1. Data Controller
Komáromi Társasjáték Klub (hereinafter "KTK" or "we") Website: ktklub.com Email: info@ktklub.com
2. What Data We Collect
2.1 REGISTRATION & PROFILE
When you register, we collect: your nickname, email address, and password (stored only in hashed form using bcrypt). Optionally, you may provide: favorite games, a short profile bio, and a profile picture.
2.2 TABLE RESERVATION
When making a table reservation, we collect: your name, email address, reservation date and time, table type, and number of players.
2.3 Finding opponents and D&D sessions
When you create or join a player search or a D&D session we collect: the name of the game or campaign, the date, the time, the maximum number of players, and the chat messages between participants. Chat messages are deleted automatically once the date of the game or session has passed.
2.4 GOOGLE LOGIN
If you log in using Google, we receive from your Google account: your name, email address, and profile picture. This data is used solely to create and manage your account. We do not access any other data from your Google account. The login process uses Google's secure OAuth 2.0 protocol — we never see or store your Google password.
2.5 MOBILE APPLICATION (NEXUS APP)
When using the NEXUS mobile application, we collect and store the following data:
Data stored on device: authentication token, user ID, nickname, email address, avatar URL, language preference, VP counter game data, Nexus Bird score, and user preferences (notifications, intro tips state). This data is stored exclusively on your device (SharedPreferences) and is automatically deleted when you uninstall the app.
Push notifications: We use Firebase Cloud Messaging (Google) to send push notifications. We store a device identifier (FCM token) on our server. The FCM token contains no personal data — it is used solely to deliver notifications.
Bug reports: If you submit a bug report from the app, we collect: your email address, the bug description, device type, Android version, and app version.
Club chat & private messages: Club chat messages between registered members and private messages between friends are stored on our server.
2.6 TECHNICAL DATA
We use only essential functional cookies (a login session cookie and one that remembers your chosen language). We do not use tracking cookies, third-party analytics, or advertisements. The app contains no advertisements and uses no analytics SDKs.
3. Purpose of Data Processing
We process your data solely for the following purposes: managing your account and profile, providing table booking, enabling opponent and D&D session finding, chat communication (club chat, player-search chat, D&D session chat, private messages), sending push and e-mail notifications (confirmation, joining, chat messages, reminders, opening-hours notice), displaying the Nexus Bird and 2048 leaderboards, managing votes and announcements, and protecting the service (brute-force protection, rate limiting).
4. Legal Basis
We process data based on your consent (Art. 6(1)(a) GDPR) — given at registration by accepting the privacy checkbox. You may withdraw your consent at any time by contacting us or deleting your account.
5. Data Sharing
We do not sell, rent or share your personal data with third parties. For push notifications we use Firebase Cloud Messaging (Google) — the only thing sent to Google is a device identifier (FCM token). If you sign in with Google, your data is transferred directly between your browser or app and Google — we receive only basic profile information. Your nickname is visible to other members in player searches, D&D sessions, the club chat and the Nexus Bird leaderboard. Your e-mail address is never shown to other users.
5.1 THIRD-PARTY SERVICES (SDKS)
The app and website use the following third-party services:
- Firebase Cloud Messaging (Google LLC): For sending push notifications. The only thing we send is a device identifier (FCM token). Google privacy policy: policies.google.com/privacy
- Glide (Bumptech): For loading and caching images. Glide collects no personal data — it operates exclusively in device memory and cache.
- Retrofit / OkHttp (Square): For network communication with our server. These libraries do not collect or forward data to third parties.
Beyond these, we use no analytics, advertising, tracking or social media SDKs.
5.2 DATA TRANSFERS OUTSIDE THE EEA
Firebase Cloud Messaging operates on Google LLC servers, which may be located in the United States or other countries outside the European Economic Area (EEA). Google ensures an adequate level of data protection under the EU–US Data Privacy Framework. All other personal data is stored exclusively on servers within the EEA.
6. Data Retention
- Account data: as long as your account is active.
- Table reservations: automatically deleted 7 days after the reservation date.
- Game requests and chat messages: automatically deleted 1 day after the game date.
- D&D sessions and chat messages: deleted automatically after the date of the session.
- Push notification tokens: as long as your account is active; the token becomes inactive after the app is uninstalled.
- Data stored on device: automatically deleted when the app is uninstalled.
You may request deletion of your account and all associated data at any time (see section 12).
7. Data Security
Passwords are hashed using bcrypt (never stored in readable form). Sessions are authenticated using tokens. Forms are protected with rate limiting (max 10 login attempts / 5 registrations per 15 minutes per IP address). CAPTCHA and nonce tokens are used for form validation. Data transfer is encrypted via HTTPS/SSL on both the website and the app.
8. Your Rights
Under the GDPR, you have the right to: access your data, rectify inaccurate data, erase your data, restrict processing, data portability, and object to processing. To exercise these rights, contact us at info@ktklub.com, or use the deletion options available in the app and on the website.
9. Cookies
We use only essential cookies: a session cookie (PHPSESSID, for login sessions) and one that remembers your chosen language (ktk_lang). Neither tracks you nor builds a profile. We do not use any marketing, analytics, or tracking cookies. The app does not use cookies — data stored on the device is managed via the SharedPreferences mechanism.
We measure site traffic without cookies, anonymously (Umami, running on our own server). It uses no cookies, builds no profile and stores no personal data — only aggregate, anonymous statistics (pages viewed, referring source, country, browser). No third party has access to it.
10. Children's Policy
The app and website are not intended for children and are not directed at users under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have stored data from a person under 13, we will delete it without delay. If you believe we are storing your child's data, please contact us at info@ktklub.com.
11. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of any material changes via email, a notice on the website, or an in-app notification.
12. Account & Data Deletion
You may request deletion of your account and all associated personal data in the following ways:
- By email: info@ktklub.com
- Via the web form: Delete account
Within 30 days of receiving the request we permanently delete all of your personal data. Deletion covers: account information, profile data, avatar, table bookings, player searches, D&D sessions, chat messages (club chat, private messages, player-search chat), Nexus Bird and 2048 scores, voting history and push notification tokens. Deletion is permanent and cannot be undone.
13. Contact
If you have questions about this privacy policy or your data, contact us at: info@ktklub.com
Effective: April 14, 2026
The KTK Community rules have moved to the House rules page — you will find them there together with the rules that apply in the club.
Go to the house rules →