Privacy policy

Last updated: 6 November 2026

Who we are

Closest Call (closestcall.app) is an independent game, made and run by a private individual in Ukraine ("we", "us"). We are responsible for the personal data described here (the "controller" under the EU General Data Protection Regulation, GDPR, which applies because the game is offered to players in the EU). Contact: hello@closestcall.app.

As a private person we don't publish our name and address. We give them to data protection authorities and courts, and to you if you need them to exercise your rights.

We run the game from Ukraine. The data it stores is kept on a server in Frankfurt, Germany (see Service providers).

What we process, why, and for how long

Practice and single player

These modes run entirely in your browser. Your shots, levels and results are not sent to us.

Your guest account

When you play your first online match, the game creates a guest account for you:

• Account key: a random code that your device keeps and sends to the game server to show that it's you. We only store a fingerprint of it (a SHA-256 hash), so we can't recover it for you.
• Nickname: you choose it and can change it at any time. It is shown to the other players in your matches and on the leaderboards. Please don't use your real name.
• Game record: your rating; how many online matches you played and won; win streaks; your closest shot; your points for this week and last week; the achievements you earned and when; when the account was created and last used.

We don't store your matches themselves, your IP address, or anything about your device with the account.

Public: the leaderboards show the top 50 players' nicknames with their rating or weekly points, matches and wins, to anyone who opens them.

How long: until you delete the account (Profile → Delete account), which deletes it at once with everything that belongs to it. We also delete accounts that haven't been used for 12 months, and accounts without a single match after 30 days without use. Weekly points older than last week are deleted automatically. Our database backups are kept for up to 30 days, so deleted data is also gone from them after 30 days at the latest.

Legal basis: the account, rating, leaderboards and achievements are part of the online game you choose to play (Art. 6(1)(b) GDPR).

Online matches

• In the match: your nickname, a random session ID for your connection, your shots and the results. The other players in your match see your nickname, shots and results.
• Your IP address. The game server uses it to limit how many matches can be joined, and how many accounts can be created, from one network, so that nobody can overload the service. IPv6 addresses are shortened to their network part.

How long: all of this is kept only in the game server's memory, never on disk. It is deleted when the match room closes, a few minutes after the match ends at the latest. Only the result updates your account's game record (see above). For the limits, your IP address is kept for about two minutes after you last joined a match or created an account. The server's logs record technical events (for example, that a match started or ended, and errors). They are set up to contain no nicknames, no account keys and no IP addresses.

Legal basis: providing the game you asked to play (Art. 6(1)(b) GDPR), and, for the IP address, our legitimate interest in keeping the game secure and available for everyone (Art. 6(1)(f) GDPR).

Every visit: delivery and security by Cloudflare

The website and the connection to the game server are delivered through Cloudflare. Like any web server, Cloudflare processes your IP address and technical details of each request (such as the page requested, the time, and your browser type) to deliver the game and to protect it against attacks. If Cloudflare needs to check whether a visitor is a bot, it may set a strictly necessary security cookie. Legal basis: our legitimate interest in delivering the game securely (Art. 6(1)(f) GDPR). Cloudflare keeps this data under its own policies (see below).

Stored on your device

• carom.account (local storage): your account key. It stays until you delete the account or clear the site data for closestcall.app. Clearing the site data loses the account for good, since we can't recover the key.
• carom.name (local storage): your nickname, so you don't have to type it again. It stays until you clear the site data for closestcall.app.
• carom.resume (session storage): a token that lets you rejoin your online match if you reload the page. It expires after about a minute and is removed when you close the tab.

These are only used for features you ask for, so they don't need consent (Art. 5(3) of the ePrivacy Directive). We use no cookies, no analytics and no advertising identifiers.

Service providers

These companies process data for us, under data processing agreements:

• Cloudflare, Inc. (USA): website hosting, domain name, content delivery, security, and the secure connection to the game server. Cloudflare's privacy policy
• DigitalOcean, LLC (USA): the server that runs online matches and stores the accounts and their backups, located in Frankfurt, Germany. DigitalOcean's privacy policy

Both are US companies, so data may be accessed from outside the European Union. Such transfers are covered by the EU Standard Contractual Clauses in their data processing agreements and, where the company is certified, by the EU–US Data Privacy Framework.

We don't share your data with anyone else, unless the law requires us to.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have it corrected (Art. 16) or deleted (Art. 17),
• restrict its processing (Art. 18) and receive it in a portable format (Art. 20),
• object to processing based on our legitimate interests (Art. 21).

The quickest way is in the game, under Profile: it shows everything we store about your account, Download my data saves it as a file, Delete account deletes it, and you can change your nickname on the Multiplayer screen.

You can also write to hello@closestcall.app. Accounts are not linked to an email address or a name, so we can only act on an account when you show us it's yours, for example with its key (Art. 11 and 12(6) GDPR). Match data and IP addresses are kept only for minutes, so usually there is nothing left to show or delete. You can delete what is stored on your device at any time by clearing the site data for closestcall.app in your browser.

You also have the right to complain to a data protection authority, in particular in the EU country where you live or work. In Ukraine, the authority is the Ukrainian Parliament Commissioner for Human Rights.

Children

Closest Call is suitable for all ages and collects no more from children than from anyone else. If you're under 16, or under the age of digital consent where you live, please ask a parent or guardian before playing online, and don't use your real name as your nickname: it appears on the leaderboards.

Changes

We will update this policy when the game changes, for example before we add sign-in with Google or Apple, or analytics, and change the date at the top.