The short version
- There are no accounts. We never ask for your name, address, card or email.
- Your orders, wishlist, sizes, savings and achievements are kept on our server, linked to a random ID in a cookie or in the app, not to your name. If you link the app and the website, they share the same game.
- Our server also sees what any website sees when you visit (your IP address and browser details) and a few small cookies it needs to show you the right shop.
- If you turn on notifications, our server keeps your browser’s push address, or your phone’s push token, and sends you the pings. Turning notifications off deletes it.
- We show ads from Google. Ads use cookies or your phone’s advertising ID only if you allow them.
- We don’t sell your data. We count visits with Google Analytics, which sets cookies only if you switch on “Statistics”.
Who is responsible
The controller for the personal data described here is Dropcatcher.nl B.V., Horsterweg 24, 6119 AC Maastricht, the Netherlands, KvK 70251924 (“we”). It runs the website dopaminechic.com in all its country and language versions, and the Dopamine Chic app.
For anything about your data, email contact@dopaminechic.com. We have not appointed a data protection officer, because the law doesn’t require one for a service like ours.
Your game data
Dopamine Chic keeps your game on our server, and the app also keeps it on your phone:
- your orders, their tracking story and the non-delivery reasons you have seen;
- your wishlist and the sizes you chose;
- whether you have ever put something in your bag (until then, the home page explains how the shop works);
- your savings counter, streak and achievements;
- your notification choices;
- the devices that use your game: for each, a random install ID, its kind (for example “iPhone”, “Android phone” or a browser’s name, never the name you gave your device), the shop version and time zone it uses, and when it was last used;
- if you share them: your tracking links with their hurry counts, your receipt links, your wishlist link with the name you chose, and the gifts friends sent you.
Your game data on our server is linked to a random ID stored in a cookie on your device (dc_id) or, in the app, in your phone’s secure storage, not to your name, email or anything you type. Our server keeps only a one-way code of that ID, so the ID itself can’t be read from our database. The app keeps its own copy of your game on your phone and exchanges changes with our server whenever it is online, so that every device you linked shows the same game. We use your game data to run the game, to send the notifications you turned on and choose what they are about, and to keep your game consistent between visits and devices. The legal basis is providing the service you use (GDPR Article 6(1)(b)).
You can delete your game data at any time with “Clear my data” on your account page or in the app. This deletes it on our server, together with the list of your devices and their push tokens, and removes the dc_id cookie; your other linked devices are told it was deleted the next time they connect, and ask whether to delete their copy too. If you only clear your browser’s site data or uninstall the app, your game data on our server is no longer linked to that device; we delete it after 400 days without a visit from any of your devices. If you lose a phone, you can give your game a new ID in the app, which disconnects all your other devices. So that a disconnected device can tell you what happened, we keep a one-way code of the old ID for 400 days. In the app, your phone’s own backup (iCloud or Google) may also include your game data; that backup is between you and Apple or Google.
Sharing, gifts and the live report
Receipts. “Get the receipt” draws a picture of an order on our server, from your game data, and sends it to your browser. We don’t keep the picture. Like every page you load, the request appears in our server logs.
Shared tracking. When you share an order’s tracking, the link itself carries the order number, its items with sizes and prices, the delivery city and when it was placed, signed so that nobody can change it. With your game data, our server keeps only whether the link still works and how often friends pressed “Hurry the courier”; where the parcel is sent next is worked out from that count. If you turned on delivery notifications, we tell you when your friends’ hurries send it somewhere new. Anyone with the link sees the parcel, never your name or address. “Stop sharing” turns the link off for everyone. To keep hurries to about one an hour, the visitor’s browser remembers in its local storage when it last hurried each link, and our server counts the hurries from each IP address per link for one hour, keeping only a one-way code of the address and the link, then deletes it.
Shared receipt. When you share an order’s receipt, it gets a link with a random code, stored with your game data together with whether you chose to show your all-time total. Anyone with the link sees that order’s receipt: the order number, date, delivery city, items, sizes, brands and prices, and your all-time total if you left it on. Never your name or address. The link works until you clear your data.
Public wishlist. If you turn on your wishlist link, anyone with the link sees your wishlist and the name you chose (optional, up to 16 characters; without one, friends see “Someone”). The link’s random code is stored with your game data. Turning the link off stops it working for everyone; turning it on again makes a new one.
Gifts. A friend who sends you a gift from your wishlist chooses an item, a size and one of six fixed card messages, and may type a name of up to 16 characters. We store the gift with your game data and delete it with your game data. The sender gets a tracking link for the gift, which works like a shared tracking link. We keep nothing about the sender apart from that name. If you send a gift, type only a name you are happy for the receiver to see.
The live counter and the report. The running total on the home page, its “Just now” feed and the report at /report are added up every minute from everyone’s game data on our server. They never show one player’s activity: a feed line names only a city and an item, with the time rounded to the minute, and a city, item or size appears only when at least 100 players are behind it. The totals are anonymous figures and stay after game data is deleted.
Limits against abuse. To stop anyone from flooding the service, our server counts some requests for a short time: for example how often a code is tried when linking a device, how many gifts arrive, or how often the same device or IP address hurries a parcel. It keeps only a one-way code of the IP address, install ID or game ID together with a count, and deletes each count when its period ends, after one day at most.
The legal basis for sharing and gifts is providing the service you use (GDPR Article 6(1)(b)); for the hurry and abuse counts and the anonymous totals, our legitimate interest in preventing abuse and in showing how the game is played (Article 6(1)(f)).
What our server processes when you visit
Connection data. When you open a page, your browser sends our server your IP address, the page address, the time, your browser and operating system, and the page you came from. We need this to deliver the page and to protect the site against abuse. We may also analyse the logs to see how the site is used, for example how many visits each page gets, so we can fix problems and improve it; results are kept only as totals. Our server logs keep it for 14 days, then delete it. We don’t combine it with anything else.
Cookies the shop needs. Our server reads a few small cookies: the country and language version you chose, your device’s time zone (to show local times and the city your parcel won’t reach), what is in your bag with its 30-minute reservation, what you have “bought” in the campaigns that are still running (so stock and purchase limits work), and the random ID that links your device to your game data on our server. None of these contain your name or anything you typed. The cookie policy lists them all.
Your time zone and delivery city. We work out a city from your device’s time zone setting, not from your location. You can change the city at checkout. It is only used for the tracking story.
Notifications on the website
Notifications are off until you turn them on. If you do, your browser gives us a push address: a long random web address at your browser’s push service (Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge).
Our server stores the push address with your game data and uses that data to work out when each ping is due, for example “Your parcel left the sorting hub”. For “Flash sales and deals”, it picks the day’s flash sale or deal of the hour that best fits what you have ordered and wished for: women’s or men’s items, the kinds of items and the brands. Without orders or wishes, it picks the biggest discount. It sends each ping through your browser’s push service, encrypted so that the push service can’t read it. If you turn notifications off or block them in your browser, we delete the push address; we also delete it 90 days after your last visit. Your game data stays until you delete it, as described above.
The legal basis is your consent (GDPR Article 6(1)(a)). You can withdraw it at any time in the notification settings or your browser settings.
Notifications in the app
Notifications are off until you allow them. If you do, the app gives our server its push token from Google Firebase Cloud Messaging (a long random code for your phone’s copy of the app), together with the shop version and language you use, your time zone, your quiet hours and which kinds of notification you want. Our server works out from your game data when each ping is due and, for “Flash sales and deals”, which flash sale or deal best fits what you have ordered and wished for, as on the website. It sends each ping through Firebase Cloud Messaging, which delivers it to iPhones through Apple’s push service. A ping contains only the text you see and a link inside the app, never your ID.
If you turn notifications off in the app, or the phone’s settings no longer allow them, the app tells our server and we delete the push token. We also delete it when Firebase reports that it no longer works, or 90 days after your last visit. Only “Reservation ending”, about the bag on your phone, is scheduled by the phone itself.
The legal basis is your consent (GDPR Article 6(1)(a)). You can withdraw it at any time in the app’s settings or your phone’s settings.
Ads
Ads keep Dopamine Chic free. They are served by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, together with Google LLC in the USA).
When you first visit, our own consent window asks what you allow. “Choose what to allow” shows two switches: “Personalised ads”, and “Statistics” for Google Analytics cookies (see “Statistics (Google Analytics)” below). Refusing is as easy as accepting, and the site works the same either way.
- If you accept ads, Google and its ad partners may store and read cookies on your device to show, measure and personalise ads. For this, Google is a separate controller and its own privacy policy applies: Google Privacy Policy and how Google uses information from sites that use its services.
- If you refuse ads, we ask Google to show only non-personalised ads. Google may still use cookies for them, but only to limit how often an ad is shown, to count ads in total and to fight fraud, not to personalise ads.
The legal basis is your consent (GDPR Article 6(1)(a)). You can change your choice at any time under “Cookie settings” at the bottom of every page. In the app, ads are shown through Google AdMob. The app asks for your consent first, and you can change your choice at any time in the app’s settings. With your consent, Google may use your phone’s advertising ID to show, measure and personalise ads; on iPhone, the app also asks for Apple’s tracking permission first. Without consent, the app shows only limited ads.
Statistics (Google Analytics)
We use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to count visits and see which pages are used.
Before you decide, or if you refuse, no cookies are set and nothing is stored on your device. Your browser still sends Google a short anonymous signal when a page loads: the page address, the time, your browser type and your approximate country, worked out from your IP address. Google doesn’t store the IP address. We use these signals only for overall visit counts. The legal basis is our legitimate interest in knowing how much the site is used (GDPR Article 6(1)(f)).
If you switch on “Statistics”, Google Analytics also sets cookies (_ga and _ga_<ID>, for 60 days) so that repeat visits are counted correctly. The legal basis is your consent (GDPR Article 6(1)(a)). You can withdraw it at any time with the same switch under “Cookie settings”, and the cookies are then deleted.
We never send Google your device ID, your orders or anything else from your game data. The data is not used for advertising. It is kept for 2 months. Google may process data in the USA; Google LLC is certified under the EU–US Data Privacy Framework, and standard contractual clauses also apply.
Linking the app and the website
“Move everything to the app” on your account page shows a QR code, and the same code to type. It holds no game data: it is a random one-use code that our server keeps for 5 minutes together with your game’s ID. When the app scans or receives the code, our server gives the app that ID, so the app and the website use the same game from then on, and adds anything the app already had to it. The code is then deleted, and so is an unused code after 5 minutes. Linking works the same way from the app to another phone or browser. The app asks for camera permission only for the scan and does not keep any images.
Who else receives data
| Recipient | What | Why | Role |
|---|---|---|---|
| Aftermarket.eu BV, the Netherlands | Connection data, cookies the shop needs, your game data on our server, push addresses and tokens | Hosting the website and its database, sending notifications | Processor, under a data processing agreement |
| Cloudflare, Inc., USA (servers worldwide, including the EU) | Connection data for every page and image you load | Delivering pages and images quickly and protecting the site against attacks | Processor, under Cloudflare’s data processing addendum |
| Connection data and, with your consent, ad cookies and (in the app) your phone’s advertising ID | Showing and measuring ads | Separate controller | |
| Google Analytics (Google Ireland Limited, Google LLC) | Page address, time, browser type and approximate country of each page view and, if you switch on “Statistics”, the Analytics cookies | Counting visits and seeing which pages are used | Processor, under Google’s data processing terms |
| Your browser’s push service (Google, Mozilla, Apple or Microsoft) | Your push address and encrypted pings | Delivering notifications you turned on | Chosen by your browser; it can’t read the pings |
| Google Firebase Cloud Messaging (Google Ireland Limited, Google LLC) and, for iPhones, Apple Push Notification service (Apple Distribution International Ltd., Apple Inc.) | Your phone’s push token and the pings for it | Delivering notifications you turned on in the app | Processor (Google); Apple delivers to its own devices |
| Apple App Store, Google Play | Download and app-store data | Distributing the app | Separate controllers, under their own terms |
We don’t sell or rent personal data. We share data with authorities only when the law requires it.
Data outside the EU
Google LLC, Apple Inc. and Cloudflare, Inc. are in the USA. Transfers to them rely on the EU–US Data Privacy Framework, which the European Commission found to give adequate protection and under which these companies are certified, and on standard contractual clauses as a fallback. Our hosting provider stores your data in the Netherlands.
Legal basis and how long we keep data
| Data | Legal basis (GDPR) | Kept for |
|---|---|---|
| Your game data on our server, with its random ID | Providing the service you use, Art. 6(1)(b) | Until you use “Clear my data”, or 400 days after your last visit |
| Your devices (install ID, kind, shop version, time zone, last use) | Providing the service you use, Art. 6(1)(b) | With your game data, or until you disconnect the device |
| Linking code with your game’s ID | Providing the service you use, Art. 6(1)(b) | Until it is used, at most 5 minutes |
| One-way code of an ID that was replaced or deleted | Our legitimate interest in telling your other devices what happened, Art. 6(1)(f) | 400 days |
| Shared tracking and receipt links, your wishlist link and name, gifts sent to you | Providing the service you use, Art. 6(1)(b) | Until you stop sharing or turn the link off, or with your game data |
| One-way code of an IP address and a link, to limit hurries | Our legitimate interest in preventing abuse, Art. 6(1)(f) | 1 hour |
| Other abuse counts (one-way codes of an IP address, install ID or game ID) | Our legitimate interest in preventing abuse, Art. 6(1)(f) | Until the count’s period ends, at most 1 day |
| Connection data in server logs | Our legitimate interest in running, securing and improving the site, Art. 6(1)(f) | 14 days |
| Anonymous page-view signals to Google Analytics | Our legitimate interest in knowing how much the site is used, Art. 6(1)(f) | 2 months |
| Statistics cookies (_ga, _ga_<ID>) and the visits they count | Your consent, Art. 6(1)(a) | Cookies 60 days; data at Google 2 months |
| Cookies the shop needs (version, time zone, bag, current purchases, device ID) | Providing the service you use, Art. 6(1)(b) | See the cookie policy |
| Push address (website) or push token (app), with your notification settings | Your consent, Art. 6(1)(a) | Until you turn notifications off or block them, or 90 days after your last visit |
| Ad cookies, and the advertising ID in the app | Your consent, Art. 6(1)(a) | Set by Google; see the cookie policy |
| Your consent choices | Our legal obligation to record consent, Art. 6(1)(c) | 13 months, then we ask again |
| Emails you send us | Our legitimate interest in answering you, Art. 6(1)(f) | 1 year after the conversation ends |
We make no automated decisions about you that have legal or similarly significant effects. To choose which flash sale or deal a “Flash sales and deals” notification is about, our server compares the day’s sales with what you have ordered and wished for, with recent ones counting more. It uses only your game data, it only decides which sale a notification names, and it stops when you turn that kind of notification off. Apart from that, nothing is used to profile you, except Google’s ad personalisation if you allow it.
Your rights
You have the right to see the personal data we hold about you, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable format, and to withdraw any consent without affecting what happened before. To use these rights, email contact@dopaminechic.com. We answer within one month.
Your account page shows your game data, and “Clear my data” deletes it on our server. Everything our server holds about your game is shown there, and the app also lists the devices linked to it. It is linked only to a random ID in your browser, so we can’t find it from an email. Notification data disappears when you turn notifications off. For server logs, tell us roughly when you visited and from which IP address, so we can find the entries.
You can also complain to a data protection authority. Ours is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); you can also go to the authority where you live or work.
Age
Dopamine Chic is meant for people aged 16 and over. If you are under 16, please don’t turn on notifications or accept ad or statistics cookies, and ask a parent or guardian first.
Security
The site only works over encrypted connections (HTTPS). Notifications on the website are end-to-end encrypted between our server and your browser. Notifications in the app travel encrypted to Google and Apple, who deliver them and could read them, so they contain only the text you see. We keep as little data as possible, so there is little that could leak. Access to our servers is limited to the people who run them.
Fonts and other outside resources
Our fonts and our own scripts are served from our own servers, so loading a page doesn’t send your IP address to font services. Google’s scripts for ads and statistics are loaded from Google, as described above. Pages and product images are delivered through Cloudflare.
If you live outside the EU
United Kingdom. The UK GDPR gives you the same rights as above. You can complain to the Information Commissioner’s Office (ico.org.uk).
Switzerland. The Swiss Federal Act on Data Protection applies to you. You have the rights described above, and you can contact the Federal Data Protection and Information Commissioner (edoeb.admin.ch). Data may be processed in the EU and, for ads, in the USA, under the safeguards described above.
South Korea. We collect the game data, cookies and connection data described above and, if you allow them, push addresses, push tokens, ad cookies and statistics cookies, for the purposes and periods stated. We don’t provide personal data to third parties except as described under “Who else receives data”. Data is transferred abroad to the recipients listed there, in the countries listed, for hosting, delivery, notifications, ads and statistics, by network transfer when you use the site. When a retention period ends we delete data so it can’t be restored. You can refuse cookies in your browser and in the consent window. Children under 14 should not use notifications, ad cookies or statistics cookies. For privacy questions, email contact@dopaminechic.com.
Australia. We handle personal information as described above. Contact contact@dopaminechic.com with questions or complaints; if you are not satisfied with our answer, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).
United States. We don’t sell personal information. With your consent, Google uses cookies for targeted advertising, which some US state laws call “sharing”; you can refuse or withdraw it under “Cookie settings”. The site also honours the Global Privacy Control signal as a refusal of ad and statistics cookies. Dopamine Chic is not directed at children under 13.
Changes
We will update this policy when what we do changes, and change the date at the top. If a change affects what we do with your data, we will tell you on the site before it takes effect.