Burrr.io — Privacy Policy Last updated: 5 October 2026 This is a translation. The legally binding version is the Spanish original (https://burrr.io/privacy.es.txt). In the event of any discrepancy, the Spanish text prevails. This policy explains what data the browser game Burrr.io (https://burrr.io) processes when you play, for what purpose, for how long, and what you can require of us. It is written to comply with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Spanish Law 34/2002 (LSSI-CE). Use of the game is also governed by its Terms of Use: https://burrr.io/terms.txt 1. DATA CONTROLLER The controller is Yatoday, S.L., the owner of the game. Its full identification details (tax ID, registered address and register entry) are in the Legal Notice: https://yatoday.es/en/legal/notice/ For any privacy matter, write to dev@yatoday.es. 2. SUMMARY - Do I have to sign up? No. We ask for no email, no password and no real name. A guest account is created automatically. - What data? The nickname you type, your game progress and statistics, technical data about the visit and server logs. - Do you use cookies? No. Only the browser's local storage, strictly necessary for the game. - What for? So that you can play and keep your progress, to improve the game with usage statistics, and to keep the server secure. - On what basis? Providing the service you ask for by playing, and our legitimate interest. - Who receives it? Our hosting providers (Hetzner in Germany, and Cloudflare). We do not sell it and use no third-party analytics. - What can I do? Access, rectify, erase, object to, restrict and port your data, and lodge a complaint with the AEPD. 3. WHAT DATA WE PROCESS a) Guest account. There is no registration. The first time you open the game a guest account is created, and your browser keeps a random access code in its local storage (localStorage). Our server stores only the SHA-256 hash of that code, not the code itself. The code is valid for 180 days; if the account is not used for 180 days, it can no longer be opened from that browser. b) Your account data on the server: - When the account was created and last seen. - The nickname you type. Other players see it (in the match and in the leaderboards). - Your progress: coins, arsenal, techniques, ranks, medals, achievements and the daily reward. - Game statistics: matches, kills, best score, playtime, causes of death and a history of your last 20 matches. - Your device's time-zone offset, to work out the daily reward by your local time. - First-visit labels: where you came from and the type of device. c) Product analytics, without cookies. To learn how the game is used and improve it, for each visit in a browser tab we record: a random key for that tab, the UTM marks of the link, the referring page's domain only, the language, the client version, the platform, the device type and, roughly, the operating system and browser derived from the user agent (the user agent itself is not stored), the load time, the time until you press "Play", the seconds played and the latency (ping). We do not store your IP address in the database and we use no third-party analytics tools. d) Server logs. The game server writes technical operating logs. Your IP address appears in them only when a connection coming from an origin other than the game is refused. e) Chat. The in-game chat allows only preset phrases and emotes; there is no free text. The only content you enter yourself is the nickname. We do not process special categories of data (Art. 9 GDPR), and we ask you not to use your real name or other personal data as your nickname. 4. PURPOSES, LEGAL BASES AND RETENTION a) Creating and keeping your guest account, saving your progress, your statistics and the daily reward. - Legal basis: providing the service you ask for by playing, under the Terms of Use (Art. 6(1)(b) GDPR). - Retention: while the account exists. There is currently no automatic deletion of inactive accounts: we delete an account when you ask us to (section 10). b) Showing your nickname to other players in the match and in the leaderboards. - Legal basis: providing the service (Art. 6(1)(b) GDPR). - Retention: while the account exists. c) Product analytics: measuring the game's use, performance and where players come from, to improve it. - Legal basis: legitimate interest in improving the game with minimal data that does not identify you directly (Art. 6(1)(f) GDPR). - Retention: per-visit records, while needed for analytics; they are currently not deleted automatically, and we delete them on request. Hourly aggregates: 90 days; technical server samples: 30 days. d) Security, abuse prevention and fault diagnosis (server logs). - Legal basis: legitimate interest in keeping the game available and protected (Art. 6(1)(f) GDPR). - Retention: the logs rotate by size (5 files of 50 MB) and are overwritten as new ones are written. e) Handling your requests to exercise your rights. - Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR). - Retention: as long as needed to show that we handled them. Where the basis is our legitimate interest, you can object by writing to us (section 10). 5. STORAGE IN YOUR BROWSER (WE USE NO COOKIES) The game sets no cookies. It uses the browser's local storage (localStorage) for three things: your guest account's access code, your settings (language, sound and the like) and which game tips you have already seen. This storage is strictly necessary to provide the service you ask for by playing and is exempt from consent under Article 22.2 LSSI-CE; that is why the game shows no cookie banner. You can clear it at any time in your browser's settings ("clear site data"). Note that if you do, the guest account can no longer be opened from that browser and your progress is lost to you. 6. RECIPIENTS AND PROCESSORS We do not sell or share your data. To run the game we use these providers, acting as processors: - Hetzner Online GmbH: game server and database. Location: Germany (EU). Processing within the EEA; no transfer safeguard needed. - Cloudflare, Inc. / Cloudflare Ireland Ltd.: serving the game client (burrr.io); like any host, it processes IP addresses in its logs. Location: EU, with access from the US. Safeguard: EU-US Data Privacy Framework (Decision 2023/1795) and Standard Contractual Clauses. We may also disclose data to courts and public authorities where the law requires it. 7. INTERNATIONAL TRANSFERS The game server and the database are in the European Union. The only transfer outside the EEA is the one that may take place with Cloudflare, Inc. (United States) when it serves the game client, covered by the EU-US Data Privacy Framework, to which Cloudflare has signed up, and additionally by the European Commission's Standard Contractual Clauses. 8. AUTOMATED DECISIONS We take no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). 9. CHILDREN The game is not aimed at children under 14, the age from which Article 7 LOPDGDD allows a person to consent on their own behalf. We do not knowingly collect data from children under that age; if we learn that an account belongs to one, we will delete it. If you are a parent or guardian and believe your child plays, write to dev@yatoday.es. 10. YOUR RIGHTS You can exercise your rights of access, rectification, erasure, restriction, portability and objection (Arts. 15 to 21 GDPR) by writing to dev@yatoday.es. It is free of charge, and we will reply within one month, extendable by two further months if the request is complex. How we identify your account. As there is no login and no email, we cannot know for certain which account is yours. Tell us your nickname and roughly when you played; if we still cannot be sure that the account is yours, we will tell you, because handing over or erasing someone else's data would also cause harm. Erasure. You can achieve it yourself by clearing the site data in your browser: the account can no longer be reached from it. If you also want us to delete it from our server, write to us and we will. Complaint. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan 6, 28001 Madrid — https://www.aepd.es). 11. CHANGES TO THIS POLICY We may update this policy when the game, our providers or the law change. The version in force is always the one published at this address, with the date shown at the top. 12. LANGUAGE OF THIS DOCUMENT This document is published in Spanish, English and Russian, the game's languages. The Spanish version (https://burrr.io/privacy.es.txt) is the only prevailing version; the English and Russian versions are translations and, in the event of any discrepancy, the Spanish text prevails.