Effective 15 September 2026
Privacy Notice
This notice explains how Tim Cadenbach, a sole trader trading as Cordango ("Cordango", "we", "us"), handles personal data of visitors, account holders, claimants, and sponsors. For this website Cordango is the data controller. Questions, or any request about your data: tim@cordango.com. Business customers whose own data we process act as controller under our Data Processing Addendum.
What we collect and why
Account data (email address, authentication identifier, and, when you sign in with Google, your Google account email and name)
Creating and securing your account, signing you in, linking your claims to you.
Legal basis: Performance of a contract.
Claim and sponsor submissions (display name, optional comment, optional link, sponsor company name, contact email, proposed copy)
Publishing your claim or sponsored encounter in the game, moderation, and contacting you about it.
Legal basis: Performance of a contract; legitimate interests in moderating public content.
Purchase records (transaction reference, amount, tier or claim, status)
Fulfilling your purchase, support, accounting, and fraud prevention. Card and billing details are collected and held by Stripe, not by us.
Legal basis: Performance of a contract; legal obligation (accounting); legitimate interests (fraud prevention).
Usage and technical data (spin and vote activity, an anonymous session identifier stored in your browser, IP address, timestamps, error and request logs)
Running the game, rate limiting, abuse prevention, security, and improving the product.
Legal basis: Legitimate interests in operating a secure, working service.
Messages you send us (email correspondence)
Answering support and other enquiries.
Legal basis: Legitimate interests in responding to you.
Who we share it with
We share personal data only with: hosting and platform providers that run the site and its database and email sending (Lovable and Lovable Cloud/Supabase); Google, where you choose to sign in with a Google account; Stripe, which processes payments and calculates and collects tax on our behalf; professional advisers such as accountants and lawyers where needed; and public authorities where the law requires it. Anything you deliberately publish in the game — your chosen display name, comment, and link — is visible to everyone. We do not sell personal data.
International transfers
Some of these providers process data outside the UK/EEA. Where that happens we rely on a lawful transfer mechanism, such as an adequacy decision or the EU Standard Contractual Clauses, together with appropriate additional safeguards.
How long we keep it
Account data is kept while your account exists and for up to 6 months after you delete it. Published claims and sponsor entries remain visible while they are live and are kept for up to 2 years after removal so we can handle disputes. Purchase records are kept for as long as tax and accounting law requires, generally 7 to 10 years. Technical logs and rate-limiting data are kept for up to 12 months. Correspondence is kept for up to 2 years. After these periods data is deleted or anonymised.
Your rights
Subject to local law, you can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where we relied on consent. Email tim@cordango.com and we will respond within one month. If you are in the UK or EEA and are unhappy with our response, you can complain to your local data protection supervisory authority.
Cookies and local storage
We use only what the site needs to work: a sign-in session cookie and an anonymous identifier in your browser's local storage used for spin and vote limits. We do not run advertising or cross-site tracking cookies. Clearing your browser storage removes them; doing so signs you out and resets your local session.
Security
We use appropriate technical and organisational measures, including encryption in transit, access controls that restrict database access to server-side code and authorised staff, and audit logging. No system is perfectly secure, but we take reasonable steps to protect your data and will notify you where the law requires it.
Children
The game is not directed at children under 16. We do not knowingly collect their personal data; contact us if you believe we have.
Changes
We will update this notice when our practices or applicable requirements change. The effective date above identifies the current version.