§ 1 Provider & Legal Notice

The party responsible for the game Curvix is:

[ANBIETER_NAME / FIRMENNAME]
[STRASSE UND HAUSNUMMER]
[PLZ ORT, LAND]
E-Mail: [KONTAKT@DOMAIN.COM]

Hereinafter referred to as the "Provider".

§ 2 Scope

These Terms of Use apply to the game Curvix, which is available worldwide as a web app, mobile app (iOS & Android via App Store and Google Play), and desktop application (Windows/macOS).

By registering or using the online features, you expressly agree to these terms. If you do not accept these terms, you may not use the online service.

Regardless of your place of residence, Part II (Privacy) of this page applies. In addition, mandatory local data protection laws of your country of residence may apply (e.g. GDPR in the EU, CCPA in California, LGPD in Brazil, PIPEDA in Canada).

§ 3 Player Account & Registration

An account is required to use online mode. All information provided during registration must be truthful.

Minimum age: Use of the service requires a minimum age of 13 years. For users between 13 and 15 years of age, parental or guardian consent is required. Children under 13 may not use the service.

COPPA (USA): Curvix is not directed at children under the age of 13. Since we do not collect any real personal data (no real name, no email address, no date of birth), it is technically not possible to identify users outside the game. The minimum age of 13 nevertheless applies as a condition of use.

• Only one account per person is permitted.
• You are responsible for keeping your login credentials confidential.
• You may not transfer or sell your account to third parties.
• Accounts can be deleted upon request (see § 17 Data Subject Rights).

§ 4 Rules of Conduct & Prohibited Actions

The following actions are expressly prohibited:

• Use of cheats, hacks, exploits, or third-party software to manipulate the game
• Manipulation of API requests, local storage, or network traffic
• Automated requests, bots, or scripts without explicit written permission
• Insults, hate speech, discrimination, or threats directed at other users
• Use of inappropriate, racist, or offensive usernames
• Reverse engineering, decompiling, or disassembling the game code
• Attempting to gain unauthorized access to servers, databases, or other user accounts
• Sharing or publishing game content without permission

Violations may result in permanent account suspension without prior warning. In the case of serious violations, we reserve the right to take legal action.

§ 5 Virtual Goods & In-Game Currency

Coins are a purely in-game currency with no real-world value. They cannot be exchanged for real money, transferred, or inherited.

To the extent that in-game purchases are offered:

• Purchases are final and non-refundable unless a statutory right exists.
• Consumers in the EU generally have a 14-day right of withdrawal for digital goods. By clicking "Buy" you consent to immediate delivery of the digital content and thereby expressly waive your right of withdrawal (Art. 16(m) Consumer Rights Directive).
• The Provider reserves the right to change coin prices and requirements at any time.

In-app purchases are processed — depending on platform — via the following payment service providers: Stripe (web and desktop), Apple App Store (iOS), Google Play Store (Android). Card and bank details are processed exclusively by these providers — the Provider has no access to them at any time (see § 13).

Items unlocked or purchased (skins, colors, etc.) are personalized digital content and cannot be transferred to other accounts.

§ 6 Intellectual Property

All content of the game — including but not limited to source code, graphics, sounds, animations, game mechanics, trademarks, and text — is the copyrighted property of the Provider.

It is not permitted to copy, modify, distribute, rent, sell, or create derivative works from game content without explicit written permission.

Creating screenshots and videos for private or non-commercial purposes (e.g. gameplay videos on platforms such as YouTube or Twitch) is permitted, provided that a clear attribution to the source is given.

§ 7 Availability & Limitation of Liability

The game is provided "as is". The Provider does not guarantee:

• Uninterrupted or permanent operation of the service
• Freedom from errors or complete security of the software
• Loss of game saves, virtual goods, or account information due to technical failures

The Provider's liability is limited to intent and gross negligence, unless mandatory statutory provisions provide otherwise. For minor negligence, the Provider is liable only in the event of a breach of essential contractual obligations, limited to foreseeable damage.

The Provider reserves the right to suspend, modify, or restrict the service at any time — including permanently.

§ 8 Amendments to the Terms of Use

These Terms of Use may be amended at any time. Material changes will be announced in the game or by email (if provided) at least 14 days before they take effect.

Continued use of the game after amended terms take effect constitutes acceptance. If a user does not accept the changes, they have the right to request deletion of their account.

§ 9 Governing Law & Place of Jurisdiction

Swiss law applies (CO/CC), excluding the UN Convention on Contracts for the International Sale of Goods (CISG).

Regardless of this choice of law, mandatory consumer protection and data protection provisions of the user's country of residence remain unaffected at all times. In particular: GDPR for EU/EEA users, CCPA/CPRA for users in California, LGPD for users in Brazil, PIPEDA for users in Canada.

The exclusive place of jurisdiction for all disputes arising from or in connection with these Terms of Use is [ORT IN DER SCHWEIZ], to the extent permitted by law.

The European Commission provides an online dispute resolution platform at ec.europa.eu/consumers/odr. The Provider is neither obligated nor willing to participate in dispute resolution proceedings before a consumer arbitration board.

§ 10 Data Controller & Contact

The data controller within the meaning of the Swiss Data Protection Act (Swiss DPA (DSG)) and — where applicable — the EU General Data Protection Regulation (GDPR, Art. 3(2)) is the Provider named in § 1. Switzerland holds an EU adequacy decision (Art. 45 GDPR), which means its level of data protection is recognized as equivalent.

For data protection inquiries, please contact:
[KONTAKT@DOMAIN.COM]

§ 11 Data We Process

Curvix is developed according to the principle of "Privacy by Design": account data is freely invented and is not linked to the user's real identity.

We process exclusively the following data required for game operation:

• Pseudonymous username: Freely invented, with no reference to real name or real identity.
• Password: Stored exclusively as a bcrypt hash — the plaintext is never known to us at any time.
• Email address (optional): May be provided voluntarily, solely for the purpose of password recovery. Not used for advertising, newsletters, or any other purpose. Can be deleted at any time.
• Game statistics & purchases: Game progress, coins, Elo rating, won/lost matches, unlocked and purchased content — necessary for game functionality.
• Platform IDs (optional): When signing in via Google or Apple Game Center, the stable, platform-generated user ID. No access to real name, email address, profile picture, or any other profile information.
• Technical connection data: IP address and timestamps for security purposes and abuse prevention — stored for a maximum of 30 days, then automatically deleted.
• Session token: JWT-based, stored exclusively locally on the user's device.

We do not collect real names, dates of birth, location data, or device identifiers. Payment data (card numbers, bank details) is processed for in-app purchases directly by the respective payment service provider (Stripe, Apple App Store, Google Play Store) — the Provider only receives a session ID and the payment status (see § 13). Providing an email address is voluntary — full use of the game is possible without an email address.

§ 12 Legal Bases for Processing

• Performance of contract (Art. 6(1)(b) GDPR / Art. 31 Swiss DPA (DSG)): Account data, game statistics, and purchases are processed to provide the service.
• Legitimate interests (Art. 6(1)(f) GDPR): Connection logs for security and abuse prevention.
• Consent (Art. 6(1)(a) GDPR): The voluntarily provided email address is stored solely on the basis of the user's consent for the purpose of password recovery. This consent can be withdrawn at any time (deletion of the email address at [KONTAKT@DOMAIN.COM]).

§ 13 Third Parties & Disclosure

Personal data is not sold. The following third-party services are used:

Authentication:

• Google Sign-In / Google Play Games (Google LLC): When signing in via Google, your Google user ID (sub claim) is transmitted to our server. Google processes data in accordance with its own privacy policy. Further information: policies.google.com/privacy
• Apple Game Center (Apple Inc.): When signing in via Game Center, Apple transmits a signed player ID. Apple processes data in accordance with its own privacy policy. Further information: apple.com/legal/privacy

Payment processing:

• Stripe (Stripe Payments Europe Ltd., Ireland — main processor for EU/EEA; Stripe, Inc., USA): When making coin purchases via web or desktop, card and bank details are transmitted directly to Stripe. We only receive a session ID and the payment status — no card or account data. Transfers to the USA are based on the EU Standard Contractual Clauses (SCC). Stripe acts as a processor under Art. 28 GDPR. Further information: stripe.com/privacy
• Apple App Store / Google Play Store (Apple Inc., USA / Google LLC, USA): In-app purchases in the mobile versions (iOS / Android) are processed directly via the respective app store. Card and bank details are processed exclusively by Apple or Google — we only receive a cryptographically signed receipt to verify the purchase.

Disclosure to other third parties only occurs under a legal obligation (e.g. official request by authorities).

§ 14 Retention Periods

• Account data: Until the account is deleted or upon the user's request.
• Email address: Until account deletion or upon a separate request (possible without deleting the account).
• Password reset token: Maximum 1 hour from issuance, then automatically invalidated.
• Connection logs: Maximum 30 days, then automatically deleted.
• Game statistics: For the duration of the account's existence; deleted upon account closure.

§ 15 International Data Transfers & Storage Location

All data is stored and processed on servers in Switzerland. Switzerland holds an EU adequacy decision — data transfers from the EU to Switzerland are therefore permitted without additional measures.

No transfer of personal data to countries without an adequate level of data protection takes place. To the extent that third-party providers (Google, Apple) transfer data to other countries, this is done within the framework of their own data protection mechanisms (standard contractual clauses, Privacy Shield successor arrangements, etc.).

§ 16 Special Rights Under Local Law

Users in the EU / EEA (GDPR): The rights set out in § 17 apply. The competent supervisory authority is the data protection authority of your member state.

Users in California, USA (CCPA/CPRA): You have the right to know what personal data we have collected about you, the right to deletion, and the right to opt out of the sale of your data. We do not sell personal data. Requests can be sent to: [KONTAKT@DOMAIN.COM]

Users in Brazil (LGPD): You have the right to access, rectification, deletion, data portability, and withdrawal of consent. Requests can be sent to: [KONTAKT@DOMAIN.COM]

Users in Canada (PIPEDA): You have the right to access your data, correct inaccurate data, and withdraw consent to data processing. Requests can be sent to: [KONTAKT@DOMAIN.COM]

USA – COPPA: Since Curvix does not collect personal data within the meaning of COPPA (no real name, no email address, no date of birth), users cannot be identified outside the game. The minimum age of 13 still applies as a condition of use. Parents may request deletion of an account at [KONTAKT@DOMAIN.COM].

§ 17 Your Data Subject Rights

You have the following rights regarding your personal data with respect to the Provider:

• Access (Art. 15 GDPR): Right to information about what data is stored about you.
• Rectification (Art. 16 GDPR): Right to correction of inaccurate data.
• Erasure (Art. 17 GDPR): Right to deletion of your data ("right to be forgotten").
• Restriction (Art. 18 GDPR): Right to restriction of processing.
• Data portability (Art. 20 GDPR): Right to receive your data in a common, machine-readable format.
• Objection (Art. 21 GDPR): Right to object to processing.
• Right of Withdrawal of consent (Art. 7(3) GDPR): Consent given can be withdrawn at any time with effect for the future.

Please send requests to exercise these rights to: [KONTAKT@DOMAIN.COM]

You also have the right to lodge a complaint with the competent data protection supervisory authority. For users in Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch. Users residing in the EU may contact the data protection authority of their member state.

§ 18 Data Security

We use technical and organizational measures to protect your data:

• Passwords are stored exclusively as bcrypt hashes — plaintext passwords are never known to us.
• All connections to the server are encrypted via HTTPS/TLS.
• Session tokens are signed with HMAC-SHA256 and contain a session version counter that is invalidated upon each new login (single-session protection).
• Access to the production database is restricted to the minimum necessary.

§ 19 Cookies & Local Storage

Curvix does not use tracking cookies or analytics cookies. The application uses exclusively the device's local storage (localStorage) to hold the session token — this is technically necessary for the login function and does not require separate consent. No data is transmitted to advertising networks, analytics services, or advertising platforms.

§ 20 Contact

For questions about these Terms of Use or about data protection:

[ANBIETER_NAME]
[STRASSE UND HAUSNUMMER]
[PLZ ORT, LAND]
E-Mail: [KONTAKT@DOMAIN.COM]

Last updated: April 2026