← Back to Marble Five

Privacy

This notice applies to Marble Five. It explains the processing of personal data required to provide the website, private game rooms, and an optional Plus account.

1. Controller

The controller responsible for processing personal data is:
Michael Zeletzky
Emanuel-Lasker-Straße 13, 14959 Trebbin, Germany
Email: support@marble-five.com
Phone: +49 172 3033290

2. Provision of the website

Marble Five is hosted by Vercel. When you visit the website, the hosting provider processes technically necessary data, in particular your IP address, the time of the request, the page requested, and information about your browser and operating system, so that the website can be delivered securely and function properly. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable provision of the game.

Further information: Vercel Privacy Notice.

3. Private game rooms and anonymous session

An anonymous game session is created for an online match. We store a technical session identifier, the assignment to a playing colour, the room code, the game state, and the times of creation and update. This data is necessary to enable the private invitation link, the shared match, and reconnection. We do not collect real names, profile pictures, or chat messages.

Processing takes place to provide the online match you requested pursuant to Article 6(1)(b) GDPR. A private game room cannot function without this data.

To protect private rooms against mass creation and excessive requests, we store short request counters linked to your technical session identifier. They cover room creation, joining, reading, and game actions, together with the start of each counting window. No IP address is stored in these counters. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of online matches.

4. Supabase

We use Supabase for anonymous sign-in, game-state storage, and real-time updates. The data listed in section 3 is processed for this purpose. Information on Supabase’s privacy and security measures is available at supabase.com/privacy and supabase.com/docs/guides/security.

5. Plus account and devices

The free game can be used without a personal account. To unlock or restore Plus and use it on additional devices, you may voluntarily sign in with your email address using a one-time sign-in link. We store your email address, a technical user identifier, and the status and source of your Plus entitlement. Marble Five does not store payment details such as card or bank-account data.

Payment processing by Stripe. When you buy Plus, we redirect you to Stripe's payment page (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). Stripe processes in particular your email address, name, billing address, payment details, and technical information for fraud prevention. Data may be transferred to Stripe, Inc. in the United States; Stripe is certified under the EU-US Data Privacy Framework and also uses standard contractual clauses. More information is available at stripe.com/privacy.

For each purchase, we receive and store from Stripe a payment and purchase reference, the amount, currency, billing-address country, payment status, and any refunds or chargebacks. We also store the country of residence you state before payment and the time and version of your consent to immediate activation. Processing is necessary to perform the purchase contract (Article 6(1)(b) GDPR), to meet statutory tax and commercial retention duties (Article 6(1)(c) GDPR), and to prevent abuse and duplicate payments (Article 6(1)(f) GDPR).

Online withdrawal and emails. If you withdraw using “Withdraw from contract”, we store your name, the email addresses you provide, the content of your declaration, and the date and time of receipt in order to confirm receipt and process the withdrawal (Article 6(1)(c) GDPR in conjunction with Section 356a of the German Civil Code). We retain this information until the statutory limitation and retention periods expire. We send the confirmation of receipt and the sign-in links for the Plus account through the mail server of our provider ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, which acts on our behalf (Article 28 GDPR).

To enforce the agreed limit of five active devices, we store a technical session identifier, a broad device label, and the registration and last-used times for each registered device. We do not use device fingerprinting. Registered devices can be removed from the Plus account. Processing is necessary to provide and restore the Plus service under Article 6(1)(b) GDPR.

6. Retention periods

  • Unaccepted invitations close after 30 minutes.
  • Ongoing matches close after 24 hours without a move, and at the latest after seven days.
  • Finished or closed rooms are deleted after 30 days.
  • Anonymous technical accounts that are no longer linked to a game room are checked daily and deleted no earlier than 30 days after creation.
  • Request counters whose counting window began at least two days earlier are deleted daily.
  • We retain Plus account and entitlement data while the entitlement exists and for as long as statutory retention duties apply. Removed devices initially remain stored with their removal time so that device management remains traceable and abuse can be limited.

7. Local settings

Your selected language is stored only in your browser so that the interface appears in the same language on your next visit. This setting is not transmitted to us.

A technical session identifier for an anonymous online match may also be stored in your browser’s local storage. It only serves to reconnect you with your private room and can be removed by deleting the website data in your browser.

Your selected board and marble designs are also stored only in your browser.

8. Your rights

Under the GDPR, you have in particular the right of access, rectification, erasure, restriction of processing, data portability, and objection. Please use the email address above to exercise these rights. You also have the right to lodge a complaint with a data-protection supervisory authority.

Last updated: 2 October 2026

This English version is provided for convenience. The German version is authoritative.