Privacy Notice

Last updated: 28 October 2026

This is an English translation of the Hungarian original, which prevails if the two differ.

This notice explains, as Article 13 of the EU General Data Protection Regulation (GDPR) requires, how we handle your data on cloud-apps.net, in its apps (they run on subdomains of cloud-apps.net, such as sudoku.cloud-apps.net) and on the developers portal at developers.cloud-apps.net. Cookies and the data stored on your device are covered in detail by the Cookie Policy.

1. Who handles your data

The controller is the operator of cloud-apps.net, a private individual based in Hungary who runs it as a hobby project — “we” in this notice:

• Name: Bence Berényi
• E-mail: [to be filled in: operator.email]

We have not appointed a data protection officer, as we are not required to. For any privacy question, write to us at the e-mail address above.

2. What data we handle, why and for how long

Below, for each kind of processing, we describe what data we handle, why, on what legal basis and for how long. We use no data for advertising or profiling, nor for automated decisions that would have legal effects on you.

2.1 Your account

• Data: your e-mail address; your display name (up to 40 characters); a scrypt hash of your password (we never store the password itself); your language; when you signed up; whether you confirmed your e-mail address; who invited you (if anyone); which version of the terms you accepted and when; when you last signed in and last changed your password; the status of the account (for example, if we have suspended it); whether you have developer access; and whether you are a tester. We choose the testers: they can also see and open apps still in development, which are hidden from everyone else.
• Purpose: running your account: signing in, managing your access and staying in touch with you.
• Legal basis: performance of a contract (Article 6(1)(b) GDPR). Without an e-mail address, a name and a password (or Google sign-in), we can’t open an account.
• How long: until you delete your account. Deletion from the live database is immediate; from the backups, the data disappears within about 6 months (see Backups).

2.2 Signing in with Google

If you choose “Continue with Google”, we keep this from Google: your Google account ID, your e-mail address, whether Google has verified that address, and your name. Because of the profile permission we ask for, Google also sends your profile picture and language, but we discard them. We have no access to your contacts.

If you sign up with Google, your account is created only once you have entered your display name and accepted the terms. Until then, the details from Google wait with the unfinished sign-up.

If an account with your Google e-mail address already exists here, we connect the two only if you confirm it from a link we send to that address.

Google is responsible for its own processing as an independent controller (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). You sign in on Google’s own page, where Google’s privacy policy applies.

• Legal basis: performance of a contract (Article 6(1)(b) GDPR) — you choose this way of signing in.
• How long: until you delete your account. The details of an unfinished sign-up wait for at most 30 minutes and are then deleted within 7 days.

2.3 Sessions

To keep you signed in, we store a random token in your browser (in the __Host-ca_sid cookie); we keep only its hash. Alongside it, we record your device’s browser and operating system (user agent), when the session was created and when you last used it.

• Purpose: keeping you signed in, and making a sign-in from an unfamiliar device recognisable.
• Legal basis: performance of a contract (Article 6(1)(b) GDPR); for the security data, our legitimate interest in protecting accounts (Article 6(1)(f) GDPR).
• How long: 60 days, renewed while you use it. If you switch off “Keep me signed in on this device” when you sign in, only until you close the browser, and 1 day at most. Signing out ends the session.

2.4 Sign-in protection

To stop anyone from trying out passwords, we count failed sign-in attempts per e-mail address and per IP address.

• Legal basis: our legitimate interest in the security of accounts and of the service (Article 6(1)(f) GDPR).
• How long: up to 24 hours.

2.5 Sign-in history

For every sign-in, we record the time, the method (password, Google or a link from an e-mail), the network part of your IP address and your browser. Only the network part of the IP address is kept (the first three numbers of an IPv4 address, the first 48 bits of an IPv6 address), never the full address. You can see your recent sign-ins on the account page. We also make anonymous daily totals from this history, such as how many sign-ins there were on a day.

• Purpose: protecting your account, so that both you and we can spot suspicious sign-ins.
• Legal basis: our legitimate interest in the security of accounts (Article 6(1)(f) GDPR).
• How long: 90 days.

2.6 E-mails

We only send the e-mails your account needs: confirming your e-mail address, resetting your password, confirming a connection to a Google account and, possibly, later, important notices about the service. We don’t send newsletters or advertising.

The links in these e-mails work once and expire: the address confirmation after 48 hours, the password reset after 1 hour, the Google connection after 30 minutes. We keep only a hash of each link, and delete that too 7 days after it expires. Our processor, Brevo, delivers the e-mails (see section 3).

Brevo puts a tracking pixel into every e-mail and sends the links through its own server; on our plan, this can’t be switched off. So we have set this tracking to anonymous: Brevo counts opens and clicks only as anonymous totals, with no e-mail address, message ID or clicked link in its logs, and nothing tied to you. We never use these figures.

• Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• How long: the hashes of the links, until 7 days after they expire.

2.7 App data

We store your favourite apps, the apps you opened recently (you can clear this list on the home screen at any time) and the apps’ synced documents — your game progress and settings, for example. A document can be up to 256 KB, with up to 32 per app. For syncing, we also store when a document was changed and a random identifier of your device, so that we can merge changes coming from different devices.

• Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• How long: until you delete your account; an app may overwrite its documents as you play. If you want one app’s data deleted separately, write to us.

2.8 Friends and invites

We store who is friends with whom and since when, and your invites: a hash of the link (not the link itself), when it expires (14 days by default), how many times and by whom it was used, and the note, if you wrote one (apart from you, only we see it, for administration). If someone signs up with your invite, we record on their account that you invited them. Your friends see your display name, how long you have been friends and, if you have one, your Supporter badge (see 2.12). Whoever opens your invite link also sees your display name.

• Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• How long: until you remove the friendship or the invite, the invite expires, or the account is deleted.

2.9 Leaderboards

Some games keep your best score per leaderboard in your account: the app, the leaderboard, the score and when you achieved it. Your scores are seen only by you and your direct friends, together with your display name and, if you have one, your Supporter badge (see 2.12); there are no public leaderboards. Your scores are also included in your “Download my data” file.

• Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• How long: until you delete your account; they are deleted together with it.

2.10 Usage statistics — only with your consent

If you consent and are signed in, we record which app you used on which day: the time of your first and last activity that day, how many times you opened it, and roughly how many minutes it was in use. This shows us which apps people enjoy and what is worth working on. Only with your consent do we also count how many times in total you opened the apps you used recently; the list of recently opened apps itself is part of the home screen and needs no consent (see 2.7).

Your consent is given per browser: it applies in the browser where you gave it. Without your consent, we record none of this.

• Legal basis: your consent (Article 6(1)(a) GDPR, and section 155(4) of the Hungarian Act C of 2003 on electronic communications, Eht.).
• How long: the daily records, 90 days, tied to your account. After that, only daily totals remain (for example, how many people used an app), from which no one can be identified. The total number of opens is deleted together with the list of recently opened apps.
• Withdrawal: at any time, under “Cookie settings”: in the footer of cloud-apps.net, in the account menu of any app, or on the account page. We then stop recording in that browser and, if you are signed in, also delete the statistics collected for your account so far. Withdrawal does not affect the lawfulness of the processing before it.

2.11 Record of your consent

To be able to show what you chose and when, we record your choice, its time, a random consent ID, your account ID (if you are signed in) and which version of the Cookie Policy was in force at the time.

• Legal basis: legal obligation: we must be able to demonstrate consent (Article 6(1)(c) and Article 7(1) GDPR).
• How long: 18 months. If you delete your account, the account ID is removed from the record too.

2.12 Donations and the Supporter badge

Voluntary donations are handled by PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg), which is responsible for the payment as an independent controller, under its own privacy statement. We never see your card or PayPal account details, and we handle no other payment data. As with any PayPal payment, PayPal shows the recipient — that is, us — the donor’s name and e-mail address, the amount and the time in our PayPal account; we use these only to deal with donations (for example if something went wrong with a payment).

On the Support page, PayPal’s donate button is shown inside a frame. The button’s script and image load only on that page, from PayPal’s servers (www.paypalobjects.com), so PayPal receives your IP address and browser details, as with any web request.

After a donation, PayPal sends you back to /donation/thank-you, with the transaction’s ID, amount, currency and status in the address. If you are signed in, we store these with your account so that it gets the Supporter badge (a heart), and we may check the transaction with PayPal by sending it the transaction ID. From PayPal’s answer we keep only the payment’s status, amount and currency; the rest of it, such as the donor’s name and e-mail address, we discard. If you are not signed in, nothing is stored on the server: your browser keeps the pending claim in sessionStorage (dash.support), and it reaches your account only if you sign in in that tab (see the Cookie Policy).

The badge is symbolic and comes with no advantages. It shows on your account page and to your friends (in the friends list and on the games’ leaderboards); they don’t see the amount or the transaction details. We can also give the badge by hand, and take it back if a donation isn’t genuine.

• Data: the transaction’s ID, amount, currency and status; whether PayPal has confirmed it; when you got the badge; and, if we gave it by hand or took it back, that fact and when.
• Legal basis: for the badge, performance of a contract (Article 6(1)(b) GDPR): you ask for it by donating while signed in, or by signing in after donating. For loading the PayPal button and for what we see in our PayPal account, our legitimate interest in receiving and handling donations safely through PayPal (Article 6(1)(f) GDPR).
• How long: the badge data until you delete your account (even if the badge was taken back); it is deleted together with the account. What we see in our PayPal account stays there under PayPal’s rules.

2.13 Feedback

If you call off a donation, PayPal sends you back to /donation/cancel. There, if you like, you can tell us why: you can pick a reason from a set list and write a short message too (up to 1,000 characters). If you are signed in, we store your feedback with your account; otherwise anonymously, without an account; either way, with the page’s language and the time. We use it only to make the site better. Please don’t put personal data in the message.

• Legal basis: our legitimate interest in improving the website based on feedback (Article 6(1)(f) GDPR). Sending feedback is optional.
• How long: 365 days. If you delete your account in the meantime, the feedback stays, no longer tied to your account, until the 365 days are up.

2.14 Developers portal

If you request developer access, we store the message of your request and the decision. As an approved developer, we also store the app ideas and specifications you submit, and the build runs (when an app is built from a specification). To draft them, we send the submitted texts to Anthropic’s artificial intelligence through its API; Anthropic acts as our processor, on our behalf (see section 3). Please don’t put personal data in the texts you submit.

• Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• How long: until you ask us to delete them — they are not removed automatically when you delete your account. Write to us and we delete them within a month. Apps that have already gone live stay published as part of cloud-apps.net.

2.15 Suspensions and bans

In case of abuse (for example cheating, harassment, unlawful content, attacks on the service or repeated breaches of the terms), we may suspend or ban an account (see section 12 of the Terms of Use). A suspension is recorded in the account’s status (see 2.1). When we ban an account, we keep its e-mail address and, if there is one, the ID of the Google account connected to it, with the date and reason of the ban, even after the account is deleted, so that the same person cannot sign up again. A suspended or banned account can’t be signed in to: if you then want your data, or the account deleted, write to us.

• Legal basis: our legitimate interest in protecting the service and its users (Article 6(1)(f) GDPR).
• How long: until the ban is lifted.

2.16 Server logs

We keep no access log of individual requests. The server and the apps keep technical logs (of errors and system messages), which may contain an IP address, the address requested and browser details.

• Purpose: the security and operation of the service: tracking down errors and attacks.
• Legal basis: our legitimate interest (Article 6(1)(f) GDPR).
• How long: at most 14 days.

2.17 Administration and security log

We record administrative actions and actions that affect the security of accounts (for example deleting or banning an account, or connecting or disconnecting a Google account) in an internal log, with internal identifiers and without e-mail addresses.

• Purpose: so that it can be checked later what happened and when.
• Legal basis: our legitimate interest in accountability and security (Article 6(1)(f) GDPR).
• How long: 2 years.

2.18 Backups

Every night, an encrypted backup of the database is made (with restic) and kept away from our server, in Cloudflare R2 storage. The encryption happens on our server; Cloudflare doesn’t know the key. Of these, we keep the last 7 daily, 4 weekly and 6 monthly backups. In addition, the server makes a local copy every day and deletes it after 7 days.

• Purpose: being able to restore the service after a failure or an attack.
• Legal basis: our legitimate interest in the security and recoverability of the data (Article 6(1)(f) GDPR).
• How long: the off-site backups for up to about 6 months, the local copies for 7 days. Deleted data therefore disappears from the backups within about 6 months.

3. Who has access to your data

We never sell your data, and we pass it only to the service providers (processors) needed to run the service. They handle it on our behalf, and only as much of it as their task needs:

• DA International Group Ltd. (AlphaVPS) (hosting) — runs our server, located in Nuremberg, Germany. Address: 8 Asen Yordanov Blvd., Sofia, Bulgaria.
• Google Ireland Limited (Ireland) — the domain’s DNS, on Google Cloud DNS, until we switch to Cloudflare.
• Cloudflare, Inc. (USA) — the storage of the encrypted backups (R2). After the switch, also the domain’s DNS, content delivery and DDoS protection: the website’s traffic then passes through Cloudflare’s network, so Cloudflare also sees your IP address and your requests.
• Brevo SAS (e-mail) — delivers the e-mails about your account; it counts opens and clicks only anonymously (see 2.6). Registered office: 9-17 rue Salneuve, 75017 Paris, France.
• Anthropic (for EEA customers: Anthropic Ireland, Limited; it may also process the data in the USA) — only on the developers portal: drafts from the texts you submit.

Google, for Google sign-in, and PayPal, for donations, are independent controllers (see 2.2 and 2.12); when we check a transaction with PayPal, we send it the transaction ID. Your friends see your display name, your leaderboard scores and your Supporter badge (see 2.8, 2.9 and 2.12), and whoever opens your invite link sees your display name (see 2.8). We disclose data to authorities or courts only where the law requires us to.

4. Transfers outside the European Union

Our server and our database are in the European Union (Nuremberg, Germany). Cloudflare is a US company, and Anthropic may also process the data in the USA, so the data they handle may also reach the United States. Such transfers are protected by appropriate safeguards: the EU–US Data Privacy Framework and/or the standard contractual clauses adopted by the European Commission. PayPal, as an independent controller, may transfer data outside the European Union under its own privacy statement.

5. How we protect your data

• Every connection is encrypted (TLS).
• Passwords are stored only as scrypt hashes, and tokens (sessions, invites, e-mail links) only as hashes too.
• The cookie that keeps you signed in is HttpOnly: code running on the page can’t read it.
• Off-site backups are encrypted.
• We administer the service only from our own computer, over SSH — never through the website.
• If a personal data breach ever happens, we report it to the authority as the law requires, and if it puts you at high risk, we tell you too.

6. Your rights

• Access: you can find out what data we hold about you and ask for a copy.
• Rectification: you can ask us to correct inaccurate data.
• Erasure: you can ask us to delete your data, or delete your account yourself.
• Restriction: in certain cases — for example while we check disputed data — you can ask us only to store the data and not to use it.
• Portability: you can get your data in a machine-readable format (JSON).
• Objection: you can object to processing based on legitimate interest. We then stop, unless we have a stronger, lawful reason to continue (investigating an attack, for example).
• Withdrawing consent: you can withdraw your consent to the statistics at any time.

You can do most of this yourself on the account page: download your data as a JSON file (“Download my data”), delete your account, and change your cookie settings (you can also do this in the footer of cloud-apps.net and in the account menu of any app). You can clear the list of recently opened apps on the home screen.

For anything else, write to us: [to be filled in: operator.email]. We reply within one month. To make sure we are answering you, write from your account’s e-mail address, or we may ask you to confirm that it’s you. Exercising your rights is free of charge.

7. Complaints

If you feel we have not respected your rights, it’s worth writing to us first — we will try to sort it out quickly. You can also lodge a complaint with the Hungarian data protection authority, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH):

• Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
• Postal address: 1363 Budapest, Pf. 9., Hungary
• E-mail: ugyfelszolgalat@naih.hu
• Web: naih.hu

If you live in another EU country, you can also turn to the data protection authority there. You can also go to court; in Hungary, you can bring the case before the regional court (törvényszék) of your place of residence or stay.

8. Children

You must be 16 or older to open an account. If you are a parent and believe your child under 16 has signed up anyway, write to us and we will delete the account.

9. Changes to this notice

If we change this notice, we update the date at the top of the page and show you the change at your next visit, on cloud-apps.net and in the apps. A material change applies to you once you accept it; if you don’t accept it, you can delete your account.