Privacy Policy
Effective date: May 14, 2026
Last updated: May 14, 2026
This Privacy Policy explains what personal data Jojo40 processes, why it is processed, how long it is stored, and which rights users have.
1. Who We Are
The controller under the General Data Protection Regulation (GDPR) is:
Tobias Waller
c/o Christian Jahnke
Gulisastraße 93
56072 Koblenz
Germany
Privacy requests:
jojo40.datenschutz@i3oot.de
Support:
jojo40.support@i3oot.de
Jojo40 is not required to appoint a data protection officer. No EU or UK representative is required because the controller is established in Germany.
2. Scope
This Privacy Policy applies to the Discord Game Activity Jojo40, the public browser app at
ui.jojo40.i3oot.de, its backend services, dynamic multiplayer room servers, public
privacy/support/terms pages, and communication through the support and privacy contact addresses listed above.
Jojo40 is a digital multiplayer card game for Discord and browser testing. The game contains alcohol or drinking-game elements such as group-shot cards and shot prompts. Jojo40 is for entertainment only, does not promote alcohol consumption, and does not require alcohol consumption.
3. Data We Collect
3.1 Data From Discord
When Jojo40 is used inside Discord, Jojo40 receives from Discord the data required to use the Activity.
- Discord user ID.
- Discord username and display name.
- Discord avatar or avatar URL.
- Server/guild ID, channel ID, and channel name where Discord provides them.
- Activity/instance context, locale, and connected participants where Discord provides them.
- Discord OAuth code or token responses where required for Activity authentication.
3.2 Data Users Provide
- Support and privacy requests by email, including the request content and sender address.
- Local test names and room parameters when Jojo40 is used outside Discord in browser test mode.
Jojo40 does not provide separate user accounts, in-app chat, uploads, or other user-generated content features.
3.3 Gameplay And App Data
- Room and lobby data, players, spectators, bots, seats, roles, readiness, and connection status.
- Moves, cards, hidden and visible game state, round state, winners, and eliminated players.
- Year chips, scores, and rankings during the active session.
- Rich Presence data such as lobby, active game, round, scoreboard, start time, party size, and room ID.
3.4 Device, Technical, And Log Data
Jojo40 itself does not use analytics or tracking services and currently does not write its own permanent application logs. During operation through hosting, network, CDN, and email service providers, technically necessary data such as IP address, timestamps, requested URLs, headers, error events, or delivery information may be processed.
3.5 Payment Data, Advertising, And Optional Permissions
Jojo40 is free. There are no in-app purchases, subscriptions, donations, payment links, real-money features, betting, prizes, loot boxes, or gambling. Jojo40 does not process payment data and does not request optional device permissions such as camera, microphone, contacts, photos, location, Bluetooth, or notifications.
4. Why We Use Data
| Purpose | Data categories |
|---|---|
| Provide the Discord Game Activity and browser app | Discord data, local test identity, activity context, room and lobby data. |
| Multiplayer, game state, card logic, year chips, and rankings | Moves, seats, game state, cards, points, winners, and eliminated players. |
| Display names and avatars | Discord display name, username, avatar or avatar URL, or local test name. |
| Discord Rich Presence | Lobby/game status, round, scoreboard, start time, party size, channel name, and room ID. |
| Support and privacy requests | Email address, request content, required assignment data such as Discord user ID. |
| Operation, security, and technical delivery | Technical connection and infrastructure data processed by service providers. |
Jojo40 does not use data for advertising, personalized advertising, marketing, analytics, app-store attribution, sale, or disclosure to data brokers.
5. Legal Bases
- Performance of a contract, Article 6(1)(b) GDPR: providing the Activity, multiplayer, game state, year chips, rankings, and Rich Presence.
- Legitimate interests, Article 6(1)(f) GDPR: operation, security, technical delivery, troubleshooting, and abuse prevention.
- Legal obligations, Article 6(1)(c) GDPR: handling legally required privacy requests or official requirements.
Jojo40 currently does not ask for consent for marketing, analytics, advertising, non-essential cookies, or optional device permissions because these features are not used.
6. Cookies, SDKs, Tracking, And Advertising
- No advertising cookies.
- No analytics cookies.
- No mobile advertising IDs.
- No ad networks, ad mediation, or attribution SDKs.
- No sale or sharing of personal data for targeted advertising.
Jojo40 uses Discord for authentication, activity context, and Rich Presence. Technically necessary browser
storage may be used: the service worker or browser cache stores app files such as scripts, stylesheets, images,
fonts, and sounds. localStorage stores the audio mute setting and, in browser test mode, local test
data such as room name, username, and local user ID.
7. Sharing And Disclosure
Jojo40 does not sell Discord API data and does not share Discord API data with advertising networks, data brokers, analytics providers, or monetization services.
| Recipient/category | Reason for processing |
|---|---|
| Discord | Platform, authentication, activity context, connected participants, and Rich Presence. |
| Hetzner Cloud and Oracle Cloud | Hosting, infrastructure, and operation of backend/session services. |
| Cloudflare | DNS, CDN, frontend cache, and network delivery. |
| AWS | Email processing for support and privacy requests. |
| Authorities or courts | Only where legally required. |
Where required, data processing agreements under Article 28 GDPR or equivalent data protection agreements are in place with processors.
8. International Transfers
Game servers are operated in the EU where possible. Some service providers may process personal data outside the EU or EEA where this is necessary for operation, support, security, administration, or service delivery. In such cases, appropriate safeguards such as adequacy decisions, EU Standard Contractual Clauses, or equivalent mechanisms are used.
9. Retention
| Data type | Retention period |
|---|---|
| Discord identity data in a game session | Temporary during the session in the room backend; deleted no later than when the dynamic room service is stopped, replaced, or restarted. |
| Game state, cards, year chips, and rankings | Temporary during the session in room-backend memory; deleted no later than when the dynamic room service is stopped, replaced, or restarted. |
| Browser cache, audio setting, and local test identity | Until deleted by the browser, the user, an app update, or clearing local browser data. |
| Support and privacy requests | When no longer needed to handle the request, unless legal duties require longer storage. |
| Technical infrastructure data at service providers | According to the technically necessary and contractually governed periods of the service providers. |
Discord data may remain in the game state after an individual user leaves until session deletion, so short connection interruptions can be bridged.
10. User Rights
Subject to the GDPR, users may have the following rights:
- Access to personal data.
- Correction of inaccurate data.
- Deletion of personal data.
- Restriction of processing.
- Data portability.
- Objection to processing based on legitimate interests.
- Withdrawal of consent if consent is requested in the future.
- Complaint to a data protection supervisory authority.
Privacy requests can be sent to jojo40.datenschutz@i3oot.de. Where relevant, please include your Discord user ID. Because Jojo40 processes game and Discord data only temporarily, assignment is usually no longer possible after a session has been deleted.
11. Children And Teens
Jojo40 is intended only for adult users because it contains drinking-game elements. Minors may not use Jojo40. Jojo40 is not directed to children and does not knowingly process children's data. There is no behavioral advertising and no child-directed content.
12. Automated Decisions, Profiling, And Personalization
Jojo40 does not use automated decisions with legal or similarly significant effects, profiling, personalized advertising, AI analysis, or AI training. There are no anti-cheat, moderation, or scoring systems that create user profiles.
13. Security
Jojo40 uses technical and organizational measures to protect personal data, including transport encryption, access restrictions, separated service components, and security measures provided by the service providers used. Absolute security cannot be guaranteed for internet-based services.
14. Regional Notices
Jojo40 is operated from Germany and is primarily governed by the GDPR and German data protection law. Where other data protection laws apply, the rights provided by those laws are intended to be respected, such as access, deletion, correction, objection, complaints, and information about recipients, purposes, and retention.
Jojo40 does not sell personal data, does not share personal data for cross-context behavioral advertising, and does not use sensitive data for advertising. Jojo40 is not directed to children.
15. Changes To This Policy
This Privacy Policy may be updated if Jojo40, the data processing, the service providers used, or legal requirements change. Material changes will be published on this page before or when they take effect. If future processing requires consent, that consent will be requested separately.