Privacy policy

Last updated: 19 October 2026

At a glance

• No cookies, no tracking, no ads, no analytics tools.
• Fonts, scripts and images all load from this domain, not from Google or other third parties.
• The website is delivered through Cloudflare, which processes your IP address for technical reasons.
• The web server keeps no access logs for this website.
• To suggest a language, your browser language and, if that gives no match, the country code that Cloudflare derives from your IP address are used for a moment. Nothing is stored or logged on the server.
• A cookie-free visitor counter shows how many people visit. It stores only totals, never anything that identifies you.
• Your scores, progress and settings stay in your own browser.

1. Controller

Email: [email protected]

2. Delivery through Cloudflare

This website runs on a server in a data centre in Germany and can only be reached through the content delivery and security network of Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you open a page, Cloudflare processes the connection data needed for this: IP address, date and time, the requested address, the browser identification (user agent) and the previously visited page (referrer). This serves to deliver the pages and to fend off attacks such as DDoS.

The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest is a secure, fast and stable website. Cloudflare processes the data as a processor. Data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); the EU Commission's standard contractual clauses also apply. If a connection fails, your browser may send a technical error report (Network Error Logging) to Cloudflare. It contains no page content, only details of the connection error. More in Cloudflare's privacy policy.

3. Server and logs

The web server keeps no access logs for this website. Technical error messages are used only to fix faults; they are rotated and deleted automatically. The server is operated by a hosting provider in Germany that processes data only on my behalf (Art. 28 GDPR).

4. Visitor counter

The small line at the bottom of each page shows how many people have visited that day. When a page loads, your browser sends one request to /api/visit. The server combines your IP address (as passed on by Cloudflare) and your browser's user agent with a random value and turns them into a one-way hash. The random value exists only in the server's memory and is replaced every day at midnight UTC, so the hash cannot be reversed or linked to your visits on other days.

The hash is kept in memory only, for the rest of the day at most, so that each visitor is counted once per day. It is never written to disk. The only data stored is the number of visitors per day, kept for up to 400 days. The counter sets no cookies and stores nothing in your browser. Requests from obvious bots are not counted.

The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest is knowing roughly how many people play here and showing it on the website.

5. Language suggestion

When you open the English page, a small script compares your browser language with the languages this site is available in. If it finds no match, it asks /api/geo, which only returns the two-letter country code that Cloudflare derives from your IP address (for example "DE"). The server does not store or log it, and nothing is sent to third parties. If a translation exists, a small card offers it; your choice (or a "no thanks") is saved in your browser's local storage so the card does not return.

6. Storage in your browser

The games save your best scores, progress and settings in your browser's local storage, and the front page remembers the last games you opened ("Jump back in"). This data stays on your device and is never sent to me. Storing it is strictly necessary for features you use (§ 25 (2) no. 2 TDDDG); the legal basis for the processing is Art. 6 (1) (f) GDPR. You can delete it at any time in your browser settings. Details are on the cookie page.

7. Contact by email

If you write to me, I process your email address and your message to answer your request. The legal basis is Art. 6 (1) (f) GDPR. I delete the messages once they are no longer needed and no statutory retention periods apply. My mailbox is operated by Proton AG (Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland). There is an adequacy decision of the EU Commission for Switzerland (Art. 45 GDPR).

8. Links to other websites

Links to other websites, such as my portfolio at adrian-kozlowski.de, only open when you click them. From then on, the privacy policy of that website applies.

9. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to [email protected]. Because the visitor counter keeps nothing that identifies you, I cannot assign counted visits to a person (Art. 11 GDPR).

You can also complain to a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI Baden-Württemberg).

10. Changes

I update this policy when the website changes. The date at the top shows the current version.