Legal

Privacy Policy

Last updated: 2026-10-31

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Overview

Bugfish (bugfish.eu) is a platform for browser games. You can play all games without an account. If you want, you can create an account to store your game progress ("save states") and favorite games on our server, to comment on games, tools, projects and the items of the media library, and to rate games. Depending on the current setting, creating an account may require an invitation link from another player or from us.

This website has no advertising, no tracking, no analytics services, social media plugins or newsletter – it only counts page views as plain numbers without any data about you (section 3). It loads no external fonts, scripts, images or other resources from third parties; everything is served from our own server. We do not sell or share your data.

3. Server log files

Each time a page or file of this website is requested, the web server automatically records the following information in log files:

• IP address of the requesting device
• date and time of the request
• requested page or file
• referrer URL (the page you came from, if transmitted by your browser)
• browser type and version, operating system (user agent)
• HTTP status code and amount of data transferred

Purpose: delivering the website and the games to your browser, ensuring the security and stability of the server, and detecting and defending against attacks and misuse.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and error-free operation of this website.

Retention: log files are deleted automatically after 30 days at the latest. Data whose further retention is necessary as evidence of a specific security incident is kept until that incident has been fully resolved.

Providing this data is neither legally nor contractually required. Without it, however, the website cannot be delivered to your browser.

Usage statistics: to see how the platform is used, we count how often the areas of this website (for example the store, a game's page, a project's page or the friends page) are opened, how often each game or tool is started, how often each track of the radio is listened to – when a track has played for 30 seconds (or to its end), the player tells our server which track it was, nothing else – and how often each item of the media library and each downloadable track is downloaded. For this, a request only adds 1 to a counter of the day – for example "game page of Cold Start, 30 Oct 2026: 57". We store no IP address, no cookie, no account, no user agent and nothing else about you or your device for this, and nothing is stored on or read from your device; the user agent your browser sends is only checked during the request, to leave out search engine bots, and is then discarded. The counters therefore contain no personal data. We show how often each game, tool and project was opened, and how often each media item was opened and downloaded, on its card and page; the other numbers only our administrators see. Pages of logged-in administrators are not counted.

4. User account

Creating an account is optional. When you sign up, we process:

• your email address,
• your password – stored only as a salted one-way hash (Argon2id or bcrypt); we never know your actual password,
• the time of registration and activation,
• your player ID – a random number that identifies your account towards other players instead of your email address,
• if you choose one, your name (see "Your name" below),
• if you signed up with an invitation link: which link you used and which player (or administrator) created it,
• the invitation links you create (code, optional note, how many people may use it, validity, when it was created or withdrawn),
• your friends and friend requests (see "Friends" below) and the aliases you give your friends,
• a pending new email address, if you request to change it, until you confirm or the request expires.

Invitations: a player who invites you sees the player ID of your account, whether it is activated and when you joined – never your email address. You see the player ID of the player who invited you. Legal basis: Art. 6(1)(b) GDPR for the invitation function you use; for showing the inviting player the pseudonymous player ID, activation and joining time of the accounts created with their link, Art. 6(1)(f) GDPR, based on the legitimate interest of the inviting player to know whether their invitation was used. Retention: who invited you is stored as long as your account exists. Withdrawn and expired invitation links are deleted 90 days after they were withdrawn or expired; if you delete your account, your invitation links are deleted and friends who joined with them are no longer marked as invited by you.

Your name: under My account you can choose a name (optional). It is shown with your player ID to your friends, to players you send a friend request to, to people who open your invitation link, and to you in the top bar – never to anyone else, and never your email address. Others cannot change it. You can change or remove it at any time; our administrators can remove names that are offensive or pretend to be someone else. Legal basis: Art. 6(1)(b) GDPR; for removing names that break these rules Art. 6(1)(f) GDPR, based on our legitimate interest in a respectful platform. Retention: until you remove it or delete your account.

Your profile picture: when you have completed a game, you can choose one of the pictures we provide for that game as your profile picture under My account (optional). We store which picture you chose. It is shown with your player ID to your friends, to players you send a friend request to, to players who send you a friend request – also before you answer it – and to people who open your invitation link, and to you in the top bar; never to anyone else. As the pictures belong to games, others can tell from your picture that you completed that game. Legal basis: Art. 6(1)(b) GDPR. Retention: until you change or remove it, reset that game completely under Save States, or delete your account.

Friends: you can add other players as friends by their player ID or with an invitation link. We store the connection – which two accounts, who asked whom, when it was requested and accepted, and whether it came from a request, a sign-up with an invitation link or an invitation link accepted while logged in – and the optional aliases you give your friends. Your friends see your player ID, your name and profile picture if you chose them, and that you are friends, never your email address; the aliases you give your friends are only visible to you. A player you send a request to sees your player ID until they accept or decline it; if they decline, you are not told. A player who sends you a request sees your profile picture right away, before you answer. If you sign up with a player's invitation link, or accept one while logged in, you and that player become friends right away. Legal basis: Art. 6(1)(b) GDPR (the friends function you use). Retention: until you or your friend end the friendship, or one of the two accounts is deleted; requests nobody accepted are deleted after 60 days.

Purpose: providing your account, cloud save states and favorites, letting you log in, recover your password and secure your account.

Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement you enter into by creating an account).

Retention: as long as your account exists. Accounts that are not activated within 48 hours are deleted automatically. You can delete your account at any time under My account; it is then deleted immediately and permanently together with all save states, completed games, favorites, friendships, comments and ratings; only the anonymous numbers it was part of (for example how many players completed a game) stay.

Providing your email address and a password is required to create an account. Without an account you can still play all games, but your progress is not stored on our server.

Access by our administrators: the people who run this platform can see in its administration area the email address, the player ID, the chosen name, the time of registration and activation and the role of an account, who invited it and the invitation links it created, the number, size, progress and time of its save states (but not their content), how many games it completed, its favorites, its comments (also before they are approved) and ratings, and its live sessions (section 10). They use this only to operate the platform, answer support requests and prevent misuse. Legal basis: Art. 6(1)(f) GDPR, based on our legitimate interest in the secure and orderly operation of the platform.

5. Save states, progress and favorites

If you are logged in, games can store save states on our server. A save state consists of the name of the game, a slot name chosen by the game, the game progress data the game sends (for example level, score or settings), an optional completion percentage that we show to you as your progress, and the time it was created and last updated. Games only store data that is needed for the game itself. When a game reports 100 % for the first time, we also store that you completed it and when; this stays when you delete the save states of the game, so the game remains completed for you. Separately we keep that you completed the game at least once: it counts you once in the number of players who completed the game – resetting the game does not lower that number and finishing it again does not raise it – and it lets you rate the game (section 6). Favorites consist of the game and the time you added it.

Progress from our other websites: some games of this platform run on other websites that we operate ourselves, for example Multi Chess on chess.bugfish.eu. Only if you connect such a game in a browser – with the "Connect" button on the game's page here – does the game's website report your progress from that browser to your account here (for Multi Chess: which of its computer levels you have beaten, and the resulting percentage). Your browser sends this directly to our server; the game's website receives nothing about your account here except whether you are logged in and the progress stored for that game. We store it like a save state and show it as your progress. If you are not logged in here, nothing is stored in an account; the requests appear in our server log files like any other request (section 3). Legal basis: Art. 6(1)(b) GDPR. You can stop the reports on the game's website (Multi Chess: Settings → Game platform → Disconnect) and delete the stored progress under Save States.

For each game we show how many players have completed it, how many have it in their favorites and – once players rated it – the average of their ratings (section 6). These are only numbers; they never show who completed, favorited or rated a game.

Purpose: letting you continue your games on any device and keeping your personal game list.

Legal basis: Art. 6(1)(b) GDPR.

Retention: save states and favorites until you delete them or your account; that you completed a game until you reset the game completely or delete your account; that you completed it at least once until you delete your account – it then loses every link to you and only remains as a part of the anonymous number of players who completed the game. You can view and delete all save states and reset completed games any time under Save States, and download all your data – including your save states – as a JSON file under My account.

6. Comments and ratings

Comments: if you are logged in, you can write comments and replies on the pages of games, tools, projects and the items of the media library (not on the home page and the radio). We store the text, the page, which comment a reply belongs to, when you wrote it, whether and when it was approved and by which administrator, and whether it is pinned. An administrator checks every comment before others can see it – this keeps spam, scams, links to harmful websites and abuse away from the platform and its players; until then only you and our administrators see it. Other players see your comment with your player ID only; your friends also see your name and profile picture (section 4) – nobody sees your email address. If you rated the game, your stars are shown next to your comments on that game. You can delete your own comments at any time on their page; administrators can pin comments to the top of a page and delete comments. Deleting a comment also deletes the replies to it. To stop floods of spam, we count how many comments you write – at most 6 in 10 minutes and 40 a day – in the way described in section 9.

Ratings: when you have completed a game, you can rate it with 1 to 5 stars. We store the game, your stars and when you rated it or last changed the rating. Others see the average of all ratings of a game and how many there are, never who rated it how – except that your stars are shown next to your own comments on that game. You have one rating per game: you can change or remove it at any time, and it stays when you reset the game completely – finishing the game again never adds a second one.

Purpose: letting players discuss games, tools, projects and media and rate games, and keeping spam and abuse away. Legal basis: Art. 6(1)(b) GDPR for the comments and ratings you write; for checking comments before they appear and for deleting comments that break the rules, Art. 6(1)(f) GDPR, based on our legitimate interest in a safe and respectful platform. Retention: comments until you or an administrator delete them or your account is deleted – then all your comments and the replies to them are deleted; ratings until you remove them, reset the game completely or delete your account. Your comments and ratings are part of the JSON download under My account.

7. Emails we send

We only send emails that are necessary for your account: the activation link, password reset links, the confirmation link for a new email address, and security notices (for example when your password or email address was changed, or when your account was deleted). We do not send newsletters or advertising.

Legal basis: Art. 6(1)(b) GDPR; for security notices also Art. 6(1)(f) GDPR, based on our legitimate interest in protecting your account against misuse.

Emails are sent from our own server described in section 11. Links in these emails contain a random one-time code; we only store a hash of it, and it expires after a short time.

8. Cookies and storage on your device

If you only browse the store and play games without logging in, this website does not set any cookies. Cookies are only set when you log in or submit a form:

These cookies are strictly necessary to provide the functions you explicitly request. Legal basis: § 25(2) No. 2 TDDDG for storing them on your device and Art. 6(1)(b) GDPR for the processing. We therefore do not ask for consent and do not show a cookie banner.

If you connected a game of our other websites (section 5), your browser also sends these cookies along with that game's progress reports to this website – both websites belong to the domain bugfish.eu – so that we can store the progress in your account. The game's website cannot read them. This, too, is strictly necessary for the function you requested by connecting the game.

The radio: once you use the player on the Radio page, it keeps your volume, shuffle and repeat choice, the station and track you listened to last with the position, and the tracks you marked with a heart in your browser's local storage (localStorage, key gdb-radio), so it can go on where you left off – also in its pop-out window. This stays on your device and is never sent to us. It is strictly necessary for the player you use (§ 25(2) No. 2 TDDDG); you can delete it at any time in your browser settings.

Some games may additionally store progress or settings locally in your browser (for example in localStorage), so you can continue playing without an account. This data stays on your device and is not transmitted to us unless the game uses the cloud save function described in section 5 while you are logged in. This is also strictly necessary for the game you chose to play (§ 25(2) No. 2 TDDDG). You can delete it at any time in your browser settings.

9. Security and abuse protection

To protect accounts against password guessing and to stop mass registrations, guessed invitation codes, spam emails and spam comments, we count login, sign-up and password reset attempts, wrong invitation codes, newly created invitation links, written comments and rating changes (section 6) and the number of newly opened live sessions (section 10). For this we store the type of attempt, the time and a keyed hash (HMAC-SHA-256) of your IP address, of the entered email address or of your account number. We cannot read the IP address or email address from this hash.

Legal basis: Art. 6(1)(f) GDPR, based on our legitimate interest in the security of the platform and of your account.

Retention: these entries are deleted automatically after 24 hours at the latest.

All connections to this website are encrypted via TLS (HTTPS).

10. Running games and multiplayer

While a game of this platform is open in your browser, it tells our server about once a minute that it is still running (a "live session"). A live session contains the game, when it was opened and when it last reported, and – if the game supports it – what is going on in the game, for example the mode ("Skirmish"), the map or the difficulty. If you are logged in, the live session is linked to your account. For guests it is not linked to any person: we store neither the IP address nor a cookie for it.

Purpose: operating and moderating the platform – our administrators can see which games and matches are running right now. Legal basis: Art. 6(1)(f) GDPR, based on our legitimate interest in operating the platform. Retention: a live session is deleted as soon as you close the game, and automatically about 6 minutes after the game stopped reporting (for example when your browser closed or lost the connection). To prevent abuse, the number of new live sessions is counted per IP address as described in section 9.

When you play a multiplayer game, your browser exchanges game data with a game server so that you can play with other people. Besides your IP address (which is technically necessary for the connection), this includes the game actions and any player name you enter in the game. Other players in the same match see your player name and your game actions.

Legal basis: Art. 6(1)(b) GDPR. Retention: only for the duration of the match, unless the respective game states otherwise.

The number of players currently online that we show for some games is requested by our own server from the game server. Your browser only talks to our server for this, and no data about you is sent to the game server.

11. Hosting

This website runs on a virtual server that we administer ourselves. The virtual server is provided by:

i-make.media operates the host system on which our virtual server runs and acts as a processor on our behalf under Art. 28 GDPR. It has no access to the data on our server beyond what is technically unavoidable for operating the host system.

The underlying physical hardware is rented by i-make.media from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, which acts as a sub-processor and provides only the data centre and physical server. All servers are located in Germany.

Apart from these infrastructure providers, we do not pass personal data on to third parties unless we are legally obliged to do so. We do not transfer personal data to countries outside the EU/EEA.

12. Contact by e-mail or phone

If you contact us by e-mail or phone, we process the data you provide (e.g. name, e-mail address, phone number, content of your message) solely to handle your request. This also applies to reports of illegal content under the Digital Services Act (see the Impressum); such reports are kept for six months after the case is closed.

Legal basis: Art. 6(1)(f) GDPR, based on our legitimate interest in responding to enquiries addressed to us; where your request relates to your account or the conclusion or performance of a contract, Art. 6(1)(b) GDPR.

Retention: your data is deleted once your request has been fully dealt with, unless statutory retention obligations require us to keep it longer.

13. Your rights

Regarding your personal data, you have the following rights under the GDPR:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object (Art. 21 GDPR, see section 14)

Many of these you can exercise yourself at any time under My account: download all your data as a JSON file, change your email address, or delete your account. For everything else, contact us using the details in section 1.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement. The authority responsible for us is:

14. Right to object

Where we process your personal data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR).

If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims. To object, an informal message to the contact details in section 1 is sufficient.

15. Automated decision-making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

16. Changes to this policy

We may update this privacy policy if the website or legal requirements change. The version published here always applies.