP address and browser information and may link the measurement to your Google account if you are signed in there. We use Google Consent Mode (v2): the default is „denied“, only your consent switches the measurement on.

With your consent we also remember for 30 days in the browser which ad brought you here (campaign, ad group, search term and the click id gclid from the link) and store these details with the order when you buy (with us and in the metadata at Stripe), so we can match revenue and ad. Without consent only the campaign and search term from the ad's link go along while you stay on the page – not the click id, and nothing is stored in the browser.

Google may also transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework, and the EU Commission's standard contractual clauses apply as well. For the conversion measurement we and Google are joint or separate controllers (Google Ads Controller-Controller Data Protection Terms). More from Google: policies.google.com/privacy. Legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw it at any time via „Cookie settings“ at the bottom of every page; we then delete the stored ad and the Google cookies in the browser.

14. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time. Just write to info@spoboo.com. You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

No automated decision-making or profiling takes place.