Privacy

Who we are

Knalpot Cup is run by Joey Hobrecker, trading as Hobrecker Webdesign, Pisanostraat 320, 5623 CK Eindhoven, the Netherlands (KvK 42134492). We decide what happens with your data. Questions, or a request about your data: hello@knalpotcup.com.

What we keep

• Your email: only as a scrambled code (HMAC with a secret key). We can't read your address back and the site never sends you email. The code is how we recognise you when you sign in.
• Your password: only as a scrypt hash.
• Your name on the leaderboard, your predictions and your points.
• Reports about names: the name, the reason, and your account if you were signed in when you reported it. No IP address.
• A sign-in cookie, valid 90 days after your last visit. No tracking or advertising cookies.

Why we may

• Your account, predictions, points and name: to run the game you joined (performance of a contract, GDPR art. 6(1)(b)).
• The limits on sign-ups and sign-in attempts, the visit log and the name reports: our legitimate interest in keeping the site safe and fair, and knowing how many people visit (art. 6(1)(f)).

We don't ask your age or where you live. If you're under 16, ask a parent or guardian before you join.

Names are checked automatically against a word list when you pick one. A person looks at every report; nothing else about you is decided automatically.

Visits

Like every website, our web server writes a line per page request: the time, the page, your IP address, your browser and the country Cloudflare reports. That log stays on our server for at most 7 days. For our visitor count we keep only a code made from your IP address, your browser and a key that changes every day; the keys are destroyed after 8 days, so we can count how many people visited on a day but can't follow anyone across days or work back to an address. No cookie is used for this.

To stop fake accounts and password guessing, the site counts sign-ups and sign-in attempts per IP address in memory, for at most a day.

How long

As long as you have an account. Delete it on your account page and your email code, password and name are removed straight away. Predictions stay in the race totals without your name, so other players' results stay correct. Name reports are removed 180 days after we dealt with them.

When you write to us

Mail to hello@knalpotcup.com is forwarded by Cloudflare's email service to our mailbox at Google (Gmail). We keep your message and address as long as we need them to answer you or hand out a prize, and at most a year after the last message. The basis is our legitimate interest in answering you (art. 6(1)(f)), or the game itself when you claim a prize (art. 6(1)(b)).

Who else sees it

The site runs on our own server in the Netherlands. Traffic reaches it through Cloudflare, Inc., which handles the secure connection and so processes your IP address in transit, on our behalf; it also forwards mail you send us. Our mailbox is at Google. Cloudflare and Google are based in the United States and take part in the EU-US Data Privacy Framework. For statistics, a copy of the game data (leaderboard names, predictions, points; never your email code or password) is kept on our own computer. Nothing is shared with anyone else or sold.

Your rights

You can ask to see the data we have about you, to correct it, to delete it, to limit what we do with it, or to get a copy; and you can object to what we do based on our legitimate interest. Deleting works straight away on your account page. For the rest, write to hello@knalpotcup.com; we answer within a month. Not happy with how we handle it? You can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.