Privacy policy

Dolmer Digital (Danish CVR 46524861), a sole proprietorship operated by Nicolai Dolmer Mikkelsen. Cycling Zone is a product of Dolmer Digital.

Requests regarding your data (access, deletion, portability, objection) can be sent via Discord (preferred) or via an email listed on the Help page. We normally respond within a few days, and at the latest within one month per GDPR art. 12.

• Account: email, username, chosen team name and manager name (required to log in and play).
• Game data: your team's economy, riders, auctions, board status, season results (everything created by playing).
• Optional: your Discord ID if you add it to receive DM notifications.
• Technical: IP address in access logs for up to 30 days, used for operations and security.
• Analytics (consent only): anonymous behavioural data via Microsoft Clarity (e.g. where users click in vain or scroll in frustration), anonymous traffic/source statistics via Google Analytics (e.g. which page you arrived from) and anonymous page views via Vercel Web Analytics (e.g. how many people visit a page). Used only to fix bad UX and understand where players find the game.
• Product analytics via PostHog (runs unless you reject analytics): page views and key steps in the game (for example sign-up, team created, first bid and first training), to see where new players get stuck. PostHog sets no cookies and stores nothing in your browser: every page load gets a new random ID. Once you log in, these events are linked to your internal account ID (never your email or name), so visits can be connected across sessions. Rejecting the "Analytics" category turns PostHog off immediately. The legal basis is legitimate interest in improving the game (GDPR art. 6(1)(f)), and rejecting analytics is how you object.
• Acquisition source (legitimate interest): when you create an account we record how you first reached the site (a referring link, any campaign tags in the URL, and the page you landed on) so we can see which channels bring new players. First-party only, no cross-site tracking, and you can object at any time.
• Aggregate traffic statistics (no consent needed): we count anonymous, aggregated page views and engagement (e.g. how many visitors a page received and whether they engaged) without cookies and without storing IP addresses or any data that can identify you. We also record which page a visit came from and any campaign tags in the URL, so we can see which channels bring visitors. That is information about the referring link, not about you. Because it cannot be linked to you, this requires no consent.
• Fair play (legitimate interest): to detect and document multi-account cheating, we record technical signals when an account is created and when value-bearing actions happen in the game (for example accepted transfers, auction bids and loans taken): IP address, browser information (user agent), language setting and timezone. This data is used solely for fair-play enforcement, is never visible to other players, is not shared with third parties, and is deleted automatically after 180 days. If you delete your account, it is deleted with it. The legal basis is our legitimate interest in a fair game (GDPR art. 6(1)(f)), and you can object at any time.

If you sign up for our "Founder" waitlist, we process the following data based on your explicit consent (GDPR art. 6(1)(a)):

• Contact: email and/or Discord handle (at least one required so we can reach back).
• Intent: interest level, preferred tier, main reason, valued benefits, perceived fairness red lines (free text).
• Follow-up: consent to personal follow-up (separate yes/no).
• Attribution: where you came from (UTM parameter or manual tag, e.g. "discord_launch").
• Timestamp: when you gave consent (proof of lawful basis).

Purpose: to administer the waitlist, contact you regarding launch, and measure which channels generate real interest.

Retention: until you ask to be deleted, or after 24 months of inactivity, whichever comes first. You can write to us at any time to be deleted.

Important: a waitlist sign-up is not a purchase and not binding. No payment is collected before a potential later launch, at which point you must actively accept commercial terms.

• Supabase (EU, Frankfurt): database and authentication (data processing agreement in place).
• Vercel: frontend hosting (EU/US edge). Vercel sees IP addresses in access logs.
• Railway: backend hosting.
• PostHog (EU cloud): product analytics without cookies. Turned off if you reject the "Analytics" category.
• Microsoft Clarity: only loaded if you have accepted the "Analytics" category.
• Google Analytics: only loaded if you have accepted the "Analytics" category. Ad signals are turned off.
• Vercel Web Analytics: only loaded if you have accepted the "Analytics" category.
• Discord (via Discord Inc.): only if you voluntarily add your Discord ID, or contact us on Discord. Discord is an independent data controller for any content you send us there.

We do not sell or share your data with third parties for marketing purposes. A link to Discord is not a data transfer, only when you click and write to us yourself.

• Account and game data: as long as your account is active. If you delete your account, personally identifiable data is removed within 30 days; aggregated game history (e.g. past season results) may be retained in anonymised form.
• Waitlist data: until you ask to be deleted, or 24 months of inactivity, whichever comes first.
• Access logs (IP): automatically deleted after 30 days.
• Fair-play telemetry (IP and device signals): deleted automatically after 180 days.
• Consent proof (consent timestamp + choices): for as long as the related data is processed, so we can document lawful basis.

• Access: to know what data we hold about you.
• Rectification: to have incorrect data corrected.
• Erasure ("right to be forgotten").
• Data portability: to receive your data in a machine-readable format.
• Object to processing based on legitimate interest.
• Withdraw consent: applies going forward and stops collection. Data gathered before withdrawal cannot be removed from anonymous aggregates.
• Complain to the Danish Data Protection Authority: datatilsynet.dk/english.

We use strictly necessary cookies/localStorage and first-party storage for:

• Login session (Supabase auth): required to keep you logged in.
• Theme choice (light/dark): stored locally in your browser.
• Consent choices (cz_consent_v1 in localStorage): so we remember your selection and don't ask again.
• Version pinning (__vdpl): keeps your browser on the version of the app you loaded, so the page does not break mid-session.

These do not require consent under the ePrivacy directive (strictly necessary). Microsoft Clarity, Google Analytics and Vercel Web Analytics are only loaded if you have actively accepted the "Analytics" category. PostHog stores nothing in your browser (no cookies, no localStorage) and is turned off if you reject "Analytics". You can change your choice on this page at any time.