Privacy notice

Last updated 22 September 2026

This notice explains how Ranking uses information when you visit, host a game, play, or submit a statement. You have privacy rights even if you never create an account.

Who is responsible

Bruce Martens operates Ranking and is responsible for its processing of personal data (the data controller). Contact bmartens2112@gmail.com for privacy questions or requests.

What we collect and why

• Hosting an account: your email address, account creation and sign-in dates, and the date and version of the terms you accept. We use these to provide and secure your account and record your agreement. An email address is required to host; we do not ask for a password.
• Signing in: email-link requests, expiry and use dates, the page to return to, and session records. These let us send sign-in emails, prevent link reuse, limit repeated requests, and keep you signed in.
• Games: the host’s account reference, game name, settings, statements, player names, joining times, submitted rankings, round results, and scores. We use these to run games, reconnect players, and let hosts revisit their games. Players can use a nickname and do not need to provide an email address.
• Statements: the text you submit and its submission time. We do not attach an account or player name to anonymous statement submissions. The text itself may still identify you or another person.
• Technical information: requests to the service and error information used to operate, troubleshoot, and secure it. Our hosting and email providers may also process connection information, such as IP addresses, and delivery records.
• Contact requests: your email address, message, and information needed to respond when you contact us.

Most information comes from you. Other participants and hosts may supply statements or rankings about you. Avoid sharing sensitive information, and only contribute information you have the right to share.

Our reasons for using personal data

We use information necessary to provide a host’s account and games to perform our agreement with that host, or to take steps they request before entering it. We rely on legitimate interests to facilitate games requested by participants, reconnect players, keep the service secure, prevent abuse, answer ordinary support questions, and retain evidence of terms acceptance. Those interests must be balanced against your rights; you can object to processing based on legitimate interests.

We also process information where necessary to meet legal obligations, including responding to privacy requests. Agreement to the Terms & Conditions does not give blanket consent to personal-data processing. Ranking does not use your game data for advertising or sell it, and the app does not include advertising or analytics trackers.

Who can see information

The host can manage statements and games. Names, statements, group rankings, and scores are shown to participants during play. In the discussion phase, the host can choose a player’s submitted ranking to show to the group. Do not treat your ballot as permanently private. Account email addresses are not included in public game data.

People with a game link or room code may be able to join or contribute while the game permits it. Hosts and participants can share or capture what they see, so use care with game links and content.

Bruce Martens can access information as needed to operate Ranking and handle support or privacy requests. Our providers process information to supply their services:

• Railway: hosts the application and database, including account and game information and operational logs.
• Resend: delivers sign-in emails and processes the recipient address, email content (including the sign-in link), and delivery information.
• Google’s Gmail: handles messages sent to our contact email address.

Information may also be disclosed where required by law or necessary to address abuse or protect legal rights.

International processing

These providers operate internationally, and information may be processed outside the European Economic Area, including in the United States. Their published data-protection terms describe applicable transfer arrangements: Railway’s data processing addendum, Resend’s legal documents, and Google’s transfer frameworks. Railway and Resend’s published addenda include standard contractual clauses for relevant transfers. Contact us for details about the arrangements applicable to your information or to request a copy of relevant safeguards.

Data handling and retention

Accounts and games: account details and terms acceptance remain while your account is retained. Games and their contents remain available to the host until the host deletes the game or we handle a deletion request. Completed games and inactive accounts are not currently deleted automatically. A host can delete a game through My games; this removes its statements, player records, rankings, rounds, and scores from the active database.

Sign-in records: email links expire after 15 minutes and work once; account sessions expire after 30 days. Logging out removes the current account session. Expiry prevents access but does not automatically erase stored link or expired-session records. Removing these records requires manual handling; contact us to request their deletion, including when closing your account.

Requests, logs, and copies: correspondence is retained for handling your request and any necessary follow-up. Hosting and email delivery logs and any backup copies have separate provider retention settings; deleting a game does not guarantee immediate removal from those copies or from participants’ own copies. Contact us for details about a particular record. Where information must be retained for a legal obligation or a specific dispute, we will explain the applicable reason and retention criteria when responding to your request.

Protecting access: the service uses HTTPS, restricted host access, and checks designed to prevent unauthorized account actions. Account sign-in and session tokens are stored as hashes in our database. Player reconnection credentials are stored separately to reconnect players to their games. No online service can guarantee absolute security. Do not share sign-in links or use sensitive information in statements.

Cookies and storage on your device

We only use cookies and browser storage to keep Ranking working: signing you in, protecting requests, and letting you resume a game. We do not use analytics or advertising trackers. There are no optional cookies to accept or reject.

• Sign-in cookie: ranking_session keeps hosts signed in for up to 30 days.
• Request-protection cookie: ranking_csrf helps prevent unauthorized browser requests. It lasts for the browser session before sign-in, or up to 30 days after sign-in. Logging out clears both account cookies.
• Game storage: player reconnection credentials and ranking drafts are saved in your browser’s local storage so you can resume. This storage has no fixed time-based expiry and can remain until the app removes it or you clear site data in your browser.

You can clear cookies and site data in your browser settings. This can sign you out, remove saved drafts, and prevent you from rejoining as the same player.

Your choices and rights

You can request access to your personal data, correction, deletion, restriction of processing, and, where applicable, a portable copy. You can object to uses based on legitimate interests. If we ever rely on your consent for an optional use, you can withdraw it without affecting processing that was lawful before withdrawal.

Email bmartens2112@gmail.com to make a request or ask to close your account. For account requests, use your account email if possible. For player or statement requests, provide enough context to locate the information, such as the game code and nickname. We may ask for proportionate information to verify your identity and protect other participants’ data. Do not send passwords, sign-in links, or identity documents unless we explain why additional verification is needed.

We will respond without undue delay and normally within one month. Where the law permits more time for a complex or numerous request, we will explain the extension within that first month. Rights can have exceptions, which we will explain if relevant. You can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local data protection authority.

Changes to this notice

We will update this page when our data practices change and show the revision date above. We will bring significant changes to your attention where required. This notice provides information; it does not require a separate agreement checkbox.