Legal Notice

Legal Disclosure

Information in accordance with § 5 ECG, § 14 UGB, § 63 GewO and § 25 MedienG.

Company & Contact Information

Disclaimer

Content

The author reserves the right not to be responsible for the topicality, correctness, completeness or quality of the information provided. Liability claims regarding damage caused by the use of any information provided, including any kind of information which is incomplete or incorrect, will therefore be rejected.

All offers are not-binding and without obligation. Parts of the pages or the complete publication including all offers and information might be extended, changed or partly or completely deleted by the author without separate announcement.

Referrals and Links

The author is not responsible for any contents linked or referred to from his pages, unless he has full knowledge of illegal contents and would be able to prevent the visitors of his site from viewing those pages. If any damage occurs by the use of information presented there, only the author of the respective pages might be liable, not the one who has linked to these pages.

Furthermore the author is not liable for any postings or messages published by users of discussion boards, guestbooks or mailing lists provided on his page.

Copyright

The author intended not to use any copyrighted material for the publication or, if not possible, to indicate the copyright of the respective object. The copyright for any material created by the author is reserved. Any duplication or use of objects such as diagrams, sounds or texts in other electronic or printed publications is not permitted without the author's agreement.

Apple, the Apple logo, iPad, iPhone, and iPod touch are trademarks of Apple Inc., registered in the U.S. and other countries. App Store is a service mark of Apple Inc. Google Play and Android are trademarks of Google Inc. Google Play and the Google Play logo are trademarks of Google LLC.

Legal Validity of this Disclaimer

This disclaimer is to be regarded as part of the internet publication which you were referred from. If sections or individual terms of this statement are not legal or correct, the content or validity of the other parts remain uninfluenced by this fact.

Privacy Policy

The controller for the processing described below is Timesheet - Mobile Time Tracking OG, at the address given above. Questions about your data can be sent to beachbar@startupsurfers.lol.

Startup Surfers has no advertising, no third-party analytics and no profiling of any kind. No Google Analytics, no advertising pixel, no social plugin: nothing on this site contacts an analytics or advertising company, and nothing about you is shared with one.

Anonymous Site Statistics

We count how many people visit, which pages they read and how long a page stays open, and we publish the result openly at /stats. It is measured entirely by our own server, and it is designed so that the resulting figures cannot be traced back to anybody — including by us.

No cookie and no identifier is used for this. Nothing is stored in your browser for statistics, and the ss_guest cookie described below is deliberately not reused for it.

Instead, each request is reduced to a one-way hash of your IP address and browser user agent, combined with a secret value that changes every day and is deleted two days later. Your IP address and user agent are never written to our database. Once the day's secret is deleted, the hash cannot be linked back to an address even by someone holding both — and it cannot be linked to the previous or following day's, which means visits cannot be joined into a profile of one person over time. It also means a "unique visitor" only ever exists within a single day, which is stated plainly on the statistics page rather than hidden behind a larger-sounding number.

We record the page template rather than the address you visited: a visit to a founder's profile is stored as /u/:handle, never as the handle itself, so which profile or which league you looked at is not recorded at all. No referrer is stored, and the request that reports a page view is sent without your session cookie.

If your browser sends a Do Not Track signal, nothing is recorded at all.

The legal basis for this processing is our legitimate interest (Art. 6(1)(f) GDPR) in understanding whether the site is used and in publishing that honestly. Because no cookie or comparable identifier is stored on your device and no personal data is retained, it needs no consent banner. Statistics rows are kept in aggregate and carry nothing that identifies you; the daily secrets that could theoretically link them are deleted after two days.

Playing Without an Account

You can play without giving us anything. When you first load the game we set a cookie named ss_guest containing a random identifier and no personal data. It lasts a year and exists so that runs you finish before registering can be credited to you if you later create an account.

Each finished run is recorded against that identifier: your score, distance, duration, the board you rode, the tricks you landed and the time it finished. Your rider appearance, sound preference and local best score are kept in your browser's own storage (startup-surfers-score-v1, startup-surfers-sound-v1) and are never sent to us.

Creating an Account

Registration needs an email address, and that is the only personal data we require. We use it to send you a sign-in code, to identify your account, and — unless you opt out — to send you the results email at the end of each season.

Sign-in codes are stored only as SHA-256 hashes and expire after ten minutes. The IP address that requested a code is recorded with it, solely to enforce rate limits and prevent abuse, and is discarded with the code. When you are signed in, a cookie named ss_session holds a session token; we store only its hash, and it lasts thirty days.

Your email address is never shown on the leaderboard, on a profile, in a league or in an embed badge.

What You Choose to Make Public

If you name your startup you also claim a public profile at /u/<handle>. Everything you add there — startup name, tagline, website, logo — is published deliberately, alongside your scores, achievements and run history. The same is true of a league you create or join: its name, description, website, crest and member list are public, as is your membership of it. You can edit or remove any of it at any time.

Payments

League subscriptions are processed by Stripe Payments Europe, Ltd. Card details are entered on Stripe's own checkout page and never reach our servers; we cannot see them. We store the Stripe customer and subscription identifiers, the plan and the subscription status, which is what tells us whether a league is active. Stripe's own handling of your data is covered by the Stripe Privacy Policy.

Email

Email is delivered by Brevo (Sendinblue SAS, France). Two kinds are sent: sign-in codes, which are necessary to operate your account and cannot be switched off while the account exists, and the end-of-season results email, which every registered player receives and which carries an unsubscribe link in every message. Unsubscribing takes effect immediately and does not affect sign-in codes.

Where Your Data Is Held

The service runs on Google Cloud Platform in the europe-west1 region (Belgium), on Google Cloud Run and Cloud SQL. Our processors are Google Ireland Limited (hosting), Sendinblue SAS (email) and Stripe Payments Europe, Ltd (payments).

Retention and Your Rights

Runs, profile and league data are kept for as long as your account exists. Sign-in codes expire after ten minutes and payment event records are deleted after thirty days.

Under the GDPR you have the right to access, rectify, erase, restrict and port your data, and to object to its processing. Most of it you can exercise yourself: your profile is editable at any time, and deleting your account from the profile page erases your email address, runs, achievements, profile and league memberships. An account that owns a league with a live subscription must cancel that subscription first, because deleting the account also deletes the league.

For anything else, write to beachbar@startupsurfers.lol. You also have the right to complain to the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna).