Privacy policy

Controller

The controller responsible for data processing is the operator of this site – see Legal notice.

Hosting and server logs

The site is hosted by Vercel Inc. (USA); the server functions run in Frankfurt am Main, Germany. When you visit the site, Vercel processes technically necessary data such as your IP address, the time of access, the requested address and your browser identifier in order to deliver the site and protect it against attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). For transfers to the USA, Vercel relies on the EU-US Data Privacy Framework or EU Standard Contractual Clauses.

Game rooms (database)

Game rooms are stored with Supabase in Frankfurt am Main, Germany. This includes the room code, the player names you choose, a random player ID, an encrypted check value (hash) of your browser secret and the game state. Feel free to use a nickname. Rooms without activity are deleted automatically after 7 days. The legal basis is providing the game you want to use (Art. 6(1)(b) GDPR).

So that moves reach all players instantly, your browser opens a real-time connection to Supabase. For technical reasons, this involves processing your IP address; the connection only carries notices such as “room has changed”, no game content.

Profile, bottle caps and leaderboard

For bottle caps, level and stats, the server creates a profile for your random player ID: your chosen name, balance, experience and the results of finished games – no email address and no account, stored with Supabase in Frankfurt am Main. If you play the Daily Dungeon, we store your first run of the day (moves and score) and show it with your player name on the public daily leaderboard. The legal basis is providing the game (Art. 6(1)(b) GDPR). If you want your profile or entries deleted, write to the address in the imprint.

Protection against abuse

To prevent rooms from being created en masse, we count new rooms per internet connection. For this, we only store a shortened hash of your IP address, not the address itself, and delete the counters after one day (Art. 6(1)(f) GDPR).

Storage in your browser

Your browser's local storage (localStorage) holds your player ID and its secret, your name, your recently visited rooms and your settings (sound, card back, table color). This data only leaves your browser to the extent needed to play, and it is strictly necessary for the site to work (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

Language cookie

We only set the cookie “ob-lang” if you switch the language yourself or close the language notice. It stores nothing but the chosen language (“de” or “en”), so the site appears in that language on your next visit, and it expires after one year. It is technically necessary to provide this feature at your request (§ 25(2) no. 2 TDDDG) and is not used for tracking. You can delete it at any time in your browser settings.

Analytics

We use Vercel Web Analytics to see which pages and games are used. It works without cookies and without storing your IP address; only aggregated data such as page views, country of origin and device type is analyzed (Art. 6(1)(f) GDPR).

Fonts

All fonts are served from our own server. There is no connection to Google.

Your rights

You have the right of access, rectification, erasure and restriction of processing, the right to data portability and the right to object to processing based on legitimate interests. You can also lodge a complaint with a data protection supervisory authority.