Foldwing
Privacy Policy
Effective October 3, 2026
In short
- Foldwing keeps only what it needs to let invited people in, run the game and keep it safe: your Google account’s id number, email address and name, how you play, and security records.
- No ads, no analytics, no tracking, no selling or sharing of your data, ever.
- Security records go after about 90 days; your account stays until you ask for it to be deleted.
- Wherever you live, you can see, correct or delete your data: see Your rights.
Who we are
Foldwing is a small, invite-only online game, run privately and without any commercial purpose by Nick Weiner, in the United States (“we”, “us”). We decide what happens to the data described here, so we are its “controller” under data-protection law, and we are responsible for following this policy. Questions and requests go to the address under Contact.
What we collect, and where it comes from
| What | Details | Comes from |
|---|---|---|
| Your Google account | its id number, your email address and your name | Google, when you sign in with it |
| Your invite | who it was for (a name or label the admin typed) and, if the admin locked it to you, your email address | the admin who invited you |
| How you play | your callsign, whether you fly under it or your Google name, your Hall of Fame runs (score, date, and the crew’s names or callsigns), when you last played | you, while you play |
| Your sessions | a random session id and when it expires | made when you sign in |
| Security records | sign-ins and refused sign-ins, invites, changes to members and settings, refused requests; with each, the time, the internet (IP) address, and, once per network per day, the browser family (such as “Chrome”) | your browser’s connection |
| People who aren’t members | if someone signs in with Google but has no invite: their email address and internet address, in the security records | Google and their browser’s connection |
Foldwing never sees your Google password and asks Google for nothing beyond basic sign-in: no mail, files, contacts, calendar or photos. We don’t collect payment details, your precise location or anything to fingerprint your device, and we use no analytics, advertising or tracking of any kind. You need a Google account to play; without one, you can’t sign in.
Why we use it, and on what legal basis
| Purpose | Data used | Legal basis (EU and UK) |
|---|---|---|
| Letting invited people in, and keeping everyone else out | Google account, invite, sessions | providing the game you asked to join (contract); for people who aren’t members, our legitimate interest in keeping the game invite-only |
| Running the game: showing the names pilots chose, the Hall of Fame | how you play, your name | contract |
| Keeping Foldwing and its members safe: spotting abuse, investigating problems, alerting the admin | security records | our legitimate interest in a safe service, which doesn’t override your rights because the records are few, short-lived and seen by very few people |
| Backups, so nothing is lost when something breaks | all of the above | legitimate interest |
| Answering lawful requests | what the request needs | legal obligation |
We don’t use your data for anything else, and don’t profile you. The only automated rules are the ones that keep the game invite-only and fair (for example, turning away a sign-in without an invite, or a co-op move a dart couldn’t have made); none of them has legal or similarly significant effects on you.
Cookies and your browser
| Name | What it does | How long |
|---|---|---|
| fw_session (cookie) | keeps you signed in | 14 days from your last visit, never more than 30 days after you sign in |
| fw_nonce (cookie) | proves a sign-in really started here | 10 minutes |
| fw_pending (cookie) | remembers your verified Google account while you enter an invite code | 10 minutes |
| foldwing.best (browser storage) | your best solo score | until you clear it |
| foldwing.callsign (browser storage) | your callsign | until you sign out |
| foldwing.graphics (browser storage) | your graphics setting | until you clear it |
All of these are strictly necessary for the game you asked for, so they don’t need consent, and none is used for tracking. Google’s sign-in script, and any cookies Google sets, load only after you agree to the terms on the sign-in page. Cloudflare, which protects the site, may set its own security cookies (such as __cf_bm or cf_clearance) when it checks traffic for attacks.
Who sees it, and who we share it with
- Other pilots see the name you fly under (your callsign, or your Google name if you choose to fly signed in) and your Hall of Fame runs.
- Admins see members’ names and email addresses, and the security records with internet and email addresses shortened.
- The person who runs the server can read the full security records, to look into problems.
- Service providers handle data for us, under contracts that oblige them to protect it and use it only for us:
- Hetzner Online GmbH hosts the server, in Germany;
- Cloudflare, Inc. carries all traffic to the site and protects it from attacks;
- if the admin turns alerts on, a push-notification service (ntfy or similar) delivers short security alerts to the admin’s phone, with internet and email addresses shortened and no names members chose.
- Google signs you in, as a separate controller under Google’s Privacy Policy.
- Authorities, only when the law requires it.
We never sell your personal information or share it for advertising (“sell” and “share” as California law defines them), and never give it to anyone for their own marketing.
Where your data goes
Foldwing’s data is stored in Germany, in the EU. Cloudflare and Google are based in the United States and handle traffic around the world; transfers to them out of the EU and the UK rely on the EU–US Data Privacy Framework (and its UK extension), under which both are certified, and on the European Commission’s standard contractual clauses. The person who runs Foldwing may also look at it from the United States.
Information from Google
Foldwing uses your Google account’s id number, email address and name only to sign you in, to decide whether you may enter, and to show you to the people you play with as this policy describes. Foldwing’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How long we keep it
- Your account, name and runs: until you ask for them to be deleted, or an admin deletes them.
- Security records: about 90 days.
- Invites: 90 days after they are used or expire.
- Backups: up to 90 days; short-term copies on the server: 72 hours.
- After an account is deleted, a one-way code made from its Google account id number stays, so that account can never take an admin’s place. It can’t be turned back into an id number, an email address or a name.
Your rights
Wherever you live, you can ask us:
- for a copy of your data, in a format a computer can read;
- to correct it (your name comes from your Google account: change it there, and Foldwing picks it up the next time you sign in);
- to delete it: this removes your name, email address and solo runs, and your seats on shared runs become “Pilot”;
- to stop or limit how we use it, or object to a use based on our legitimate interests.
Ask at the address under Contact. It’s free; we may ask you to write from your Google email address or to sign in, so we know the request is yours; and we answer within 30 days, or tell you if a complicated request needs longer, up to the time the law allows. Using your rights never changes how you’re treated in the game.
In the EU and the UK
These are your rights under the GDPR and the UK GDPR, including the right to data portability. You can also complain to the data protection authority where you live or work, or where you think the problem happened.
In California
Foldwing isn’t a business that the California Consumer Privacy Act covers, but we honour the same rights to know, correct and delete, and we don’t discriminate against anyone for using them. In the last 12 months we collected identifiers (your name, email address, Google account id number and internet address) and records of your activity on Foldwing, from the sources and for the purposes above, and disclosed them only to the people and providers listed above. We don’t sell or share personal information and don’t use sensitive personal information, so there is nothing to opt out of; we treat a Global Privacy Control signal as such a request all the same. Under California’s “Shine the Light” law: we give no personal information to anyone for their direct marketing.
In Canada
By signing in after reading this policy, you consent to the uses it describes; you can withdraw that consent by asking us to delete your account (you then can’t play). You can access and correct your information, and if you’re not satisfied with our answer, complain to the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.
Elsewhere
If you live somewhere else with privacy laws of its own, such as Brazil or Australia, the same rights apply: just ask.
Do Not Track and Global Privacy Control
Foldwing doesn’t track you across other websites or over time, and doesn’t let anyone else do so through it, so Do Not Track and Global Privacy Control signals have nothing to switch off. We respect them anyway.
Children
Foldwing isn’t meant for children under 13, and we don’t knowingly collect personal information from them. If we learn that a child under 13 has an account, we delete it promptly; parents or guardians can ask us to review or delete their child’s information (see Contact). If you are under 16 and live in the EU or the UK, play only with a parent’s or guardian’s permission.
Keeping it safe
Everything travels over HTTPS. Only invited people get in, and sessions can be ended at once. We keep as little as we can, admins see addresses shortened, backups stay private, and the server is locked down. No system is perfect: if a breach affects your data, we’ll tell you without undue delay, and tell the authorities where the law requires (for example, within 72 hours under the GDPR).
Changes
When this policy changes, the date at the top changes too. We tell members about important changes in the game’s hangar notice before they take effect.
Contact
Write to support@foldwing.fun, or ask the admin who invited you. Requests about your data, accessibility problems and security reports are all welcome there.