Last updated 2026-10-29

Privacy policy

Gambure is an app for keeping score of the games you play with your friends. This policy explains what personal data Gambure processes, why, and what your rights are.

1. Who is responsible

The controller under the GDPR is:

Maximilian Schnabl
Münzgrabenstraße 116, 8010 Graz, Austria
Email: contact@gambure.app

Gambure is a private, non-commercial project. There is no data protection officer.

2. What we process and why

Your account. You sign in with your email address (confirmed by a one-time code), with Apple or with Google. Our sign-in provider Clerk stores your email address and, for Apple or Google, the account identifier those services give us. Gambure itself stores a link to your Clerk account, your username, your display name, your friend code, your avatar (an illustration you choose, not a photo), the sign-in method and the date you joined. Gambure itself never stores your email address. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).

What you do in the app. Your friends and friend requests, your groups and group invites, the games your groups create (name and rules), the games and equipment on your shelf, and your matches: who played, the teams, the scores, the rounds, the winner, the time, and who entered the match. Legal basis: Art. 6(1)(b) GDPR.

Guests. You can add people without an account as guests to your matches. A guest has only the name you give them. Only you can pick your guests; the other players of a match see the guest’s name in that match. Give a guest only a name the person agrees to, such as a first name. Legal basis: Art. 6(1)(b) GDPR for you, and our legitimate interest in correct results (Art. 6(1)(f) GDPR) for the guest.

Server logs. When the app talks to our server, the server records the requested path, the time and the result. We use this to run the service and to find errors. The logs do not contain your IP address. To limit sign-in attempts against abuse, the server keeps your IP address in memory for a few minutes only, and it never writes it to disk. Logs are deleted after 15 days. Legal basis: our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR).

Reports. If you report a user or content, we process the report, the reported content and your username to handle it. Legal basis: Art. 6(1)(f) GDPR and our terms of use.

Camera. The app uses the camera only to scan a friend’s QR code. The picture is processed on your device and is never stored or sent to us.

On your device. The app stores your sign-in session in the device’s secure storage and your chosen view (all friends or a group) in app storage. Nothing is used for tracking.

We do not use advertising, analytics or tracking, we do not sell data, and we do not make automated decisions about you.

3. Who can see your data

• Any Gambure user can find you by your username, display name or friend code and see your username, display name, avatar and the number of mutual friends.
• Your friends also see your statistics and your match history.
• Members of your groups see your matches in that group and the games on your shelf.
• The other players of a match see that match.

4. Service providers

• Clerk, Inc. (USA): sign-in and account management. Transfer basis: the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and a data processing agreement.
• OVHcloud (Frankfurt, Germany, EU): hosting of the server and the database. A data processing agreement is in place.
• Apple and Google: if you sign in with Apple or Google, they confirm your identity to us. For this they act under their own privacy policies.
• Apple App Store and Google Play deliver the app and process data about the download under their own privacy policies.

5. How long we keep data

We keep your data as long as you have an account. When you delete your account:

• we delete your account at Clerk, your friendships, friend requests, group memberships and invites, your shelf and your guests;
• a group you managed passes to another member, and a group with no other member is deleted;
• in the matches you played, your name is replaced by “Deleted player”, so that the results and statistics of the other players stay correct. These entries can no longer be linked to you.

Server logs are deleted after 15 days.

6. Deleting your account

In the app: Me → Delete account. Without the app: see Delete your account.

7. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Write to contact@gambure.app.

You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb.gv.at.

8. Age

Gambure is for people aged 14 and older.

9. Changes

If we change this policy, we update the date above and tell you in the app if the change is significant.