Privacy Policy — viktir.com
Last updated: 3 August 2026
1. Who is responsible
The data controller for viktir.com is its operator, Viktir, a private individual based in Croatia. Contact: support@viktir.com. The Site is operated under this name; the controller's legal identity will be disclosed to supervisory authorities, courts, or other parties where the law requires it. For exercising your rights under this policy, the contact email above is sufficient and all requests made there are honored.
2. What I collect and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Username, email, password (stored as a hash — I never see or store the password itself) | Your account | Contract (Art. 6(1)(b) GDPR) | Until account deletion |
| Session cookie (opaque token) | Keeping you logged in | Contract | Deleted at logout/expiry |
| IP address | Rate limiting, upload quotas, and abuse prevention (recorded on map uploads and requests) | Legitimate interest (Art. 6(1)(f)): keeping the service operational and abuse-free | 90 days, or longer where tied to an active abuse investigation |
| Maps, lyrics, transliterations, visualizer configs you upload | Providing the Typing Test | Contract | Until you delete them |
| Scores, WPM statistics, playback metadata | Gameplay, public leaderboards | Contract | Until account deletion |
| Moderation records (flagged submissions, strikes, reports about your content, actions taken) | Content moderation, legal compliance | Legitimate interest / legal obligation | 1 year after resolution |
| Emails I send you (password resets, important service notices) | Account security and service operation | Contract | Delivery logs per provider policy |
I do not collect your date of birth, real name, address, or payment details. I do not sell or share personal data for advertising. There are no third-party advertising or tracking cookies; the only cookies are essential session cookies, which is why there is no cookie banner.
3. Public information
Your username, scores, and the maps you upload are public. Choose a username accordingly.
4. Processors and third parties
Personal data is processed by these providers on my behalf:
- Vercel — hosts and serves the website (frontend) and its content-delivery network; receives your IP address and request metadata.
- Backend server (EU) — the application backend and database run on a server rented from an EU hosting provider and administered by me; this is where accounts, maps, scores, and moderation records are stored. The provider supplies the infrastructure only.
- Resend — sends password-reset and service emails (receives your email address).
- OpenAI (moderation API) — user-authored text (usernames, map titles/artist/category fields) is sent for automated content classification at submission time. No account identifiers are sent with it, and song lyrics are never sent.
- YouTube (Google) — the Typing Test embeds the YouTube player to play songs. When a map loads, YouTube sets its own cookies and receives your IP and playback data under Google's privacy policy.
- Ko-fi / Patreon — if you donate, the entire payment happens on their platform under their privacy policy; I receive at most your supporter name/email from them, never payment details.
Some providers are outside the EU (US). Transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses, per each provider's data-processing terms.
5. Your rights (GDPR)
You have the right to access, rectify, export, and delete your personal data, to object to or restrict processing, and to withdraw consent where processing is based on consent. To exercise these rights, email support@viktir.com or use the in-account tools:
- Delete your account: Settings → Account management → Delete account. This deletes your account, sessions, and scores. Maps you uploaded remain on the Site but are unlinked from any account (see ToS §5.2); delete your maps first if you don't want that.
- You can lodge a complaint with your national data protection authority.
I will respond within one month.
6. Security
Passwords are hashed with a modern algorithm; sessions are stored server-side as hashes and are revocable; the database is not publicly reachable. No system is perfectly secure — if a breach affecting your data occurs, I will notify you and the supervisory authority as GDPR requires.
7. Children
The Site is not directed at children. Accounts require a self-declaration of being at least 16 years old. If I learn an account belongs to someone younger, I will delete it.
8. Changes
Material changes to this policy are announced on the Site with an effective date. The change log is below.
Change log
- 3 August 2026 — Initial version.