Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for the website sridu.com and the app at play.sridu.com is:

Barnabas Hohl
Fehrenbachstr. 32
51067 Köln
Germany
Email: [email protected]

2. Overview

The website and the app are deliberately built to use as little data as possible. Personal data is only processed where it is needed for operation or where you use a feature yourself. In detail:

• When you open the website or the app, technical access data is processed (sections 3 and 4).
• No cookies are set for visitors. Page views and loading times are counted with Cloudflare Web Analytics without cookies, and the app counts its use in anonymous daily totals. There is no tracking across websites and no advertising (sections 5 and 6).
• The app stores your players, games, statistics and settings only in your browser. Camera images never leave your device (section 7).
• To play across several devices, a connection is set up; the game itself runs directly between the devices (section 8).
• In the lobby, your display name, your status and your game statistics are visible to others. Reports from the lobby are stored for moderation (sections 9 and 10).
• If you report a problem, your description, images you attach and technical details about your device and the app are sent to us (section 11).
• If you join the leaderboard, the name you choose and your results are stored and shown publicly (section 12).
• If you send us an email, we process it in order to reply (section 14).

3. Hosting and Cloudflare

The website and the app run on the operator’s own server in Germany (self-hosting). No external hosting provider is involved.

Connections from the internet to the server run through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (“Cloudflare”). Cloudflare provides the encrypted connection (https), caches content of the website and protects against attacks. All requests to the website and the app pass through Cloudflare’s servers, including the connections of the lobby and of the connection setup. In doing so, Cloudflare processes your IP address and the data of the request. If a request looks suspicious, Cloudflare may set a technically necessary cookie to protect against automated access (such as __cf_bm or cf_clearance).

Cloudflare also asks your browser, through Network Error Logging (NEL), to report failed connections to Cloudflare (a.nel.cloudflare.com). Such a report contains your IP address, the address requested and the type of error. It is used to detect connection problems.

Cloudflare acts as a processor; a data processing agreement is in place. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in providing the website and the app reliably and securely without exposing the server directly to the internet.

Data may be transferred to the USA in the process. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision for this framework. In addition, the European Commission’s standard contractual clauses have been agreed.

4. Server log files

When you open a page, access data is automatically stored in log files on the operator’s server.

Website sridu.com

• IP address
• date and time of the request
• address requested (URL)
• referrer (the previously visited page, if transmitted)
• browser and operating system (user agent)
• HTTP status code and amount of data transferred

App play.sridu.com

• shortened IP address (for IPv4 the last block is replaced by 0, for IPv6 only the first three blocks are stored)
• date and time of the request
• request method and path requested (without parameters)
• HTTP status code and amount of data transferred
• browser and operating system (user agent)

In the app, the referrer and request parameters are not logged. In addition, the app’s services write an operating log with error messages. It also records the name chosen when someone joins or leaves the leaderboard, for reports from the lobby the identifier of the reported device and the reason chosen, and for problem reports their report number and the number of attached images (without any further content).

To protect against overload and abuse, the app’s server limits the number of requests and connections per IP address. For this, the full IP address is briefly held in memory: for the duration of a connection or at most one hour. It is not written to disk for this purpose.

The data is processed to ensure security and technical operation, for example to find errors and detect attacks. It is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR.

The log files are limited to 15 MB per service. Once this size is reached, the oldest entries are continuously overwritten; whenever a service is updated, its log files are deleted completely. How long an entry is kept therefore depends on the number of requests.

5. Cookies and storage in your browser

The website and the app set no cookies for visitors. Technically necessary login cookies are only set when logging in to the administration area of WordPress or of the app. This only concerns the operator. The web analytics (section 6) also work without cookies. For Cloudflare’s cookies, see section 3.

The app stores its data in your browser’s local storage (section 7). This storage is strictly necessary for the app to provide the features you request (Section 25(2) no. 2 TDDDG).

6. Web analytics, no tracking, no third-party content

The website and the app use no tracking services that follow you across websites or build profiles, and show no advertising. There are no comments, no newsletter, no social media plugins and no embedded videos.

Fonts, language files, voices and all other parts are loaded from the operator’s own server. No content from Google Fonts, content delivery networks or other third parties is embedded. The SEO plugin used on the website (Rank Math) does not send visitor data to third parties. Connections to third parties only arise as described in sections 3, 6, 8 and 13, or when you click a link (section 15).

Cloudflare Web Analytics

To see which pages are used and how fast they load, we use Cloudflare Web Analytics, a service of Cloudflare (section 3), on the website and in the app. For this, Cloudflare adds a small script to the pages it delivers, which your browser loads from static.cloudflareinsights.com. The script reads the page’s loading times and performance values (such as the Core Web Vitals) through a browser interface and sends them to the address /cdn-cgi/rum of the same domain, that is, to Cloudflare.

The following is processed: the address visited (domain and path), the referrer, browser, operating system and device type (from the user agent), the country the visit comes from, and the measured loading times. When the script is loaded and the values are sent, Cloudflare also receives your IP address for technical reasons. We only see aggregated figures, such as page views per page or visits per country, not individual people.

According to Cloudflare, Web Analytics sets no cookies and uses no other storage in the browser such as localStorage. According to Cloudflare, it also does not “fingerprint” people based on their IP address, user agent or any other data, and does not track individual people across its customers’ websites. A visit is recognised solely by the referrer not belonging to the domain visited.

According to Cloudflare, the individual measurements are kept in full for 7 days; after that, only a sample of about 10% is kept. The reports are available to us for the past six months.

Cloudflare acts as a processor for this (section 3); for transfers to the USA, what is said in section 3 applies. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in knowing which content is used and where pages load too slowly, in order to improve the website and the app. You can object to this processing (section 19). You can also prevent the measurement yourself by blocking requests to static.cloudflareinsights.com in your browser or with a content blocker; the website and the app then keep working as usual.

Usage figures of the app

To see how the app is used, the server of play.sridu.com counts per day how often the app was started. For this it counts the request for the settings (config.json) that the app makes at every start anyway. At the end of a match, the app also sends the game mode and the number of darts thrown and, for a match with cameras, how many of the detected darts were corrected, taken back or added by hand. This shows us whether detection works reliably. The message only goes to the app’s own server, so for play.sridu.com only to play.sridu.com, and only if that server has counting switched on.

Only daily totals are stored: app starts, finished matches, darts thrown, the number of matches per game mode and the totals of camera darts fixed by hand. No IP addresses, device IDs, names or cookies are stored for this; individual people cannot be identified from the figures. To limit abuse, the server accepts at most 60 reports per hour from one IP address; for this it keeps the address in memory only, for about an hour. The daily totals are deleted after 400 days.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in planning the operation of the app and improving it.

Visitor statistics (play.sridu.com)

To see whether new players find play.sridu.com and whether they play, the app sends two short messages to our server: when it is opened (the app’s language, whether it runs as an installed app) and when a game starts (the game mode; whether it is played at your own board, online, in a tournament, as a challenge or joined on a second device; whether with cameras, the demo board or typed in; and whether against a bot).

The server stores this together with your IP address in shortened form only (IPv4: the last block removed, e.g. 203.0.113.x; IPv6: only the first 48 bits) and a coarse browser class (e.g. “Chrome · Android”). The full IP address is never stored. To tell the devices of one day apart, the server forms a pseudonym from IP address and browser identifier with a key that exists only in its memory, changes every day and is never stored. No cookies are set and nothing is stored on your device for this; player names, chat and scores are not sent. The data are deleted automatically after 30 days.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in running and improving the service). You can object at any time; if you block requests to /api/hello, nothing is sent and the app keeps working.

7. The app: data on your device

Sridu runs in your browser. The app stores its data in your browser’s local storage (localStorage and IndexedDB). This includes in particular player profiles with names and a random identifier, games and statistics including dart positions, games in progress, tournaments, the records of the warm-up games, settings, the assignment and calibration of the cameras, voice and sound settings, your sound packs with your own recordings and audio files, the last lines of the lobby chat, and the keys your device uses to identify itself to the lobby and the leaderboard. The app also keeps the settings of the installation it loaded last, so that it knows the right servers even without internet. They only contain server addresses and switches, no personal data.

This data is not sent to the server; only the game mode and number of darts of a finished match, and how many of its camera darts were fixed by hand, go into the usage figures, without any link to a player or device (section 6). The feature that stores player data in a data folder on the server is switched off on play.sridu.com. If you move a player profile to another device, this happens encrypted and directly between the two devices, after you have agreed on the old device.

The cameras are only used after you allow it in your browser. The images are analysed on your device to detect darts; they are neither stored nor sent to the server. For sharing the camera picture with an opponent see section 8, for camera images in problem reports see section 11.

The microphone is only used when you record a sound or a caller line for a sound pack yourself, and only after you allow it in your browser. The recordings, the audio files you add and your sound packs are stored only in your browser on your device. They are not sent to the server and are not transmitted to opponents in online matches. If you export a pack, the app creates a file on your device, and it is up to you whether to pass it on. The sound-pack library that can share packs through a server is switched off on play.sridu.com.

You can delete this data at any time, in the app itself or in your browser settings (delete site data for play.sridu.com). The operator has no access to this data and can neither view nor restore it.

8. Playing across several devices

Sridu can connect several devices, for example a smartphone as a display or remote, or two boards for an online match. For this, the app sets up a direct, encrypted connection between the devices (WebRTC). Scores, darts and player names then travel directly between the devices and not through the operator’s server.

Connection setup

For two devices to find each other, they first exchange some technical details, including their network addresses. This exchange runs through a relay service (MQTT broker) on the operator’s server. The messages are encrypted with a key that is only contained in the invitation link or QR code; the server cannot read them and does not store them. Public third-party relay services are not used on play.sridu.com.

Finding the public address (STUN)

While connecting, the browser asks a so-called STUN server under which public address it can be reached. The app only uses Cloudflare’s STUN server for this (stun.cloudflare.com). It receives your IP address and port number, but no game content. The operator does not run a relay server that forwards connections.

Board camera picture

If you share your board camera picture in an online match, it is sent directly and encrypted to your opponent’s device and shown there. It is not stored by the operator or by the app. Please mind what can be seen in the picture.

What the other side sees

With a direct connection, the other device technically learns your IP address. It also sees the player names and everything shared in the game. By default, you have to admit devices from another network before they can join your session.

The legal basis for connections between devices is Art. 6(1)(b) GDPR, because you request the connection yourself. When the STUN server is used, data may be transferred to the USA (see section 3).

9. Lobby

In the lobby you can see who is online, chat, find opponents for an online match and write direct messages. The lobby runs on the operator’s server. It is also open to users of other Sridu installations that connect to this lobby.

When you open the lobby, the app sends:

• a random device identifier and a secret key, both created in your browser
• the display name you choose (at most 20 characters) and an optional status line
• if you offer a game, its title and mode
• figures from your game statistics, such as average, first-9 average, checkout rate, number of games and wins, best values and a short history
• a public key for encrypted direct messages

Name, status, offered game and statistics are visible to everyone in the lobby. Chat messages (at most 240 characters) and notices such as “looking for an opponent” are seen by everyone present; the server checks them for blocked words. The server keeps the last 50 chat lines in memory so that newcomers can see them. They are not written to disk and are gone after a server restart.

Direct messages are end-to-end encrypted by the apps. The server only forwards them to the recipient, cannot read them and does not store them.

So that nobody can pose as another device, the server stores a hash of the secret key and the time of last use for each device identifier. Entries unused for half a year (183 days) are deleted automatically.

Using the lobby is voluntary. The legal basis is Art. 6(1)(b) GDPR; for the word filter, the limits and the protection of identifiers, Art. 6(1)(f) GDPR. The legitimate interest lies in a lobby free from abuse and impersonation.

10. Reports and moderation

You can report people or messages in the lobby. A report stores the device identifier and name of the person reported, the text of the reported message, the reason chosen, your optional note, the time and the processing status. Who made the report is not stored. To limit the number of reports, your IP address is held in memory for at most one hour.

The operator reviews reports and can block devices. For a block, the device identifier, name and time are stored until the block is lifted. The list of blocked identifiers and the word filter are sent to the apps so that they can hide blocked devices. Open reports are kept until they have been handled; handled reports are deleted automatically six months after they came in. At most 500 reports are kept.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in preventing abuse, harassment and unlawful content in the lobby.

11. Problem reports

In the app you can send us a technical problem via “Report a problem”. This only happens when you send the report yourself. Before that, the dialog shows you all the data that will be sent.

What is sent: your description, an email address if you give one for questions, and images you add yourself (screenshots and, if you choose, still images from your cameras). In addition, technical details: time, local time and time zone, app version, the language of the app and the preferred languages of the browser, type of installation and the address (URL) the app runs at, browser and operating system with version, device model and processor architecture (where the browser provides them), screen and window size, orientation and touch support, graphics chip, number of processor cores, network status and connection type, the status of the camera permission, display settings (dark mode, reduced motion), supported browser features, memory and storage figures, the names of the connected cameras with resolution and calibration status, the configuration of the installation without passwords, the open view, game mode and settings, the type of the current game with the number of players, bots and connected devices, the number of saved games and player profiles, and a log of the app’s most recent warnings and errors and of the views opened before the problem. Player names, chat messages and statistics are not sent.

The report goes to the server play.sridu.com, even if you use Sridu in another installation (section 16). Your IP address is not stored; to limit the number of reports, a hash of it is held in memory for at most one hour. Reports are deleted automatically after 90 days, or earlier on request.

If sending does not work, you can send the report by email to [email protected] instead. Section 14 applies to this.

The legal basis is your consent under Art. 6(1)(a) GDPR, which you give by sending the report. You can withdraw it at any time with effect for the future by email to [email protected]; please quote the report number shown to you after sending. The report will then be deleted.

12. Leaderboard

The leaderboard shows results of the hourly challenges, of matches and records from training and warm-up games. From these results the server also computes verified figures, such as your 3-dart average of the last 30 days, and shows them to other players in the lobby next to your name. You only join if you explicitly do so in the app. You choose a name; the server assigns an identifier and a key that is stored in your browser. The server only keeps a hash of this key.

What is stored:

• the name you chose, the identifier, the hash of the key, and the time you joined and last used it
• for each challenge: hour, league, level, result, time taken, number of visits and darts, how the darts were recorded (camera or input) and the points
• for each match: the figures the server calculates from the darts (such as average, checkout rate, best leg, number of 180s)

To check results, the app sends the individual darts with field and time. The server calculates the figures from them and does not store the individual darts.

Name and results are publicly visible to all users of the app. So do not choose a name that makes you identifiable against your will.

Results are deleted automatically after 90 days. Your name stays stored until you leave the leaderboard in the app; your name and all results are then deleted immediately. The operator can remove entries and block names; in the case of a block, the identifier, name and time remain stored so that the name cannot be used again.

The legal basis is Art. 6(1)(b) GDPR; for blocks, Art. 6(1)(f) GDPR. The legitimate interest lies in a fair leaderboard without offensive names.

13. Voice output

The caller’s studio voices are audio files loaded from the operator’s server and played on your device. Nothing is sent to third parties.

If you choose a voice of your system or browser instead, the app uses the browser’s speech output. Some of these voices work online, such as certain voices in Google Chrome or Microsoft Edge; the text to be read out (for example scores and player names) is then processed by that provider. The operator has no influence on this; the privacy policy of your browser or operating system provider applies. The studio voices and locally installed voices avoid this transfer.

14. Contact by email and contact form

If you email us, for example at [email protected] or [email protected], we process your email address, your name if given, and the content of your message including attachments in order to deal with your request. Emails to addresses at sridu.com are forwarded by Cloudflare’s Email Routing service (section 3) to a mailbox of the operator at Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Gmail), and stored there. Google may also transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework.

If you use the contact form on sridu.com, you send us your email address, your name if given, the topic you chose and your message. We store this with the time and the language of the page in the website’s database on the operator’s server. No email is sent, and apart from Cloudflare passing on the connection (section 3) no third party is involved. We do not store your IP address. To protect against spam, a check value (hash) is made from it with a secret key and kept for at most one hour, so that too many messages in a short time can be turned away. The form sets no cookie.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in answering your request and, for the spam protection, in protecting the website against misuse. If it concerns a contract, such as a licence for commercial use, the legal basis is Art. 6(1)(b) GDPR. We delete your emails and messages once the request has been dealt with, unless statutory retention obligations apply. Messages from the contact form are deleted automatically after twelve months at the latest.

15. Donations and external links

The website and the app contain a link to PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg) through which you can support the project voluntarily. It is a plain link; the QR code for it is created in the app itself. Only when you open the link do you reach PayPal’s website, and PayPal then processes your data under its own responsibility. PayPal’s privacy policy applies. After a donation, PayPal sends you back to the app. PayPal may add payment details to the address; the app does not use them and removes them from the address bar, and the server does not log address parameters.

For other links to external websites, the privacy policy of the respective provider applies.

16. Other Sridu installations

Anyone can run Sridu themselves. If you use the app at an address other than play.sridu.com, its operator is responsible for the data processing there; this privacy policy does not apply to it. Exceptions are problem reports you send to us from such an installation (section 11) and the lobby on play.sridu.com when such an installation uses it (section 9).

17. SSL/TLS encryption

For security reasons, the website and the app use SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar.

18. Recipients and transfers to third countries

Recipients of personal data are:

• Cloudflare, Inc. as a processor for the connection to the server, for web analytics and for forwarding emails (sections 3, 6 and 14), and as the operator of the STUN server (section 8)
• Google Ireland Limited (Gmail) as the operator’s email provider for emails you send us (section 14)
• the other users you play with, and the people in the lobby and users of the leaderboard, as far as you use these features (sections 8, 9 and 12)

Transfers to the USA are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework. There is no automated decision-making, including profiling. Providing data is neither a legal nor a contractual requirement; without it, only the respective features are unavailable.

19. Your rights

You have the following rights against the controller regarding personal data concerning you:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to processing (Art. 21 GDPR)
• right to withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object

Where processing is based on Art. 6(1)(f) GDPR, you may object to it at any time on grounds relating to your particular situation. The data will then no longer be processed unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for the operator is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

To exercise your rights, an informal message to the email address given in section 1 is enough. As the app has no accounts, please state your name there for requests about the leaderboard and the report number for problem reports; data in the lobby can usually only be linked to a person through the display name. The operator cannot see data that is only stored in your browser; you can delete it yourself.

20. Last updated

This privacy policy was last updated on 30 October 2026. It will be updated when the website, the app or the legal requirements change.