Privacy policy

Updated 15 November 2026

Biitsi only collects what it needs to run the game and keep players safe. We don't ask for your email, real name or phone number, and we don't use advertising or tracking cookies.

Controller and contact

The Biitsi team. Privacy matters: [email protected]

What we process

Account details: character name, password as a hash (scrypt – we never see your password), character look, motto and sign-up time.
Game data: decibels, items, rooms, tracks and records, friends list, achievements, trades and guestbook entries.
Messages: private messages between friends (up to the 100 latest per conversation). Room chat is delivered to the people in the room and isn't stored permanently.
Reports: reports players make about other players, and how they were handled.
Technical data: your IP address at sign-up and at your latest login. It's used to prevent multiple accounts, cheating and harassment.
Local browser storage: your login token, volume and arcade high score. These stay in your own browser.

Why, and on what basis

We process data so the game works (performance of the service agreement) and to protect players from cheating and harassment (legitimate interest). Data is never sold or shared for marketing.

Who else processes data

netcup GmbH (Germany): the server that hosts the game and its database.
Cloudflare, Inc.: network protection and delivery. Cloudflare processes IP addresses to stop denial-of-service attacks and may transfer data outside the EU under the EU Standard Contractual Clauses.

How long we keep data

Account data is kept as long as the account exists. Login sessions expire after 30 days. Sign-up IP limits are cleared within a day. Database backups are deleted after 14 days.

Your rights

You can ask to see the data we hold about you, correct it, or have your account deleted. Send your request to the address above and include your character name. You can also lodge a complaint with your local data protection authority.

Children

Players under 13 may play with a parent's or guardian's permission. A guardian can request a child's account data or its deletion at the same address.