Last updated 23 October 2026

Privacy Policy

PvP Blackjack collects as little about you as it can. There are no ads, no tracking cookies and no analytics, and your data is never sold. This page explains exactly what is stored, why, for how long, and what you can do about it.

1. Who we are

The data controller responsible for PvP Blackjack (https://pvp-blackjack.com) is:

Rok Brecko
Koroska cesta 74, 2000, Maribor, Slovenia
E-mail: info@pvp-blackjack.com

Write to this address for anything about your data. We answer within one month.

2. What we store and why

Data	Why	Legal basis (GDPR)
Account — your username, your e-mail address, the account type, when it was created and last used, and when you accepted the Terms. Your password is stored only as a salted scrypt hash that cannot be turned back into the password. Other players never see your e-mail address.	To give you an account and keep it yours.	Contract — Art. 6(1)(b)
E-mail codes — when you create an account, log in on a new device, reset your password or change your e-mail address, we e-mail you a 6-digit code. The code is kept only in the server’s memory, as a hash, for at most 30 minutes. We only send e-mails you ask for (and a short notice when your password or e-mail address changes) — never newsletters or advertising.	To confirm the address is yours and to keep strangers out of your account.	Contract — Art. 6(1)(b); legitimate interest in account security — Art. 6(1)(f)
Trusted devices — for each browser or device where you entered a login code: a random device number (stored only as a hash), and when it was added and last used.	So you aren’t asked for a code every time on your own devices.	Legitimate interest in account security — Art. 6(1)(f)
Guest play — a random name such as Guest_12345 and the game data below. No e-mail address, no password.	To let you play without signing up.	Contract — Art. 6(1)(b)
Game data — your chip balance, results, statistics, your last 10 games, your net-chips graph, and settings such as “allow friend requests”.	To run the game, show your profile and the leaderboard.	Contract — Art. 6(1)(b)
Friends & messages — friends, friend requests, favourites, players you blocked, and direct messages (the latest 200 per conversation).	The social features you choose to use.	Contract — Art. 6(1)(b)
Table chat — kept only in the server’s memory while the table is open, and never written to disk — unless someone reports a player: then that player’s last messages at the table are attached to the report.	Chat during a game; evidence for moderators.	Contract — Art. 6(1)(b); legitimate interest in a safe community — Art. 6(1)(f)
Reports & moderation — reports you make or that are made about you (reason, optional note, time, attached chat lines), and any suspension of your account.	To deal with cheating, abuse and offensive names.	Legitimate interest — Art. 6(1)(f)
Login sessions — when each login was created and last used. The login token itself is stored only as a hash.	To keep you logged in, and to let you log out other devices.	Contract — Art. 6(1)(b)
Connection data — your IP address, while you are connected. It is used only in the server’s memory to limit how often requests can be made (for example failed logins), and is not stored in our database.	Security and protection against abuse.	Legitimate interest — Art. 6(1)(f)

Chat messages and direct messages pass through an automatic filter that replaces swear words with ****, removes links, and refuses offensive usernames. This is done by the computer without a person reading your messages, and it has no legal or similarly significant effect on you. A moderator only reads messages that are attached to a report.

We do not use your data for advertising, we do not build profiles of you, and we do not sell or rent your data to anyone.

3. Cookies & data on your device

We use no advertising, analytics or tracking cookies, so there is no cookie banner. Only what is strictly necessary for the service you asked for is stored on your device:

Your login — a random login token in your browser’s local storage, so you stay logged in. Logging out removes it.
Your settings — sound, animation speed and similar choices, in local storage. They never leave your device.
Your device number — a random number in your browser’s local storage, so this device is recognised after you have entered a login code here. It contains nothing about you.

The game’s fonts and images are served from our own server, so loading the game sends nothing to other companies.

4. Who else sees your data

Other players see your username, statistics and net-chips graph, and your place on the leaderboard (guests are not listed). Friends also see whether you are online, and the people you message see your messages. Nobody else ever sees your chip balance or your password.
Our hosting provider — Hetzner Online GmbH, Germany — runs the server and stores the data on our behalf, under a data processing agreement (Art. 28 GDPR). It may keep short-lived technical logs, such as IP addresses, to operate and protect its network.
Our e-mail provider — NEOSERV d.o.o., Slovenia — delivers the e-mails with your codes, so it processes your e-mail address and those e-mails on our behalf.
Authorities — only where the law requires us to.

If our hosting provider stores data outside the European Economic Area, we make sure it is protected by an adequacy decision of the European Commission or by the EU’s Standard Contractual Clauses.

5. How long we keep it

Your account and game data: until you delete your account. Deleting is immediate and permanent.
Guest accounts: deleted automatically after 30 days without playing.
Logins: expire after 30 days without use, and after 180 days at the latest.
Trusted devices: forgotten after 180 days without use, or at once with Log out other devices.
E-mail codes: 10 minutes (30 minutes to finish signing up or resetting a password), and only in the server’s memory.
Direct messages: the latest 200 per conversation; all of them are deleted when either player deletes their account.
Table chat: gone when the table closes (except lines attached to a report).
Reports: up to one year, or until the reporter or the reported player deletes their account.
Connection data: held in memory for at most one hour.
Backups: one copy of the database per day, kept for 14 days — so deleted data is gone from the backups at the latest 14 days after deletion.

When you delete your account, your name in other players’ recent games is replaced with “Deleted player”.

6. Your rights

Under the GDPR you have the right to:

access your data and receive a copy in a portable format (Art. 15 and 20) — Settings → Account → Download my data gives you everything we store about you as a file;
erasure (Art. 17) — Settings → Account → Delete account;
rectification (Art. 16) — change your e-mail address in Settings → Account; for a different username, write to us;
restriction of processing (Art. 18) and to object to processing based on our legitimate interests (Art. 21) — write to us;
complain to a supervisory authority — in Slovenia this is the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec, www.ip-rs.si); you may also complain to the authority where you live or work.

To use any of these rights, write to info@pvp-blackjack.com. If we can’t be sure the request comes from the account’s owner, we may ask you to confirm it from inside the game.

7. Security

The game is served over an encrypted connection (HTTPS). Passwords are stored only as salted scrypt hashes and login tokens only as SHA-256 hashes, so even a copy of the database could not be used to log in. A new device needs a code from your e-mail as well as your password. Logins and codes are rate-limited, the game logic runs entirely on the server (your browser never sees your opponent’s cards), and access to the data is limited to the operator. No system is perfectly secure — if we ever learn of a breach that puts your rights at risk, we will act as the GDPR requires (Art. 33 and 34).

8. Age limit

PvP Blackjack is only for people aged 18 or older. We do not knowingly collect data from anyone younger; if we learn that an account belongs to someone under 18, we delete it.

9. Changes to this policy

If we change this policy in a way that matters, we update the date at the top and ask you to accept the new version the next time you play.