Website Privacy Policy

The short version

Looking for what our games do? See the games privacy policy.

1. Who is responsible

The controller within the meaning of Art. 4 (7) GDPR is:

We have not appointed a data protection officer, and are not required to (Art. 37 GDPR, § 38 BDSG).

2. When you open this site

To deliver a page, your browser necessarily sends us its IP address, the page requested, the time, and the browser's self-description (user agent). Requests pass through Cloudflare, which delivers the site and filters attacks, and then reach our server in Germany.

• Our server does not write these requests to a log. They are processed only for as long as it takes to answer.
• Cloudflare processes them to deliver the site and to detect and block attacks and abuse, and keeps security-related records for a limited time under its own rules. For bot protection, Cloudflare may set a strictly necessary security cookie (such as __cf_bm, 30 minutes) that contains no identifier of you.

Legal basis: Art. 6 (1)(f) GDPR. Our legitimate interest is delivering a fast, secure website. Access to your device by the security cookie is strictly necessary for that service (§ 25 (2) no. 2 TDDDG).

3. Contact details on this site

Our name, address and email on the imprint, support and privacy pages are loaded after an invisible check by Cap, a proof-of-work challenge that we run ourselves on our own server (captcha.sheesh.solutions). Your browser solves a small computation; no puzzle, no tracking, no third party. For the check, our server processes your IP address and browser information without storing them in a log. The revealed details are kept in your browser's session storage until you close the tab, so you do not solve it again on the next page.

Legal basis: Art. 6 (1)(f) GDPR. Our legitimate interest is keeping address harvesters from collecting the details in bulk while still showing them to people. The session storage is strictly necessary for the function you used (§ 25 (2) no. 2 TDDDG).

4. When you write to us

If you email us, we process your address and what you write to answer you. Legal basis: Art. 6 (1)(b) GDPR where it concerns a contract or a purchase, otherwise Art. 6 (1)(f) GDPR. We delete the correspondence once your request is settled, unless tax or commercial law requires us to keep it (§ 147 AO, § 257 HGB). Our mail server is our own and runs in Germany.

5. Recipients and transfers

• Cloudflare: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, processor (Art. 28 GDPR).
• netcup: netcup GmbH, Daimlerstraße 25, 90441 Nürnberg, Germany, hosting, processor.
• Hetzner: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, hosting, processor.

Cloudflare is based in the USA. Transfers are covered by the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Cloudflare is certified, and by the EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR). We make no automated decisions about you (Art. 22 GDPR). You are not obliged to provide any data; without the technical connection data, the site cannot be shown.

6. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object at any time to processing based on legitimate interest (Art. 21). Write to the address in section 1.

You can complain to a supervisory authority (Art. 77 GDPR). The one competent for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, datenschutz-hamburg.de .