Legal

Privacy Policy

Last updated: 26 July 2026

This privacy policy covers the website. The iOS apps have a policy of their own: Privacy in my apps.

Table of contents

• Controller
• Overview of processing activities
• Relevant legal bases
• Security measures
• Transfer of personal data
• International data transfers
• General information on data storage and deletion
• Rights of data subjects
• Provision of the online offering and web hosting
• Cookies and web analytics
• Blogs and publication media
• Contact and enquiry management

Controller

See the legal notice.

Overview of processing activities

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of data processed

• Inventory data
• Contact data
• Content data
• Usage data
• Meta, communication and procedural data
• Log data

Categories of data subjects

• Communication partners
• Users

Purposes of processing

• Communication
• Security measures
• Organisational and administrative procedures
• Feedback
• Provision of our online offering and user-friendliness
• Information technology infrastructure
• Measurement of web performance (real user measurements)

Relevant legal bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection rules may apply in your or our country of residence or domicile. Should more specific legal bases be relevant in individual cases, we will inform you of these in this privacy policy.

• Consent (Art. 6(1) sentence 1 lit. a GDPR) - "The data subject has given consent to the processing of the personal data concerning them for one or more specific purposes."
• Performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 lit. b GDPR) - "Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps prior to entering into a contract."
• Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the fundamental rights of the data subject.

National data protection rules in Germany: In addition to the data protection rules of the GDPR, national data protection rules apply in Germany. These include in particular the Bundesdatenschutzgesetz (BDSG - German Federal Data Protection Act). The BDSG contains special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of data, transfers and automated decision-making, including profiling. In addition, the data protection laws of the individual German federal states may apply.

Note on the applicability of the GDPR and the Swiss DSG: This privacy policy serves to provide information under both the Swiss DSG (Swiss Federal Act on Data Protection) and the GDPR. For this reason, the terminology of the GDPR is used. However, within the scope of application of the Swiss DSG, the legal meaning of the terms is determined by that act.

Security measures

In accordance with the legal requirements and taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the threat to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access to, entry of and disclosure of the data, and safeguarding its availability and separation. Furthermore, we have established procedures that ensure the exercise of data subject rights, the deletion of data and responses to threats to the data. We also take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by data-protection-friendly default settings.

Transfer of personal data

In the course of our processing of personal data, it may happen that the data is transferred to, or disclosed to, other bodies, companies, legally independent organisational units or persons. The recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

International data transfers

Data processing in third countries: Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies, this only occurs in accordance with the legal requirements. If the level of data protection in the third country has been recognised by means of an adequacy decision (Art. 45 GDPR), that decision serves as the basis for the data transfer. Otherwise, data transfers only take place if the level of data protection is otherwise ensured, in particular through standard contractual clauses (Art. 46(2)(c) GDPR), explicit consent or in the case of contractually or legally required transfers (Art. 49(1) GDPR). Beyond that, we will inform you of the bases for third-country transfers for each individual third-country provider, with adequacy decisions taking precedence as the basis. Information on third-country transfers and existing adequacy decisions is available from the EU Commission: commission.europa.eu.

Under the so-called "Data Privacy Framework" (DPF), the EU Commission has also recognised the level of data protection of certain companies from the USA as secure within the scope of the adequacy decision of 10.07.2023. The list of certified companies and further information on the DPF are available on the website of the US Department of Commerce at dataprivacyframework.gov (in English). We will inform you in this privacy policy which of the service providers we use are certified under the Data Privacy Framework.

General information on data storage and deletion

We delete personal data that we process in accordance with the legal provisions as soon as the underlying consents are withdrawn or no further legal bases for the processing exist. This applies to cases in which the original purpose of the processing no longer applies or the data is no longer required. Exceptions to this rule exist where legal obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal prosecution or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that applies specifically to certain processing operations.

Where several retention periods or deletion deadlines apply to a piece of data, the longest period always prevails.

If a period does not expressly begin on a specific date and is at least one year, it automatically starts at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in the context of which data is stored, the event triggering the period is the date on which the termination or other ending of the legal relationship takes effect.

Data that is no longer retained for its originally intended purpose but on the basis of legal requirements or other reasons is processed exclusively for the reasons that justify its retention.

Retention and deletion of data: The following general periods apply to retention and archiving under German law:

• 10 years - retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets as well as the work instructions and other organisational documents required to understand them, accounting records and invoices (§ 147(3) in conjunction with (1) nos. 1, 4 and 4a AO (German Fiscal Code), § 14b(1) UStG (German VAT Act), § 257(1) nos. 1 and 4, (4) HGB (German Commercial Code)).
• 6 years - other business documents: commercial or business letters received, copies of commercial or business letters sent, and other documents insofar as they are relevant for taxation (§ 147(3) in conjunction with (1) nos. 2, 3 and 5 AO (German Fiscal Code), § 257(1) nos. 2 and 3, (4) HGB (German Commercial Code)).
• 3 years - data required to take into account potential warranty and compensation claims or similar contractual claims and rights, and to process related enquiries, is stored for the duration of the regular statutory limitation period of three years (§§ 195, 199 BGB (German Civil Code)).

Rights of data subjects

Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, arising in particular from Art. 15 to 21 GDPR:

• Right to object: "You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you …"
• Right to withdraw consent: You have the right to withdraw consent you have given at any time.
• Right of access: "You have the right to obtain confirmation as to whether data concerning you is being processed and to obtain access to this data."
• Right to rectification: "You have the right to have incomplete data concerning you completed and inaccurate data concerning you rectified."
• Right to erasure and restriction of processing: "You have the right to request that data concerning you be erased without undue delay or, alternatively, to request a restriction of the processing of the data."
• Right to data portability: "You have the right to receive data concerning you which you have provided to us in a structured, commonly used and machine-readable format."
• Complaint to a supervisory authority: "You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, if you consider that the processing infringes the provisions of the GDPR."

Provision of the online offering and web hosting

We process users' data in order to be able to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to deliver the content and functions of our online services to the user's browser or device.

• Types of data processed: usage data; meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers); log data (e.g. log files concerning logins or the retrieval of data or access times).
• Data subjects: users (e.g. website visitors).
• Purposes of processing: provision of our online offering and user-friendliness; information technology infrastructure; security measures.
• Legal bases: legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Collection of access data and log files: Access to our online offering is logged in the form of so-called "server log files". The server log files may include the address and name of the web pages and files retrieved, the date and time of retrieval, the volume of data transferred, notification of successful retrieval, the browser type and version, the user's operating system, the referrer URL and, as a rule, IP addresses and the requesting provider. Log file information is stored for a maximum of 30 days and then deleted or anonymised.

Cookies and web analytics

This website does not use any tracking services. No usage profiles are created and no cross-site tracking takes place.

Language selection cookie: This website is available in German and English. On the first visit, visitors are redirected to the appropriate language version based on the language set in their browser. So that this redirect does not happen again on every visit and a later manual choice via the language switcher is preserved, a cookie named "lang" is set. It contains only the code of the selected language version ("de" or "en") - no identifier and no personal data. The storage period is one year. The cookie applies to all pages of this website (Path=/), is transmitted only over encrypted connections (Secure) and is sent only to a limited extent on requests originating from third-party websites (SameSite=Lax). It is not transferred to third parties and is not used for recognition, analysis or profiling. As the cookie is technically necessary for the language selection expressly requested by the visitor, no consent is required (§ 25(2)(2) TDDDG (German Telecommunications Digital Services Data Protection Act)). The legal basis for the processing is our legitimate interests in providing the online offering in a user-friendly manner (Art. 6(1) sentence 1 lit. f GDPR).

The selected display setting (light or dark theme) is stored locally in the browser (localStorage); this information remains on your device and is not transmitted to us or to third parties. The same applies to your progress in the gamebooks on this website: it is stored locally in the browser only and can be deleted at any time through your browser settings.

Cloudflare Web Analytics: To measure reach (e.g. the number of page views) and the technical performance of this website (e.g. loading times and Core Web Vitals), we use Cloudflare Web Analytics provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. For this purpose, Cloudflare embeds a small JavaScript (beacon) in the pages, which transmits technical details when a page is visited (e.g. page visited, referrer, loading time, browser type, device type) to Cloudflare; the return channel runs via our own domain. The service uses no cookies, no localStorage and no fingerprinting; individual visitors are not identified or recognised across multiple visits. The IP address is processed during transmission for technical reasons but is not stored for the purpose of identifying individual visitors.

• Types of data processed: usage data (e.g. pages visited, referrers, loading times); meta, communication and procedural data (e.g. IP addresses, browser and device type).
• Data subjects: users (e.g. website visitors).
• Purposes of processing: reach measurement (e.g. access statistics); measurement of web performance (real user measurements); provision of our online offering and user-friendliness.
• Legal bases: legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).
• Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; Cloudflare is certified under the EU-US Data Privacy Framework (DPF). Privacy policy: cloudflare.com/privacypolicy.

GoatCounter: To measure reach (e.g. the number of page views and the origin of visits), we use the open-source service GoatCounter. For this purpose, a small JavaScript is embedded in the pages, which transmits technical details when a page is visited (page visited, referrer, browser and system type, screen width, language and the country of origin derived from the IP address) to GoatCounter. The service uses no cookies and no fingerprinting; the data is stored exclusively in aggregated form, individual visitors are not identified and are not recognised across multiple visits. The IP address is processed during transmission for technical reasons but is not stored.

• Types of data processed: usage data (e.g. pages visited, referrers); meta, communication and procedural data (e.g. browser and system type, country of origin).
• Data subjects: users (e.g. website visitors).
• Purposes of processing: reach measurement (e.g. access statistics); provision of our online offering and user-friendliness.
• Legal bases: legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).
• Provider: GoatCounter (open-source web analytics). Privacy policy: goatcounter.com/help/privacy.

Blogs and publication media

We use blogs or comparable means of online communication and publication (hereinafter "publication medium"). Readers' data is processed for the purposes of the publication medium only to the extent necessary for its presentation and for communication between authors and readers, or for reasons of security.

• Types of data processed: inventory data, contact data, content data, usage data as well as meta, communication and procedural data.
• Data subjects: users.
• Legal bases: legitimate interests (Art. 6(1) sentence 1 lit. f GDPR).

Comments and contributions: When users leave comments or other contributions, their IP addresses may be stored on the basis of our legitimate interests. This is done for our security in case someone leaves unlawful content. The information provided in the context of comments is stored permanently until the user objects.

Contact and enquiry management

When you contact us (e.g. by post, contact form, email, telephone or via social media) and in the context of existing user and business relationships, the details of the enquiring person are processed insofar as this is necessary to answer the contact enquiries and any requested measures.

• Types of data processed: inventory data, contact data, content data, usage data as well as meta, communication and procedural data.
• Data subjects: communication partners.
• Purposes of processing: communication; organisational and administrative procedures; feedback; provision of our online offering.
• Legal bases: legitimate interests (Art. 6(1) sentence 1 lit. f GDPR); performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 lit. b GDPR).

This English version of the privacy policy is provided for ease of understanding only. The legally binding version is the German version DE; in case of any discrepancy, the German version prevails.