Privacy policy

Last updated: 21 October 2026

This is a translation for your convenience. If it differs from the Spanish version, the Spanish version prevails.

1. Who the controllers are

The joint controllers of your data are Jorge Martínez Fernández and Óscar Marqués Sanchis, who run Barajamos. For any question about your data you can write to either of them: jorgemarfer179@gmail.com or omarques1308@gmail.com.

As joint controllers, they have agreed that either of them will handle your requests about your data and that they will keep each other informed; you can exercise your rights against either of them. Jorge takes care of sign-in and Óscar of the website hosting and the database.

2. What data we process

If you play without an account:

• Your profile (chips, stats, collection), your settings and your game against bots are saved only in your browser. They don’t reach our servers.
• When you play online, the room keeps, while it exists, the nickname you choose, the game and the table chat messages, which the other players in that room see.
• Your IP address is processed by Cloudflare to deliver the website and limit abuse (for example, too many connections in a row). We don’t store it in the game database; Cloudflare may keep it for a few days in its technical logs.

If you sign in with Google, also:

• Sign-in (handled by Supabase): your email, your Google name and photo, your Google account identifier and the dates of sign-up and last access. We don’t use your photo.
• Game account (on our server): a random account identifier, your chips and the record of every chip movement, your stats, your collection, your latest games (with the nicknames of your rivals and your partner), the promo codes you have redeemed, what you own and wear from the store and your ranking points per game. We don’t store your email or your Google name on the game server.
• Public ranking: your table nickname, your points and your games played and won, visible to anyone. Never your email, your Google name or your identifier.
• Friends (if you use it): your friend code, the name your friends see you by (your table nickname), your friends list and friend requests. While you are on the site, your friends see whether you are online and where you are playing (the home page, against bots, or the room and game); this is not stored. Your friends never see your email or your Google name.

If you write to us (a question, a request about your data or a report):

• We receive your email address and whatever you tell us. A chat or ranking report also includes the room, the reported nickname and message, and the time. Emails arrive in the controllers’ Gmail inboxes.

3. What for, and on what legal basis

• Providing the game and your account (games, chips, ranking, store, saving your progress on any device): it is necessary to provide the service you request when accepting the terms of use (Article 6(1)(b) GDPR).
• Security and fair play (limiting abuse, detecting cheating or rigged games, rejecting and hiding offensive nicknames with an automatic filter): our legitimate interest in the game working and being fair (Article 6(1)(f) GDPR).
• Visit statistics with Cloudflare Web Analytics, without cookies and in aggregate form (pages viewed, country, browser type): our legitimate interest in knowing how the website is used (Article 6(1)(f) GDPR).
• Handling what you write to us and processing reports (replying, reviewing the report, deciding on a measure and any review of it, and emailing you at your account address if the measure concerns you): our legitimate interest in keeping the game safe and in answering you (Article 6(1)(f) GDPR); if you exercise your rights, the legal obligation to respond (Article 6(1)(c) GDPR).

We don’t use your data for advertising. The only automated decision is made by the filter that doesn’t allow nicknames with insults: its only effect is asking you for another nickname, and if you think it got it wrong, write to us and a person will review it.

4. Who it is shared with

We don’t sell or hand over your data. It is processed by these providers, only to provide their service to us and on our behalf:

• Cloudflare: hosts the website, the online rooms and the game database (the latter in the European Union jurisdiction) and provides the visit statistics.
• Supabase: handles sign-in; its data is in Ireland.
• Google: when you sign in with Google, Google knows you have signed in to Barajamos and processes your data according to its own privacy policy.
• Google (Gmail): keeps the emails you send us, including reports.

Cloudflare is a United States company and Supabase is based in Singapore. The game database and the sign-in database are in the European Union, but the providers may access them from outside to provide their service, and each online room is hosted in the Cloudflare data centre closest to whoever opens it, which may be outside the European Union. Those transfers are covered by the EU-US Data Privacy Framework (Cloudflare and Google) and by the European Commission’s standard contractual clauses.

5. How long we keep it

• Online rooms are deleted after 12 hours without activity.
• Your account data, for as long as you have the account.
• If you delete your account, your game account, your chips and their record, your ranking and your sign-in user are deleted immediately. For 30 days only the random account identifier remains, so that nothing can recreate it with an old session. The record of rated games keeps random identifiers, without name or email, to review the ranking; once the account is deleted, they can no longer be linked to anyone.
• The providers’ automatic backups may keep deleted data for up to 30 more days.
• Emails with reports, until they are resolved and for six more months, in case a review is requested; other emails, for as long as needed to answer you.

6. Your rights

You can access your data, rectify it, ask for it to be deleted, object to its processing, ask for it to be restricted and take it with you (portability). The quickest way is from the website itself:

• Settings → Download my data: everything the game server keeps, in one file. Your sign-in data (your email, name and Google photo) we send you if you ask for it.
• Settings → Delete my account: deletes it for good.
• Settings → Your name at the table: changes your nickname.

For anything else, write to jorgemarfer179@gmail.com or to omarques1308@gmail.com. If you think we haven’t handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the authority of the European Union country where you live.

7. If you live outside the European Union

The law of your country protects you too. In particular:

• Brazil. The Lei Geral de Proteção de Dados (LGPD, Law 13,709/2018) also applies. We process your data to perform the game contract, for our legitimate interest and to comply with legal obligations (Article 7, items V, IX and II). You can ask us to confirm whether we process your data, and to access, correct, anonymise, block or delete it, take it with you, know whom we share it with and have a person review an automated decision (Articles 18 and 20), and you can petition the Autoridade Nacional de Proteção de Dados (www.gov.br/anpd). As small-scale processing agents we haven’t appointed a data protection officer (ANPD Resolution CD/ANPD No. 2/2022): the channel for your data is the email addresses in section 1. Your data is processed in the European Union, which the ANPD has recognised since January 2026 as providing an adequate level of protection, and by the providers in section 4.
• United Kingdom. The UK GDPR applies and you can complain to the Information Commissioner’s Office (ico.org.uk).
• Argentina. You can complain to the Agencia de Acceso a la Información Pública (argentina.gob.ar/aaip), which oversees Law 25,326 on personal data protection.
• In any other country, you can also turn to your own data protection authority.

8. Minors

You must be at least 14 years old to create an account. If you are a minor, ask your mother, father or guardian for permission before signing in with Google.

9. Cookies and browser storage

Barajamos doesn’t use cookies. It saves in your browser (local storage) what’s essential to work: your profile without an account, your settings, the game against bots, the room you are in and, if you sign in with Google, your session. It isn’t used to track you and it doesn’t leave your browser except to play. You can delete it from your browser settings.

To count visits we use Cloudflare Web Analytics, which saves nothing in your browser and gives you no identifier: when each page loads, a small script anonymously sends the page viewed, the page you came from, the browser type and how long the page took to load. It is only used to measure this website’s audience, it isn’t combined with other data or used to follow you from one site to another, and Cloudflare doesn’t use it for anything else. That is why it meets the conditions of the AEPD (the Spanish data protection authority) for measuring audiences without asking for consent.

10. Changes

If we change this policy, we will say so here with the date of the last update. If the change is important, we will also announce it on the website.