Who we are
Infobits ApS is the data controller for thrungames: the company responsible for your personal data.
Infobits ApS, CVR 43958364, Ny Carlsberg Vej 4, 4. th, 1760 København V, Denmark. Email: support@infobits.io.
What we collect
When you create an account: your email address, your password (stored only as an Argon2id hash, never in readable form), your first and last name, and the nickname and avatar you choose. Your nickname and avatar are public: they appear next to your comments and in follower lists. If you publish games, your first and last name and nickname also appear on your developer page and next to your games. Your email address is never shown publicly.
When you sign in with GitHub: your GitHub account number, GitHub username, verified email address and display name. We use them to create and sign in to your account.
When you sign in: the IP address and browser (user agent) of each sign-in session, to help keep your account secure.
When you visit: our servers and our content delivery network log each request, including the IP address, browser and page requested.
When you play: a play session (which game, and when it started and ended). If you are signed in, it is linked to your account. If you are not, it contains nothing that identifies you.
When you post: your games, comments, likes and dislikes, saved games, the people you follow, and reports you send. Follower lists are public.
When you report a problem: what you write, and an optional contact email. Reports about bugs or games that won't load also include your browser, platform, screen size and the game version; the form shows this before you send. Copyright reports include your name and the original work. A developer sees your nickname and contact email only if you tick "Share my name and email with the developer".
If you are a developer: your upload tokens, the apps you connect (the CLI or an MCP client), and the IP address that registered an app.
Email: the notifications we send you, and any message you send us.
We don't collect your date of birth, your location, or anything about your activity on other websites.
Why we use it
| Purpose | Data | Legal basis |
|---|---|---|
| Running your account and thrungames: signing in, showing your games and comments, sending the notifications you chose | Account, GitHub, content, email | Contract (GDPR Art. 6(1)(b)) |
| Keeping accounts and the service secure, preventing abuse, and moderation | Sign-in sessions, server logs, reports | Legitimate interests (Art. 6(1)(f)) |
| Showing developers how their games are played, as totals only | Play sessions | Legitimate interests (Art. 6(1)(f)) |
| Sharing your report contact details with a developer | Nickname, contact email | Consent (Art. 6(1)(a)) — withdraw it by emailing us |
| Meeting legal obligations, such as answering authorities | Whatever the request concerns | Legal obligation (Art. 6(1)(c)) |
What we don't do
We don't show ads, use analytics or tracking tools, or sell or rent your data. We don't profile you or make automated decisions that have legal or similarly significant effects on you.
The old thrungames website used Google Analytics and Google AdSense until 14 October 2026. The current site uses neither.
Who we share it with
We use these service providers (processors), who handle data only on our instructions:
| Provider | What for | Where |
|---|---|---|
| Scaleway | Hosting, database, file storage, sending email, logs | France (EU) |
| Bunny.net | Delivering the site and games quickly (content delivery network) | Slovenia (EU) |
| Proton | Our support mailbox | Switzerland |
| Cloudflare | Forwarding email sent to us | USA |
GitHub receives your sign-in request if you choose to sign in with GitHub. GitHub's own privacy policy covers your GitHub account.
Developers see totals about their games (plays, players, play time, likes, saves, comments) and reports our staff choose to share with them, never your individual play history.
Authorities receive data only when the law requires it.
Everyone can see what is public by design: your profile, your games, your comments and who you follow.
International transfers
Your data is stored in the EU, except our support mailbox, which is in Switzerland. Transfers to Switzerland rely on the European Commission's adequacy decision for Switzerland. Transfers to the USA (Cloudflare, and GitHub if you use it) rely on the EU–US Data Privacy Framework.
How long we keep it
| Data | How long |
|---|---|
| Your account | Until you delete it, plus the 14-day grace period |
| Backups and deleted uploads | Up to 30 days after deletion |
| Sign-in IP address and browser | While the session is active, and 30 days after it ends |
| The IP address that registered a connected app | 30 days |
| Server logs | 30 days |
| Content delivery network logs | Up to 30 days |
| Notifications | 90 days |
| Emails we send you | 30 days |
| Play sessions | Kept so we can count plays for developers' statistics; unlinked from you when you delete your account |
| Comments | Kept as "Deleted user" when you delete your account, unless you ask us to remove them |
| Comments you or our staff delete | Hidden straight away; the text is kept so we can handle moderation and appeals |
| Reports | Kept, with your name and contact details removed when you delete your account |
| Moderation records | Kept, so we can handle appeals and repeat abuse |
Your rights
You have the right to:
- access the personal data we hold about you;
- correct it — most of it you can change yourself in Settings;
- erase it — delete your account in Settings, or email us, for example to have your comments removed too;
- restrict how we use it;
- object to uses based on our legitimate interests;
- receive your data in a machine-readable format (portability) — email us and we'll send it;
- withdraw consent at any time, where we rely on it.
To use any of these, email support@infobits.io. We reply within one month.
You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk.
Children
Accounts are for people aged 13 and over. If we learn that a child under 13 has an account, we delete it.
Security
Passwords are hashed with Argon2id. Every connection is encrypted. Games run on a separate domain (thrun.games), so they can't reach your account. Only staff who need access to personal data can see it.
Changes to this policy
If we change this policy, we post the new version here with a new date.
Contact
Questions about your data: support@infobits.io.