Privacy policy

Last updated: 24 August 2026

1. Controller and contact

The controller of personal data processed through Patches.cafe is Krystian Welcel, operating the game under hsr.gg. Privacy questions and requests can be sent to kontakt@hsr.gg.

2. What the game processes

Data kept on your device

Campaign progress, settings, achievements, custom levels, hint and star balances, and a randomly generated player identifier are stored in localStorage. The installable version also keeps application files, icons, fonts, and music in browser Cache Storage so the game can work offline. This information stays in the browser profile you use to play. Patches.cafe does not receive the campaign save merely because you open the game.

Leaderboard data

If you use the shared leaderboard, the server stores a shortened cryptographic hash derived from the random player identifier, your chosen nickname, and positive scores for Campaign, Espresso Blitz, and Perfectionist. A lower score does not replace a better one.

Optional analytics data

If you accept analytics, Google Analytics 4 receives information about page views, approximate location, device and browser type, referring page, session activity, and interactions measured by the Google tag. Patches.cafe does not send your nickname, leaderboard identifier, custom level code, or other directly identifying information to Analytics. The Google tag remains blocked until consent is granted.

Security and connection data

The leaderboard function briefly processes the requesting IP address to limit excessive score submissions. The rate limit entry expires after about 70 seconds. The hosting provider may also receive standard request information such as the IP address, browser type, request time, and requested file.

The game does not ask for an account, e-mail address, payment data, advertising identifier, or social profile. It does not display advertising. Google Signals and advertising-personalisation signals are disabled in the tag configuration.

3. Why the data is used

Local data remembers the progress and settings requested by the player. Leaderboard data provides the shared ranking. Short security records protect that ranking and the public API from automated abuse. Depending on the situation, the legal basis is performance of the requested service and the controller's legitimate interest in operating and protecting it, under Article 6(1)(b) and Article 6(1)(f) GDPR.

With your consent, analytics data is used to understand visits, popular pages, devices, and general use of the game so that bugs and confusing areas can be prioritised. The legal basis for Google Analytics is consent under Article 6(1)(a) GDPR. Refusing analytics does not limit the game.

4. Providers and international transfers

Patches.cafe uses Vercel for hosting and server functions and Upstash for the leaderboard database. Fonts, styles, icons, and music are served as local game files instead of being requested from separate asset CDNs.

After consent, Google Analytics is provided by Google Ireland Limited, with Google LLC and other Google entities acting as service providers. Google may process technical and analytics data outside the European Economic Area under the safeguards described in the Google Privacy Policy and its data transfer terms. The browser sends Google the page URL and IP address as part of the network request.

5. How long data remains

Local game data remains until you clear it through the game or browser. Leaderboard records remain until you delete them, the ranking is reset, or the service closes. Temporary rate limit data expires after about 70 seconds. Hosting and CDN request logs follow the retention periods set by each provider.

After consent, Google Analytics may set _ga and _ga_<container-id> cookies. Their default lifetime is up to two years and can be refreshed by later visits. Event and user data in the GA4 property follows the retention period configured in Google Analytics. Your consent choice remains in localStorage until you change it or clear site data.

6. Your rights

Depending on the legal basis and circumstances, you may request access, correction, deletion, restriction, or portability of your data, or object to processing. You may also complain to the President of the Personal Data Protection Office in Poland at uodo.gov.pl. Because the game has no user accounts, the locally stored random player identifier may be needed to locate the matching leaderboard record.

You may withdraw analytics consent at any time through the Cookie settings link in the footer. Withdrawal blocks future Analytics collection and removes the Analytics cookies accessible to Patches.cafe. It does not affect processing already carried out before withdrawal.

7. Automated decisions

Patches.cafe does not make automated decisions that produce legal or similarly significant effects. Scores are sorted to build the public leaderboard, but that ranking has no legal consequence for a player.

8. Changes to this policy

The policy may be updated when the game adds a provider or changes how an online feature works. The date at the top identifies the current version. Material changes will be described in the game or on this page.