Privacy Policy
Last updated: October 28, 2026
1. Who is responsible
The controller of your personal data (GDPR Art. 4(7)) is the operator of THE GOAT:
invibe s. r. o.
Company ID: 52807363
Address: Drieňová 1712/34, 821 02 Bratislava – Ružinov, Slovakia
E-mail: info@invibe.sk
Write to this address for anything about your data.
2. What we process, why, and for how long
We collect the minimum needed to run the game and its leaderboards. We measure how the game is used with our own software only. We do not use third-party analytics, advertising or social media trackers, and we do not load fonts or scripts from third parties.
| Data | Purpose and legal basis | Retention |
|---|---|---|
| Account: name, e-mail address, password (stored only as a hash), e-mail verification and sign-up date | Provide the account and sign you in (Art. 6(1)(b)) | Until you delete the account |
| Public name: your account name, shown on leaderboards and the daily challenge. Guests appear as “Kamzík-xxxx” | Provide the leaderboards you chose to take part in (Art. 6(1)(b)) | Until you delete the account or rename yourself |
| Runs: mountain, mode, start and finish time, duration, height, deaths, summit or abandoned | Provide the game, your profile and the leaderboards (Art. 6(1)(b)) | Until you delete the account. Runs of players without an account are kept without a name |
| Anti-cheat data: progress checkpoints sent during a run, plausibility flags, a one-way hash of your IP address | Keep the leaderboards fair, our legitimate interest (Art. 6(1)(f)) | Together with the run |
| Ghost replay: position samples of a best run, shown to other players as a ghost | Provide the ghost feature (Art. 6(1)(b)) | Together with the run |
| Gameplay telemetry: where and how runs end, per run | Balance and fix the levels, our legitimate interest (Art. 6(1)(f)) | 90 days, then deleted automatically |
| Usage statistics: a random session ID (kept in your browser until you close the tab), your device type and screen size class, the game version, how a climb started and ended, the site you came from (domain only) and campaign tags (utm_*) of your first visit, and the time of your first and last visit. No IP address | Understand where players drop out and improve the game, our legitimate interest (Art. 6(1)(f)) | Runs and visit times: until you delete the account. Telemetry: 90 days |
| Page-view counters: a daily count per page, referring domain and device type. No IP address, cookie or visitor ID, so they cannot be linked to a person | Measure how many people visit the site, our legitimate interest (Art. 6(1)(f)) | Not personal data; kept as totals |
| Server logs and client error reports: IP address, browser user-agent, URL, error message | Security, abuse prevention and fixing errors, our legitimate interest (Art. 6(1)(f)) | 14 days, then deleted automatically |
| Bans: guest ID or IP address, reason, expiry | Protect the game and other players, our legitimate interest (Art. 6(1)(f)) | As long as the ban is in force |
| Cookies and local storage: session and CSRF cookies, the language you picked, a random guest ID, mute preference, where your first visit came from | Strictly necessary to run the game (Art. 6(1)(f), Section 55 of the Slovak Electronic Communications Act) | Session cookie: the session. Local storage: until you clear it |
You are not required by law or contract to give us this data, but without it we cannot provide an account or leaderboard entries.
3. Your name is public
The name of your account appears on the public leaderboards, the daily challenge and ghost replays, to everyone who visits the site. Pick a name that does not reveal who you are if you do not want that. You can rename yourself on your profile page at any time. Players without an account appear under a short random name like “Kamzík-3fa2”.
4. Who receives your data
We do not sell your data. It is processed on our behalf by providers of hosting and of transactional e-mail (verification and password reset) under data processing agreements. If a provider processes data outside the EEA, we rely on an adequacy decision or the EU standard contractual clauses. We disclose data to authorities only when the law requires it.
5. Your rights
- Access and portability (Art. 15, 20): download your data as JSON on your profile page.
- Rectification (Art. 16): change your name on your profile page, or write to us.
- Erasure (Art. 17): delete your account on your profile page. This removes your runs, leaderboard entries, achievements and ghost replays. Backups are overwritten in the normal rotation. Bans for a guest ID or IP address stay in force.
- Restriction and objection (Art. 18, 21): write to us, in particular to object to processing based on our legitimate interest.
- Withdraw consent: we do not rely on consent.
- Complain to a supervisory authority. In Slovakia: Úrad na ochranu osobných údajov Slovenskej republiky.
We answer within one month. We use no automated decisions with legal effect; the anti-cheat hides suspicious runs from the leaderboards until a person reviews them.
6. Children
The game is for people aged 16 and older and is not directed at children. We do not knowingly collect data of younger children. If you think a child has registered, write to us and we will delete the account.
7. Security
Passwords are hashed. Connections use HTTPS. Access to the admin area is restricted, and anti-cheat protects leaderboard integrity.
8. Changes
We may update this policy. We will change the date above and, for material changes, e-mail registered users.