Privacy

1. Controller

The controller for the processing of personal data on this site (hockeyonline.app) and in the HockeyOnline app (my.hockeyonline.app and demo.hockeyonline.app) and on the public game pages (hockeyonline.games) is Einig Investitionsgesellschaft mbH & Co. KG, Leonhardweg 8, 86842 Türkheim, Germany, represented by its general partner, Einig Verwaltungs GmbH, which in turn is represented by its managing director Matthias Einig.

For any privacy question, e-⁠mail us at hello@hockeyonline.app or call +49 170 3365397.

2. Overview

HockeyOnline is a non-commercial hobby project. We process as little data as we can: the site has no tracking, no ads, no forms and loads nothing from other providers. In the app, games, lineups and officials stay in your browser; we do not store them on our servers.

Only these things pass through our servers: signing in to and fetching from the HockeyData league system, game reports you explicitly submit to HockeyData, public HockeyData data, error reports without names and, when you play an announcement, the text for the announcer’s AI voice. The sections below describe each one, with its legal basis under the General Data Protection Regulation (GDPR).

3. Visiting this site

The site is hosted by Cloudflare (Cloudflare, Inc., USA). On every request Cloudflare processes technically necessary data: your IP address, date and time, the address requested, browser and operating system, and the page you came from. Without this data the site cannot be delivered or protected against attacks. We use technical logs only to find faults. The legal basis is our legitimate interest in a secure, working site (Art. 6(1)(f) GDPR).

We serve our fonts ourselves. The audio samples on the announcer page are finished audio files on our server; playing them calls no other service.

4. Cookies and browser storage

The site sets exactly one cookie, and only when you switch the language: ho_lang stores your choice (for example “en”) for one year. The app and the public game pages set no cookies.

The app keeps your work in your browser’s storage (see section 5). The language cookie and the app’s storage are strictly necessary for functions you ask for, so they need no consent (section 25(2) no. 2 TDDDG, the German telecommunications and digital services data protection act). There are no tracking or advertising cookies.

5. The app: data stays on your device

The app stores in your device’s browser (IndexedDB and localStorage): loaded games with lineups and officials, every event of a game (such as goals, penalties, goalkeeper changes), the game archive, games you create yourself, club logos, your settings (such as language, theme, last league chosen) and, if you create one, a profile on this device (name, picture, referee licence number). It also stores a random device ID that links entries in the game log to a device. For the leagues you use, the app also keeps team names and club logos per season (public HockeyData data), at most 4 MB of logos; the app deletes data of earlier seasons itself. So that the app runs offline, a service worker keeps the app itself and logos in the browser.

This data leaves your device only in the cases described in sections 6 to 9. We have no access to it. Windows in the same browser sync directly with each other, not through our servers. On game screens the app asks the browser to keep the screen on; no data is sent for that. You can delete everything at any time in your browser settings (clear site data for my.hockeyonline.app).

The legal basis for what the app does with game data is providing the app you use (Art. 6(1)(b) GDPR) and, where data of players and officials is concerned, the legitimate interest of clubs, leagues and us in running games properly (Art. 6(1)(f) GDPR).

6. Signing in to HockeyData and public league data

For real games you sign in to the HockeyData league system of hockeydata GmbH with your league’s credentials. The app sends the credentials and every request through our server to HockeyData, because the league system cannot be reached from the browser directly. Our server only passes the data through: we store neither credentials nor the game data fetched. The app keeps the league password in memory only and forgets it when you sign out. Our logs contain only technical details such as the kind of request, game number, status code and duration, never credentials.

The app submits game reports to HockeyData only in the scorekeeper app (my.hockeyonline.app, and my.hockeyonline.dev in our test environment) and only when the scorekeeper explicitly triggers it: with F4, with the pre-game save and with the final upload. The app sends nothing automatically; the demo submits nothing. Each submission contains the full game report with lineups, officials and every event of the game. The recipient is the HockeyData league system of hockeydata GmbH. The data passes through our server, which only passes it on and does not store it. We submit at the scorekeeper’s instruction; scorekeepers, clubs and leagues decide what is reported (see section 12).

Our server fetches schedules, standings, results, statistics and club logos from HockeyData’s public interface and keeps them for up to 24 hours, up to 6 hours longer during outages. We pass no data about you to hockeydata when doing so. This public data can include players’ names and statistics; it comes from HockeyData and the leagues.

To prevent abuse we limit how many requests may come from one IP address (for IPv6, from one network range). Cloudflare keeps these counters in memory for 60-⁠second windows only; we do not store the addresses. The legal basis is Art. 6(1)(b) GDPR for the sign-in, requests and submissions you trigger, and our legitimate interest in secure operation (Art. 6(1)(f) GDPR) for the limits.

7. Error reports

The app reports errors and technical faults to our server so that we can fix them. A report contains: the kind and time of the error, league and game identifiers, the view and role in the app, technical codes, browser family with major version and operating system, and a random ID that lasts only until the page is reloaded. The app removes names of players and officials, your profile, licence numbers, passwords and access codes before sending; our server checks again. We do not store IP addresses with them.

The reports are kept in a Cloudflare database in the EU jurisdiction. You can turn them off in the app’s profile with the “Send error reports” switch; in the demo they are off. The legal basis is our legitimate interest in a working app (Art. 6(1)(f) GDPR).

8. AI voice for the announcer

When you play an announcement in the app, the app sends the announcement text to our server, which has ElevenLabs (USA) turn it into speech. The text can contain players’ names and jersey numbers, for example “Goal for ..., number 17”. We send only the text, voice and language, nothing about you. Our server keeps the generated audio for up to 24 hours so that the same announcement is not generated again; we do not log the text. ElevenLabs works for us as a processor (Art. 28 GDPR). [OFFEN: how long ElevenLabs keeps the texts under the data processing agreement]

If the AI voice is unavailable, the app uses your browser’s speech output. In the demo the AI voice is switched off. The legal basis is providing the function you use (Art. 6(1)(b) GDPR) and the legitimate interest of clubs and us in arena announcements, in which the names are said out loud anyway (Art. 6(1)(f) GDPR).

9. Fonts in the app

The app and the public game pages serve their fonts themselves; no other service is called for them.

10. Contact by e-⁠mail or phone

When you write to us or call, we process your details to answer your request (Art. 6(1)(b) or (f) GDPR). [OFFEN: name the provider of the mailbox for hello@hockeyonline.app]

11. Public game pages (hockeyonline.games)

The public game pages at hockeyonline.games show public HockeyData game data (such as games, results and club logos) without sign-in. They set no cookies, store nothing in your browser and have no service worker. Our server fetches the data from HockeyData’s public interface as described in section 6; we pass no data about you to hockeydata when doing so. On every request Cloudflare processes the same technical data as when you visit this site (section 3). The pages have their own strict security policy (Content Security Policy).

Only when a page is opened with a stream link (the ?yt= parameter) does it embed a YouTube player in privacy-enhanced mode (youtube-nocookie.com). The player currently loads straight away with the page, not only after a click. As soon as it loads, Google (USA) receives your IP address and browser details. Without a stream link no player is embedded. [OFFEN: should the player load only after a click?]

12. Who is responsible for game data

Scorekeepers, clubs and leagues decide which games, lineups and events are recorded and submitted to HockeyData. HockeyOnline is a tool for that which processes the data in your browser. The leagues and federations and hockeydata GmbH are responsible for the data in the HockeyData league system, under their own privacy policies. This policy describes what we process ourselves.

13. Data of children and young people

Lineups often include children and young people. The app processes their data like all game data, in your browser. It reaches our servers only in the ways described in sections 6 and 8: as part of requests and game reports to HockeyData, and as the text of an announcement you play. The app removes names from error reports. HockeyOnline has no user accounts at all, including for children.

14. Recipients

Cloudflare, Inc. (USA): hosting of the site and the app, servers, caches, logs and the error report database, as a processor.

ElevenLabs (USA): generating the AI voice from announcement texts, as a processor.

Google (USA): the YouTube player on public game pages opened with a stream link.

hockeydata GmbH: the HockeyData league system; receives your credentials and requests when you sign in, and game reports you submit.

Beyond that we pass on data only where a law requires us to.

15. Transfers to third countries

Cloudflare, ElevenLabs and Google are based in the USA. Cloudflare serves content from data centres worldwide, so data can also be processed outside the EU. Transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

16. How long we keep data

Data in your browser: until you delete it. Teams and logos in the browser: until the end of the season, then replaced and deleted; you can delete them at any time in your browser settings. Language cookie: one year. HockeyData credentials: not at all on our servers, in the app only until you sign out. Public HockeyData data: up to 30 hours in the cache. AI voice audio: up to 24 hours in the cache. Abuse-limit counters: 60 seconds. Technical logs: 7 days at most. Error reports: 30 days, alerts derived from them 90 days, aggregated counts with no link to individuals 13 months. E-⁠mail and phone requests: until they are dealt with, unless statutory retention duties require longer.

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of legitimate interests, you can object on grounds relating to your particular situation (Art. 21 GDPR). Write to us at hello@hockeyonline.app.

We cannot see data that exists only in your browser; you can view and delete it yourself. For data in the HockeyData league system, contact your league or hockeydata GmbH.

18. Complaints to a supervisory authority

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

19. Security

The site and the app transfer data encrypted (HTTPS). Our servers store as little as possible, and error reports are cleaned of names and credentials before they are stored.

20. Changes

We update this policy when the site, the app or the law changes. The version published here applies.