Privacy policy

Last updated: 3 November 2026

1. Controller

The controller of data collected in Mosaico City and on mosaico.games is:

JGS – PROSOFT Kamil Wojtyła
ul. Józefa Braka 29C lok. 2, 43-344 Bielsko-Biała, Poland
Tax ID (NIP) 9372562957, REGON 361984407
e-mail: hello@mosaico.games

For anything about your personal data, write to hello@mosaico.games.

2. What data we process

We don’t ask for your name, e-mail or password. We process:

Player account — a random identifier in the browser_token cookie, your player name (random or chosen by you), avatar, the date the account was created and the name last changed. The account is created only when you solve your first task.
Game results — routes, number of steps, points, number of attempts, when a solution was sent and how many routes were rejected as invalid.
Usage statistics of the Game and the Mosaico site — page views (page address, the site you came from, the campaign tag in the link, browser language, phone or computer), opening and finishing tasks, solving time, number of undos, the route of a task left unsolved, player name changes, device connections and technical errors. Events are linked by a random identifier valid only until the page is closed or reloaded and, if you have an account, by that account.
Technical data — IP address, browser type and request time in server logs. The IP address is also used to prevent abuse (limits on new accounts and code attempts) — for that it is kept in memory for at most an hour and never saved to the database.
Device connection code — we store only its hash, valid for 10 minutes.

We collect statistics ourselves, on our own server. We don’t use third-party analytics (e.g. Google Analytics), ads, tracking pixels or social media plugins. Fonts and images are served from our server. We don’t make decisions about you based solely on automated processing and don’t profile you for marketing.

3. Purposes and legal bases

Running the Game, your account, results and rankings — Art. 6(1)(b) GDPR (providing the service under the terms).
Security, preventing abuse and cheating, server logs, backups — Art. 6(1)(f) GDPR (our legitimate interest).
Statistics — to learn which tasks are too hard, what is broken and where players come from — Art. 6(1)(f) GDPR (our legitimate interest: developing the Game).
Replying to messages and complaints — Art. 6(1)(f) GDPR.

4. Cookies and browser storage

We store in your browser only what the Game needs to work or what you choose yourself. This doesn’t require consent, which is why we don’t show a cookie consent banner.

browser_token (cookie) — your player account; not readable by scripts, valid for 400 days from your last visit.
mosaico.lang (browser storage) — the language you chose for the Game and the Mosaico site.
mosaico.camera (browser storage) — the board view you chose on a phone.
mosaico.boardExit (tab storage, cleared when the tab closes) — where the “Leave the board” button takes you.

We don’t use advertising, analytics or third-party cookies.

5. Who has access to the data

Data is processed on our behalf by technical service providers:

Railway Corporation (USA) — Game servers; data stored in the European Union (the Netherlands).
Cloudflare, Inc. (USA) — domain name service (DNS) and storage of encrypted database backups in the European Union.
home.pl S.A. (Poland) — e-mail.

Railway and Cloudflare are US companies. If data is transferred to the USA as part of their technical service, this happens under GDPR mechanisms — the European Commission’s EU-US Data Privacy Framework decision (for certified companies) or standard contractual clauses. We don’t sell data or share it with anyone else unless the law requires it.

Rankings are public: they show the player name, avatar, total points and place — not your name or e-mail.

6. How long we keep data

Account and results — while the Game runs or until deleted at your request. We may delete accounts inactive for 3 years.
Statistics — up to 400 days, then deleted automatically.
Database backups — 30 days.
Server logs — at the hosting provider, up to 30 days.
E-mails — until the matter is resolved, then for the period of possible claims.

7. Your rights

You have the right to access your data, rectify it (you can change your player name yourself in your profile), erase it, restrict processing, data portability, and to object to processing based on our legitimate interest. Guest accounts have no e-mail, so include the player name shown in the page header — we may ask you to confirm the account is yours (e.g. by changing the name to one we suggest). You can also lodge a complaint with a supervisory authority — in Poland the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority in your country.

8. Changes to this policy

We will announce changes to this policy on this page. Before adding features that need other data (e.g. signing in with a Google account), we will describe them here.