1. Who processes your data
The personal data controller is FAIRPLAY APPS DOO (ul. Železnička 20, Novi Sad, 21102, Serbia); [email protected].
The controller runs the VOG board game club: the websites vogclub.com and vogclub.games, the Windows client and the mobile apps (the "Service"). The vogclub.ru website operates under its own documents published there.
Personal data questions: [email protected] or [email protected].
This policy is based on the Law on Personal Data Protection of the Republic of Serbia ("Official Gazette of RS", No. 87/2018; the "Law"). The Russian version of this policy prevails.
2. Who this policy applies to
It applies to everyone whose data the Service processes: registered players, guests playing without an account, website visitors, and people who contact us through the feedback form.
The Service is intended for persons over 14 years old. By registering you confirm that you are at least 14. If we learn that an account was created by someone under 14, we close it and delete the data.
3. Club data before 2026
The VOG club has been running since 1997. The controller of the club's data is the company named in section 1. Accounts, game history and ratings accumulated by the club earlier continue to be processed for the purposes and in the manner described in this policy. If you do not want your earlier data to be processed, delete your account in your profile or write to [email protected].
4. What data, why, and on what basis
We collect only what a specific purpose requires. We do not process phone numbers, passport data, special categories of data (health, beliefs, etc.) or biometric data.
| Purpose | Data | Basis |
|---|---|---|
| Account and sign-in | email address; nickname; profile picture; when signing in with Google, GitHub or Telegram — your identifier and name at that service; IP address, browser details, country and city derived from the IP; passkeys and second-factor methods, if you enabled them | performance of our contract with you — the Terms of Use (Art. 12 of the Law) |
| Playing | nickname; games, their moves and results; ratings; tournament participation; answers and progress in lessons; settings | performance of the contract |
| Profile and communication | information you add to your profile yourself (name, gender, date of birth, country, about you); friends and following; room and table chat messages; private messages; reactions to news | performance of the contract |
| Security and rule enforcement | IP address, country and city derived from it, browser details next to sign-ins and chat messages; sign-in log; restrictions for rule violations; history of nickname and email changes | legitimate interest of the controller and users in protecting the Service (Art. 12 of the Law) |
| Answering requests | name or nickname, email address, request text | performance of the contract; for requests without an account — your request |
| Club news emails | email address | your consent (separate checkbox; withdraw in settings) |
| Gravatar picture | hash of your email address | your consent (enabled in your profile when the option is available) |
| Service statistics | account number, time and duration of visits, country and city derived from the IP | legitimate interest of the controller |
| Technical support | IP address, browser details, client installation identifier, error and crash information | legitimate interest of the controller |
| Mobile app notifications | device notification identifier | your permission in the app |
Service emails — sign-in codes, access recovery, sign-in alerts — are sent regardless of the news email consent: the account cannot be used without them.
5. What other players see
Other players see your nickname, profile picture, ratings, games played and messages in public chat. Your profile is visible within the visibility settings you choose. Your email address, IP address and sign-in log are never shown to other players.
6. Cookies and browser storage
The websites use only cookies they cannot work without: signing in, interface language, marks of news you have seen and the catalog view you chose. There is no third-party analytics and no advertising cookies. Game settings and unfinished guest games are kept in browser storage on your device. Sign-in pages and the feedback form use Cloudflare Turnstile bot protection.
7. Who receives the data
The data, including backups, is stored and processed on servers in Germany at the hosting provider Hetzner Online GmbH. Traffic to the websites passes through the Cloudflare network (Cloudflare, Inc., USA), which, on the controller's behalf, delivers it to the servers and protects the websites from attacks.
Only the following receive data:
- sign-in services you choose yourself: Google, GitHub, Telegram;
- Cloudflare — as the entry point for traffic to the websites (above);
- bot protection service on sign-in pages and the feedback form: Cloudflare Turnstile (Cloudflare, Inc., USA);
- Gravatar (Automattic Inc., USA) — only if you enabled the Gravatar picture;
- Apple and Google notification services — in mobile apps, if you allowed notifications;
- other players — to the extent described in section 5;
- public authorities — where required by law.
Processing on the controller's behalf is carried out by processors under contracts with confidentiality and data protection obligations (Art. 45 of the Law): Hetzner Online GmbH (Germany) — servers and backups, Cloudflare, Inc. (USA) — the traffic entry point.
Transfers outside Serbia: storage and processing in Germany — a party to Council of Europe Convention 108 with an adequate level of data protection (Art. 64 of the Law); Cloudflare (USA) — the traffic entry point, under a data processing agreement with the European Commission's standard contractual clauses; Gravatar and notification services (USA) — at your choice; Cloudflare Turnstile (USA) — bot protection; sign-in services — at your choice. We do not sell data and do not share it for advertising.
8. How long we keep data
| Data | Period |
|---|---|
| Account, profile, connections | while the account exists |
| IP address and browser details | 1 year; after that only country, region and city remain |
| Public chat messages | 90 days |
| Private messages and support requests | 3 years after the last message |
| Records of accepted documents and consents | while the account exists and 3 years after its deletion or the withdrawal of consent |
| Games played and ratings | indefinitely — they are the history of the club and of your opponents; after account deletion your nickname in them is replaced with an anonymous one |
| Technical logs, error data, backups | up to 90 days |
9. Deleting your account
You can delete your account in your profile without contacting us. 30 days after the request the account data is anonymised: email, nickname, profile, picture, connections and sign-in methods are deleted, and the account's IP addresses are erased. You can cancel the deletion within 30 days. Games played and ratings remain with an anonymous nickname (section 8). Data leaves backups as they are replaced.
10. Your rights
You have the right to:
- learn what data of yours we process, why and how, and get a copy of it;
- have inaccurate data corrected or completed;
- have data erased or its processing restricted where there is no basis for it;
- receive the data you provided to us in a machine-readable format;
- object to processing based on legitimate interest;
- withdraw consent — for emails and Gravatar this is done in your profile settings; withdrawal does not affect what was done before it;
- lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs) or go to court.
Send requests to [email protected] from the email address of your account. We reply within 30 days; for complex requests this period may be extended, and we will tell you why.
11. How we protect data
Data is transmitted over networks only in encrypted form; access to data is restricted and protected by a second factor; sign-in secrets are stored encrypted and codes as hashes; databases are not reachable from the Internet; sign-ins and security events are logged; backups are made. We notify the Commissioner and you of security breaches affecting your data in the cases and within the time limits set by the Law. Report vulnerabilities and possible leaks to [email protected].
12. Changes to this policy
A new version is published on this page with its date; previous versions are listed below. If changes affect the purposes of processing or require new consent, we will tell you when you sign in.