| Language: |
Magic Pieces – Terms of Use and Legal Documents (version 2026-10-07.1)
These are the same documents the game shows you before you use your game account. Before your game account is unlocked, you also accept the Terms of Use once in the game. The Privacy Policy and the Legal Notice are for your information; accepting does not give consent to advertising or tracking. The Steam version contains no real-money purchases; the paid membership described in section 7 of the Terms of Use is not available there.
----------
1. Scope & provider
These terms of use apply to the use of Magic Pieces (the “Service”), provided by Fatih Kavuncu. You can view and save them here at any time. Before using registered account features, we ask for explicit acceptance using the labelled button. For data processing, see our privacy policy.
2. Service & beta status
Magic Pieces is an online chess game in beta. The services and any prices described in the respective offer apply. Beta status does not limit agreed services or statutory warranty, refund or other consumer rights.
3. Account & minimum age
Some features require an account. You are responsible for keeping your credentials confidential and for activity under your account. A minimum age applies. See Youth Protection. Information provided at registration must be accurate.
In the Steam version, your account is created automatically with your Steam account. You expressly accept these terms in the game. Merely launching the game or dismissing a notice does not count as acceptance. Declining does not change existing rights from a Steam purchase.
4. Rules of conduct
When using the service, in particular in all communication features (community chat, match chat, direct messages), the following is prohibited:
• insults, hate speech, harassment or threats,
• illegal, youth-endangering or rights-infringing content,
• spam, advertising and the exploitation of technical vulnerabilities,
• fraud, cheating, bots or the manipulation of games and rankings,
• impersonating another identity.
5. Moderation & suspension
We may remove content that violates these terms or applicable law and may warn, suspend or delete accounts in the event of a violation, in the case of serious or repeated violations also without prior notice. Such measures are based on a human review, not on a solely automated decision. You can object to a measure by contacting F.kvnc97@gmail.com.
6. Virtual content (“Souls” & collection)
Content acquired or unlocked in the game, such as the currency Souls, cards/pieces or packs, are purely game elements without real monetary value. They cannot be paid out, traded or converted into real money and grant a simple, revocable right of use within the game.
You earn Souls by playing or receive them via a membership; they are not individually purchasable and not transferable between users. There is no trading and no marketplace between players.
Packs & randomness. Packs contain a randomly determined selection of pieces of various rarity tiers. Packs are not individually purchasable for real money; they come from the earned currency Souls, from in-game rewards or from a membership. In regions whose law prohibits chance-based purchasable content (currently Belgium), buying and opening packs is disabled.
Melting down (“Soul Forge”). You can melt pieces from your collection into Souls at fixed values shown in the game. This, too, creates no real monetary value: credited Souls remain pure game elements within the meaning of this section and can neither be paid out nor transferred.
7. Membership & payments
A paid membership is not yet enabled. The following terms apply once it becomes available.
Membership is optional and does not unlock anything game-decisive (no pay-to-win): it supports development and provides cosmetic and minor convenience benefits. It is a monthly subscription that renews automatically by one month at a time until cancelled. Price, benefits, term and the automatic renewal are shown to you before the contract is concluded during checkout.
Payment processing (merchant of record). We process the checkout and the contract for the paid membership via our reseller Lemon Squeezy (Lemon Squeezy, LLC, a Stripe company) as merchant of record. Lemon Squeezy is your contractual partner for the purchase, issues the invoice, remits VAT and provides you with the statutory withdrawal instructions as well as the management of your subscription. The terms of Lemon Squeezy in the checkout window apply in addition.
Cancellation (§ 312k BGB). You can cancel your subscription at any time with effect from the end of the current billing period, via the management link in your order confirmation from Lemon Squeezy or via the customer account there. After cancellation, the benefits remain active until the end of the period already paid for; the membership then ends automatically.
Right of withdrawal. As a consumer, you generally have a 14-day right of withdrawal. Because the membership provides digital content/services immediately (e.g. the crediting of Souls), the right of withdrawal may expire early if you expressly agree that we begin before the withdrawal period expires and confirm that you thereby lose your right of withdrawal (§ 356(5) BGB). Lemon Squeezy obtains the corresponding consent during checkout.
The in-game currency Souls and other virtual content are not real money and cannot be paid out (see section 6). A membership is not a purchase of Souls but a service; any Souls are a bonus.
8. Rights to content
All rights to the service and its content remain with the provider. For content you submit (e.g. chat messages), you grant us the simple right to store and display it within the scope of the service.
9. Warranty & liability
Statutory warranty rights remain unaffected. We are liable without limitation in cases of intent and gross negligence and for injury to life, body and health. In the case of simple negligence, we are liable only for the breach of essential contractual obligations and limited in amount to the foreseeable, typical damage. Essential contractual obligations are those whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance you may regularly rely. Mandatory statutory liability (for example under the Product Liability Act, for fraudulently concealed defects or under a guarantee we have assumed) remains unaffected.
10. Changes & termination
Continuing to play does not by itself make changes binding. Where a new agreement is necessary, we present the new version for explicit acceptance. You can stop using the service and delete your account at any time. Statutory and existing contractual rights remain unaffected.
11. Applicable law
The law of the Federal Republic of Germany applies. If you are a consumer with your habitual residence in another country, the mandatory consumer protection provisions of your country of residence remain unaffected.
----------
1. Controller
The controller for data processing on this service is:
Fatih Kavuncu
Ronnebergweg 43
48151 Münster
Germany
Email: F.kvnc97@gmail.com
No data protection officer has been appointed; the nature and scope of the processing do not trigger that obligation (§ 38 BDSG, Art. 37 GDPR).
2. Hosting & infrastructure
The frontend is delivered via Vercel (Vercel Inc., USA); the game and account logic runs on a server at Fly.io (Fly.io, Inc., USA) operated in the Frankfurt region (EU). The associated PostgreSQL database is therefore physically located in the EU. When the service is accessed, technically necessary connection data is processed (see server log files).
Both providers are US companies and may also process data in the USA or are subject to US law. We base such transfers on the Standard Contractual Clauses of the EU Commission (Art. 46(2)(c) GDPR), supplemented by the EU-U.S. Data Privacy Framework where the provider is certified. The legal basis for operating a secure, functional service is Art. 6(1)(f) GDPR. The full list of recipients is in section 8.
3. Server log files
With each request, the server automatically collects data transmitted by your browser: IP address, date and time, the resource requested, the volume of data transferred, referrer and user agent. This data serves the technical delivery, stability and prevention of misuse (Art. 6(1)(f) GDPR) and is deleted or anonymised after no more than 30 days.
4. User account & sign-in
For an account, you can sign in via magic link (email) or via Google or Discord (OAuth). Authentication is handled via Supabase (Supabase, Inc.). In the course of this we process your email address, a self-chosen display name, and account- and game-related data (e.g. statistics, collection, the in-game currency “Souls”).
The legal basis is the performance of the user contract (Art. 6(1)(b) GDPR).
If you sign in via Google or Discord, we receive this data not from you directly but from the respective provider (information obligation under Art. 14 GDPR). This typically includes your email address, a unique user ID from the provider, and the display/username you have stored there; for Discord additionally, where applicable, your profile picture. The source of this data is solely your existing account with Google or Discord: we do not access any further or publicly available sources. The privacy notices of the respective provider apply in addition.
Sign-in via Steam. In the Steam version, you are signed in automatically with your Steam account. For this, the Steam client creates a sign-in ticket, which we send to the Steam interface of the Valve Corporation (USA) for verification. In the course of this we receive your Steam ID and your Steam display name (only as a suggestion for your display name on first launch), but no email address. The game reports unlocked achievements to Steam. The legal basis is performance of contract (Art. 6(1)(b) GDPR). Valve itself is responsible for processing within Steam; the Valve privacy policy applies in addition.
The sending of sign-in emails (in particular the magic link) is handled technically via the email service provider Resend (Plus Five Five, Inc., USA); your email address is processed in the course of this (processing on our behalf; for the third-country transfer see section 8).
For online matches we process game-related data (display name, your moves, the chosen deck, the result). For matchmaking (ranked/casual queue) and any rating/ranking position, your display name and results are processed and made visible to your opponent and in rankings. The legal basis is performance of contract (Art. 6(1)(b) GDPR) and our legitimate interest in fair competitive operation (Art. 6(1)(f) GDPR).
Recipients of personal data and the respective third-country transfer are summarised in section 8.
5. Local storage (essential)
We do not use tracking or advertising cookies. For sign-in and to save your settings, we use exclusively technically necessary storage in your browser (session token, local settings such as mute state or navigation state). This is exempt from consent under § 25(2) TDDDG because it is strictly necessary for the service you have requested.
Should we use optional services in future (e.g. statistics/analytics), we will first request your consent via our cookie/consent dialog (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time.
6. Communication: community chat, match chat, friends & direct messages
Community chat. If you use the community chat, your messages are stored together with your display name and made visible to other signed-in users (Art. 6(1)(b) and (f) GDPR; the legal bases are performance of contract and the operation of a community). Do not publish any sensitive personal data there. For moderation, contributions may be viewed, hidden or deleted.
Match chat. In online matches against another person you can chat with your opponent. Your first message is only delivered once the opponent accepts the chat request; if they decline, the chat remains closed. Match-chat messages are not stored permanently: they are held only transiently in the game server's memory and are discarded at the latest when the match ends or the server restarts. They are visible exclusively to the two players of the match (Art. 6(1)(b) GDPR).
Friends & direct messages. You can send friend requests to other users and exchange direct messages with friends. We store the friendship status (requesting and requested person, status) and direct messages (sender, recipient, content, read timestamp) until the respective account is deleted (Art. 6(1)(b) GDPR). Direct messages are visible only to sender and recipient; we review them only where there are concrete indications of a legal or rules violation (e.g. a report by the recipient, Art. 6(1)(f) GDPR).
7. Error & crash reports
For stability and security we collect technical error and crash reports. This includes the error message and the technical context (e.g. the function affected, code location/stack trace, the address requested, browser type/user agent) as well as the IP address. This data serves exclusively the detection and correction of errors (Art. 6(1)(f) GDPR).
For this monitoring we use Sentry (Functional Software, Inc., San Francisco, USA) as a processor. Error reports from your browser are transmitted to Sentry via our server. We base the transfer to the USA on the Standard Contractual Clauses (Art. 46(2)(c) GDPR), supplemented by the EU-U.S. Data Privacy Framework. The reports are deleted automatically after the retention period configured at our provider (typically up to 90 days).
8. Recipients & third-country transfers
Data is disclosed to third parties only where necessary for operation or where we are legally obliged to do so. The following service providers process personal data on our behalf (processing under Art. 28 GDPR):
• Vercel Inc., USA: delivery of the frontend (hosting/CDN);
• Fly.io, Inc., USA (server location Frankfurt/EU): operation of the game/account server and PostgreSQL database;
• Supabase, Inc., USA/Singapore (database hosting in the United Kingdom): authentication and account management;
• Functional Software, Inc. (Sentry), USA: error and crash monitoring;
• Plus Five Five, Inc. (Resend), USA: sending of sign-in and system emails.
Where these providers process personal data in a third country (in particular the USA), we base the transfer on the Standard Contractual Clauses of the EU Commission (Art. 46(2)(c) GDPR); for the providers certified accordingly (Vercel, Fly.io, Sentry, Resend) the EU-U.S. Data Privacy Framework applies in addition. We will provide a copy of these safeguards on request at F.kvnc97@gmail.com.
If you play the Steam version, we send your sign-in ticket to the Valve Corporation (USA), which acts as an independent controller (see section 4). This transfer is necessary for the sign-in via Steam that you have chosen (Art. 49(1)(b) GDPR).
The account database is hosted in the United Kingdom. The UK benefits from an adequacy decision of the EU Commission (Art. 45 GDPR), so no additional safeguards are required in that respect.
9. Your rights
You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and a right to object (Art. 21 GDPR). You can withdraw any consent given at any time with effect for the future. To do so, contact F.kvnc97@gmail.com.
You can have your account and the associated data deleted. You also have a right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
The competent authority is generally the state data protection supervisory authority responsible for the provider's location; however, you may contact any supervisory authority, in particular that of your habitual residence or place of work (Art. 77(1) GDPR).
No automated decision with significant effect. In-game calculations (matchmaking, rating/ELO, statistics) serve only the operation of the game; moderation measures such as warnings, suspension or deletion are based on a human review. There is no solely automated decision within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.
You can report security incidents or suspected data misuse at any time to F.kvnc97@gmail.com. In the event of a personal-data breach likely to result in a high risk, we will inform affected users without undue delay (Art. 34 GDPR).
10. Retention period
We store personal data only for as long as necessary for the stated purposes or as required by statutory retention periods. Account data is removed when your account is deleted, unless a retention obligation applies.
Acceptance of the terms. We store the accepted version, language and server-recorded time against your game account. The displayed legal documents are archived for traceability. The purpose is to document the contractual agreement (Art. 6(1)(b) GDPR). The account-specific record is deleted with your account. This is not consent to advertising or tracking.
Payment data. A paid membership is not yet available. Once it is offered, the following applies: if you take out a paid membership, the payment data is processed by our merchant of record Lemon Squeezy (Lemon Squeezy, LLC, a Stripe company) as an independent controller; we ourselves do not receive or store any complete payment-instrument data, only the information necessary for allocation and accounting (e.g. tier, status, subscription and order ID). The legal basis is performance of contract (Art. 6(1)(b) GDPR); we base any transfer to the USA on the Standard Contractual Clauses (Art. 46(2)(c) GDPR). Invoice- and accounting-relevant data is retained for the statutory periods (§ 257 HGB, § 147 AO, typically 6 to 10 years).
11. Minors
The service is not directed at children. A minimum age applies for independently using an account. Details in our youth protection notice.
12. Changes
We will adapt this privacy policy if the data processing changes. The version published here at the time applies.
----------
Service provider
Responsible for the service Magic Pieces:
Fatih Kavuncu
Ronnebergweg 43
48151 Münster
Germany
Contact
Email: F.kvnc97@gmail.com
Phone: 01634930208
Responsible for content (§ 18(2) MStV)
Fatih Kavuncu
Ronnebergweg 43
48151 Münster
Germany
Consumer dispute resolution
We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.
As a provider with ten or fewer employees, the information obligation under § 36(1) no. 1 VSBG does not apply to us anyway by virtue of § 36(3) VSBG; this clarification is provided voluntarily.
The former EU Online Dispute Resolution (ODR) platform was discontinued on 20 July 2025; a link to it is no longer required.
Liability for content
As a service provider, we are responsible for our own content on these pages under the general laws pursuant to § 7(1) DDG. However, under §§ 8 to 10 DDG we are not obliged to monitor transmitted or stored third-party information. Upon becoming aware of legal violations, we will remove the content concerned without delay.
Liability for links
Our service may contain links to external third-party websites over whose content we have no influence. The respective provider is always responsible for such external content. Upon becoming aware of legal violations, such links will be removed without delay.
Copyright
The content, graphics, pieces and works created by the operator on these pages are subject to German copyright law. Third-party contributions (e.g. chat messages) are marked as such. Reproduction, editing or distribution beyond the limits of copyright require our written consent.
----------
Minimum age for an account
Our account policy sets a minimum age of 16 years for independently using an account. Younger users may only use an account with the consent of their legal guardians. Playing without an account remains possible below that age.
When accepting the terms of use, you confirm by self-declaration that you meet this age limit or have the consent of your legal guardians. We do not carry out a technical age-verification check. Legal guardians can contact us at any time at F.kvnc97@gmail.com to have a child's account reviewed or deleted.
Note for players outside the EU
Different age limits apply in some countries. In the USA, children under 13 years may not create an account under our account policy. This policy does not replace any legally required age verification or parental authorisation.
Age rating of the content
Magic Pieces is a strategic chess game with imaginative pieces and contains no drastic depictions of violence, fear or sexuality. It is generally suitable for younger players too. For the Steam version, refer to the age rating displayed in the Steam store. There is no separate USK rating; the assessment here is non-binding.
Chat features: note for parents
The service contains communication features (each usable only with a signed-in account): a community chat, a match chat with the respective online opponent, and direct messages between friends. In the match chat, an opponent's first chat request must be explicitly accepted before their messages become visible; friendships are only formed by mutual confirmation.
Despite moderation, we cannot review all content in advance. We recommend that legal guardians accompany the use by younger children. You can report problematic contributions or notify us at F.kvnc97@gmail.com; we review reports and remove unlawful or youth-endangering content.
Packs: chance-based content
The game includes packs whose content (pieces) is determined by chance. Packs cannot be bought with real money; they can only be acquired with the earned in-game currency or received as rewards, and their contents are not tradeable, not transferable and cannot be paid out. Nevertheless, we recommend that legal guardians talk to children about chance-based reward mechanics.
Responsible contact point
Please direct questions about youth protection to F.kvnc97@gmail.com.
A youth protection officer pursuant to § 7 JMStV has not been appointed: the service contains no content that impairs development or endangers minors, so the obligation to appoint one under § 7(1) JMStV does not apply in the first place.
These are the same documents the game shows you before you use your game account. Before your game account is unlocked, you also accept the Terms of Use once in the game. The Privacy Policy and the Legal Notice are for your information; accepting does not give consent to advertising or tracking. The Steam version contains no real-money purchases; the paid membership described in section 7 of the Terms of Use is not available there.
----------
TERMS OF USE
1. Scope & provider
These terms of use apply to the use of Magic Pieces (the “Service”), provided by Fatih Kavuncu. You can view and save them here at any time. Before using registered account features, we ask for explicit acceptance using the labelled button. For data processing, see our privacy policy.
2. Service & beta status
Magic Pieces is an online chess game in beta. The services and any prices described in the respective offer apply. Beta status does not limit agreed services or statutory warranty, refund or other consumer rights.
3. Account & minimum age
Some features require an account. You are responsible for keeping your credentials confidential and for activity under your account. A minimum age applies. See Youth Protection. Information provided at registration must be accurate.
In the Steam version, your account is created automatically with your Steam account. You expressly accept these terms in the game. Merely launching the game or dismissing a notice does not count as acceptance. Declining does not change existing rights from a Steam purchase.
4. Rules of conduct
When using the service, in particular in all communication features (community chat, match chat, direct messages), the following is prohibited:
• insults, hate speech, harassment or threats,
• illegal, youth-endangering or rights-infringing content,
• spam, advertising and the exploitation of technical vulnerabilities,
• fraud, cheating, bots or the manipulation of games and rankings,
• impersonating another identity.
5. Moderation & suspension
We may remove content that violates these terms or applicable law and may warn, suspend or delete accounts in the event of a violation, in the case of serious or repeated violations also without prior notice. Such measures are based on a human review, not on a solely automated decision. You can object to a measure by contacting F.kvnc97@gmail.com.
6. Virtual content (“Souls” & collection)
Content acquired or unlocked in the game, such as the currency Souls, cards/pieces or packs, are purely game elements without real monetary value. They cannot be paid out, traded or converted into real money and grant a simple, revocable right of use within the game.
You earn Souls by playing or receive them via a membership; they are not individually purchasable and not transferable between users. There is no trading and no marketplace between players.
Packs & randomness. Packs contain a randomly determined selection of pieces of various rarity tiers. Packs are not individually purchasable for real money; they come from the earned currency Souls, from in-game rewards or from a membership. In regions whose law prohibits chance-based purchasable content (currently Belgium), buying and opening packs is disabled.
Melting down (“Soul Forge”). You can melt pieces from your collection into Souls at fixed values shown in the game. This, too, creates no real monetary value: credited Souls remain pure game elements within the meaning of this section and can neither be paid out nor transferred.
7. Membership & payments
A paid membership is not yet enabled. The following terms apply once it becomes available.
Membership is optional and does not unlock anything game-decisive (no pay-to-win): it supports development and provides cosmetic and minor convenience benefits. It is a monthly subscription that renews automatically by one month at a time until cancelled. Price, benefits, term and the automatic renewal are shown to you before the contract is concluded during checkout.
Payment processing (merchant of record). We process the checkout and the contract for the paid membership via our reseller Lemon Squeezy (Lemon Squeezy, LLC, a Stripe company) as merchant of record. Lemon Squeezy is your contractual partner for the purchase, issues the invoice, remits VAT and provides you with the statutory withdrawal instructions as well as the management of your subscription. The terms of Lemon Squeezy in the checkout window apply in addition.
Cancellation (§ 312k BGB). You can cancel your subscription at any time with effect from the end of the current billing period, via the management link in your order confirmation from Lemon Squeezy or via the customer account there. After cancellation, the benefits remain active until the end of the period already paid for; the membership then ends automatically.
Right of withdrawal. As a consumer, you generally have a 14-day right of withdrawal. Because the membership provides digital content/services immediately (e.g. the crediting of Souls), the right of withdrawal may expire early if you expressly agree that we begin before the withdrawal period expires and confirm that you thereby lose your right of withdrawal (§ 356(5) BGB). Lemon Squeezy obtains the corresponding consent during checkout.
The in-game currency Souls and other virtual content are not real money and cannot be paid out (see section 6). A membership is not a purchase of Souls but a service; any Souls are a bonus.
8. Rights to content
All rights to the service and its content remain with the provider. For content you submit (e.g. chat messages), you grant us the simple right to store and display it within the scope of the service.
9. Warranty & liability
Statutory warranty rights remain unaffected. We are liable without limitation in cases of intent and gross negligence and for injury to life, body and health. In the case of simple negligence, we are liable only for the breach of essential contractual obligations and limited in amount to the foreseeable, typical damage. Essential contractual obligations are those whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance you may regularly rely. Mandatory statutory liability (for example under the Product Liability Act, for fraudulently concealed defects or under a guarantee we have assumed) remains unaffected.
10. Changes & termination
Continuing to play does not by itself make changes binding. Where a new agreement is necessary, we present the new version for explicit acceptance. You can stop using the service and delete your account at any time. Statutory and existing contractual rights remain unaffected.
11. Applicable law
The law of the Federal Republic of Germany applies. If you are a consumer with your habitual residence in another country, the mandatory consumer protection provisions of your country of residence remain unaffected.
----------
PRIVACY
1. Controller
The controller for data processing on this service is:
Fatih Kavuncu
Ronnebergweg 43
48151 Münster
Germany
Email: F.kvnc97@gmail.com
No data protection officer has been appointed; the nature and scope of the processing do not trigger that obligation (§ 38 BDSG, Art. 37 GDPR).
2. Hosting & infrastructure
The frontend is delivered via Vercel (Vercel Inc., USA); the game and account logic runs on a server at Fly.io (Fly.io, Inc., USA) operated in the Frankfurt region (EU). The associated PostgreSQL database is therefore physically located in the EU. When the service is accessed, technically necessary connection data is processed (see server log files).
Both providers are US companies and may also process data in the USA or are subject to US law. We base such transfers on the Standard Contractual Clauses of the EU Commission (Art. 46(2)(c) GDPR), supplemented by the EU-U.S. Data Privacy Framework where the provider is certified. The legal basis for operating a secure, functional service is Art. 6(1)(f) GDPR. The full list of recipients is in section 8.
3. Server log files
With each request, the server automatically collects data transmitted by your browser: IP address, date and time, the resource requested, the volume of data transferred, referrer and user agent. This data serves the technical delivery, stability and prevention of misuse (Art. 6(1)(f) GDPR) and is deleted or anonymised after no more than 30 days.
4. User account & sign-in
For an account, you can sign in via magic link (email) or via Google or Discord (OAuth). Authentication is handled via Supabase (Supabase, Inc.). In the course of this we process your email address, a self-chosen display name, and account- and game-related data (e.g. statistics, collection, the in-game currency “Souls”).
The legal basis is the performance of the user contract (Art. 6(1)(b) GDPR).
If you sign in via Google or Discord, we receive this data not from you directly but from the respective provider (information obligation under Art. 14 GDPR). This typically includes your email address, a unique user ID from the provider, and the display/username you have stored there; for Discord additionally, where applicable, your profile picture. The source of this data is solely your existing account with Google or Discord: we do not access any further or publicly available sources. The privacy notices of the respective provider apply in addition.
Sign-in via Steam. In the Steam version, you are signed in automatically with your Steam account. For this, the Steam client creates a sign-in ticket, which we send to the Steam interface of the Valve Corporation (USA) for verification. In the course of this we receive your Steam ID and your Steam display name (only as a suggestion for your display name on first launch), but no email address. The game reports unlocked achievements to Steam. The legal basis is performance of contract (Art. 6(1)(b) GDPR). Valve itself is responsible for processing within Steam; the Valve privacy policy applies in addition.
The sending of sign-in emails (in particular the magic link) is handled technically via the email service provider Resend (Plus Five Five, Inc., USA); your email address is processed in the course of this (processing on our behalf; for the third-country transfer see section 8).
For online matches we process game-related data (display name, your moves, the chosen deck, the result). For matchmaking (ranked/casual queue) and any rating/ranking position, your display name and results are processed and made visible to your opponent and in rankings. The legal basis is performance of contract (Art. 6(1)(b) GDPR) and our legitimate interest in fair competitive operation (Art. 6(1)(f) GDPR).
Recipients of personal data and the respective third-country transfer are summarised in section 8.
5. Local storage (essential)
We do not use tracking or advertising cookies. For sign-in and to save your settings, we use exclusively technically necessary storage in your browser (session token, local settings such as mute state or navigation state). This is exempt from consent under § 25(2) TDDDG because it is strictly necessary for the service you have requested.
Should we use optional services in future (e.g. statistics/analytics), we will first request your consent via our cookie/consent dialog (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time.
6. Communication: community chat, match chat, friends & direct messages
Community chat. If you use the community chat, your messages are stored together with your display name and made visible to other signed-in users (Art. 6(1)(b) and (f) GDPR; the legal bases are performance of contract and the operation of a community). Do not publish any sensitive personal data there. For moderation, contributions may be viewed, hidden or deleted.
Match chat. In online matches against another person you can chat with your opponent. Your first message is only delivered once the opponent accepts the chat request; if they decline, the chat remains closed. Match-chat messages are not stored permanently: they are held only transiently in the game server's memory and are discarded at the latest when the match ends or the server restarts. They are visible exclusively to the two players of the match (Art. 6(1)(b) GDPR).
Friends & direct messages. You can send friend requests to other users and exchange direct messages with friends. We store the friendship status (requesting and requested person, status) and direct messages (sender, recipient, content, read timestamp) until the respective account is deleted (Art. 6(1)(b) GDPR). Direct messages are visible only to sender and recipient; we review them only where there are concrete indications of a legal or rules violation (e.g. a report by the recipient, Art. 6(1)(f) GDPR).
7. Error & crash reports
For stability and security we collect technical error and crash reports. This includes the error message and the technical context (e.g. the function affected, code location/stack trace, the address requested, browser type/user agent) as well as the IP address. This data serves exclusively the detection and correction of errors (Art. 6(1)(f) GDPR).
For this monitoring we use Sentry (Functional Software, Inc., San Francisco, USA) as a processor. Error reports from your browser are transmitted to Sentry via our server. We base the transfer to the USA on the Standard Contractual Clauses (Art. 46(2)(c) GDPR), supplemented by the EU-U.S. Data Privacy Framework. The reports are deleted automatically after the retention period configured at our provider (typically up to 90 days).
8. Recipients & third-country transfers
Data is disclosed to third parties only where necessary for operation or where we are legally obliged to do so. The following service providers process personal data on our behalf (processing under Art. 28 GDPR):
• Vercel Inc., USA: delivery of the frontend (hosting/CDN);
• Fly.io, Inc., USA (server location Frankfurt/EU): operation of the game/account server and PostgreSQL database;
• Supabase, Inc., USA/Singapore (database hosting in the United Kingdom): authentication and account management;
• Functional Software, Inc. (Sentry), USA: error and crash monitoring;
• Plus Five Five, Inc. (Resend), USA: sending of sign-in and system emails.
Where these providers process personal data in a third country (in particular the USA), we base the transfer on the Standard Contractual Clauses of the EU Commission (Art. 46(2)(c) GDPR); for the providers certified accordingly (Vercel, Fly.io, Sentry, Resend) the EU-U.S. Data Privacy Framework applies in addition. We will provide a copy of these safeguards on request at F.kvnc97@gmail.com.
If you play the Steam version, we send your sign-in ticket to the Valve Corporation (USA), which acts as an independent controller (see section 4). This transfer is necessary for the sign-in via Steam that you have chosen (Art. 49(1)(b) GDPR).
The account database is hosted in the United Kingdom. The UK benefits from an adequacy decision of the EU Commission (Art. 45 GDPR), so no additional safeguards are required in that respect.
9. Your rights
You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and a right to object (Art. 21 GDPR). You can withdraw any consent given at any time with effect for the future. To do so, contact F.kvnc97@gmail.com.
You can have your account and the associated data deleted. You also have a right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
The competent authority is generally the state data protection supervisory authority responsible for the provider's location; however, you may contact any supervisory authority, in particular that of your habitual residence or place of work (Art. 77(1) GDPR).
No automated decision with significant effect. In-game calculations (matchmaking, rating/ELO, statistics) serve only the operation of the game; moderation measures such as warnings, suspension or deletion are based on a human review. There is no solely automated decision within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.
You can report security incidents or suspected data misuse at any time to F.kvnc97@gmail.com. In the event of a personal-data breach likely to result in a high risk, we will inform affected users without undue delay (Art. 34 GDPR).
10. Retention period
We store personal data only for as long as necessary for the stated purposes or as required by statutory retention periods. Account data is removed when your account is deleted, unless a retention obligation applies.
Acceptance of the terms. We store the accepted version, language and server-recorded time against your game account. The displayed legal documents are archived for traceability. The purpose is to document the contractual agreement (Art. 6(1)(b) GDPR). The account-specific record is deleted with your account. This is not consent to advertising or tracking.
Payment data. A paid membership is not yet available. Once it is offered, the following applies: if you take out a paid membership, the payment data is processed by our merchant of record Lemon Squeezy (Lemon Squeezy, LLC, a Stripe company) as an independent controller; we ourselves do not receive or store any complete payment-instrument data, only the information necessary for allocation and accounting (e.g. tier, status, subscription and order ID). The legal basis is performance of contract (Art. 6(1)(b) GDPR); we base any transfer to the USA on the Standard Contractual Clauses (Art. 46(2)(c) GDPR). Invoice- and accounting-relevant data is retained for the statutory periods (§ 257 HGB, § 147 AO, typically 6 to 10 years).
11. Minors
The service is not directed at children. A minimum age applies for independently using an account. Details in our youth protection notice.
12. Changes
We will adapt this privacy policy if the data processing changes. The version published here at the time applies.
----------
LEGAL NOTICE
Service provider
Responsible for the service Magic Pieces:
Fatih Kavuncu
Ronnebergweg 43
48151 Münster
Germany
Contact
Email: F.kvnc97@gmail.com
Phone: 01634930208
Responsible for content (§ 18(2) MStV)
Fatih Kavuncu
Ronnebergweg 43
48151 Münster
Germany
Consumer dispute resolution
We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.
As a provider with ten or fewer employees, the information obligation under § 36(1) no. 1 VSBG does not apply to us anyway by virtue of § 36(3) VSBG; this clarification is provided voluntarily.
The former EU Online Dispute Resolution (ODR) platform was discontinued on 20 July 2025; a link to it is no longer required.
Liability for content
As a service provider, we are responsible for our own content on these pages under the general laws pursuant to § 7(1) DDG. However, under §§ 8 to 10 DDG we are not obliged to monitor transmitted or stored third-party information. Upon becoming aware of legal violations, we will remove the content concerned without delay.
Liability for links
Our service may contain links to external third-party websites over whose content we have no influence. The respective provider is always responsible for such external content. Upon becoming aware of legal violations, such links will be removed without delay.
Copyright
The content, graphics, pieces and works created by the operator on these pages are subject to German copyright law. Third-party contributions (e.g. chat messages) are marked as such. Reproduction, editing or distribution beyond the limits of copyright require our written consent.
----------
YOUTH PROTECTION
Minimum age for an account
Our account policy sets a minimum age of 16 years for independently using an account. Younger users may only use an account with the consent of their legal guardians. Playing without an account remains possible below that age.
When accepting the terms of use, you confirm by self-declaration that you meet this age limit or have the consent of your legal guardians. We do not carry out a technical age-verification check. Legal guardians can contact us at any time at F.kvnc97@gmail.com to have a child's account reviewed or deleted.
Note for players outside the EU
Different age limits apply in some countries. In the USA, children under 13 years may not create an account under our account policy. This policy does not replace any legally required age verification or parental authorisation.
Age rating of the content
Magic Pieces is a strategic chess game with imaginative pieces and contains no drastic depictions of violence, fear or sexuality. It is generally suitable for younger players too. For the Steam version, refer to the age rating displayed in the Steam store. There is no separate USK rating; the assessment here is non-binding.
Chat features: note for parents
The service contains communication features (each usable only with a signed-in account): a community chat, a match chat with the respective online opponent, and direct messages between friends. In the match chat, an opponent's first chat request must be explicitly accepted before their messages become visible; friendships are only formed by mutual confirmation.
Despite moderation, we cannot review all content in advance. We recommend that legal guardians accompany the use by younger children. You can report problematic contributions or notify us at F.kvnc97@gmail.com; we review reports and remove unlawful or youth-endangering content.
Packs: chance-based content
The game includes packs whose content (pieces) is determined by chance. Packs cannot be bought with real money; they can only be acquired with the earned in-game currency or received as rewards, and their contents are not tradeable, not transferable and cannot be paid out. Nevertheless, we recommend that legal guardians talk to children about chance-based reward mechanics.
Responsible contact point
Please direct questions about youth protection to F.kvnc97@gmail.com.
A youth protection officer pursuant to § 7 JMStV has not been appointed: the service contains no content that impairs development or endangers minors, so the obligation to appoint one under § 7(1) JMStV does not apply in the first place.