Privacy policy

1. Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Gaea Operations GmbH Neuer Wall 10 20354 Hamburg Germany

Managing Director: Stefan Himmelskamp Email: legal@gaeaoperations.com

2. In short

• •You decide when signing in: a profile marked "this browser only" is never transmitted anywhere. An account stores your progress with us so you can use it on several devices.

• •We use no analytics, advertising or tracking services and set no cookie for such purposes. The only cookie is the session token after you sign in to an account.

• •No content is loaded from third-party servers: fonts, images and scripts all live on our own server.

• •We ask for neither an email address nor any other contact details. An account needs only a name of your choosing and a PIN.

3. Visiting the site and server log files

When you visit the site, our hosting provider automatically records data your browser transmits in log files. These are:

• •the IP address of the requesting device
• •date and time of the request
• •name and URL of the file requested
• •browser and operating system used
• •the previously visited page (referrer), where transmitted

This data is technically necessary to deliver the site, keep it stable and defend against attacks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in secure and trouble-free operation. This data is not merged with other sources and is not evaluated on a personal basis.

Note: the name of the hosting provider and the retention period for log files still need to be entered here once hosting is settled. A data processing agreement under Art. 28 GDPR must be concluded with that provider.

4. Storage in your browser's local storage

So that your progress survives between visits, the application stores data in your browser's local storage. This data is held exclusively on your own device and is at no point transmitted to us or to anyone else.

Two entries are stored:

• •"spielehub.profile.v1": profile name, a non-reversible check value derived from the PIN you chose, chips, lives, diamonds, game statistics, unlocked achievements, purchased motifs and daily quests.
• •"spielehub.sprache": the display language you selected (German or English).

The PIN itself is not stored. A key derivation function (PBKDF2-SHA256 with a random salt) turns it into a check value that cannot be converted back into the PIN.

This storage is strictly necessary to provide the service you explicitly requested – a game profile with progress. It therefore requires no consent under § 25 (2) no. 2 TDDDG, and for the same reason no cookie banner is needed.

You can delete this data yourself at any time through your browser settings under "clear site data" or similar. The game then starts from scratch; we cannot restore it, because we never had it.

5. Account and game progress on the server

If you choose "Account (anywhere)" when signing in, we create an account for you. We then process:

• •the profile name you chose
• •a non-reversible check value derived from your PIN (using scrypt with a random salt; the PIN itself is not stored)
• •your game progress: chips, lives, diamonds, statistics, achievements, purchased motifs and daily quests
• •the times of creation and last sign-in, plus the number of failed sign-in attempts
• •a check value for your session key together with its expiry time

The legal basis is Art. 6 (1) (b) GDPR: the processing is necessary to provide the account you asked for. Counting failed attempts rests on Art. 6 (1) (f) GDPR – our legitimate interest in preventing anyone from guessing other people's PINs.

We deliberately do not ask for an email address. That also means we cannot reset a forgotten PIN, because we have no way to reach or identify you.

You can have your account deleted at any time. Write to legal@gaeaoperations.com; after deletion the account, the game progress and all sessions are irrevocably gone. Accounts nobody has signed in to for 24 months are deleted by us.

Please choose a profile name that does not identify you personally – it is not required and we do not need it.

6. The session cookie

After you sign in to an account we set a single cookie named "sw_sitzung". It contains a random value by which the server recognises your session – no name, no PIN and no game data.

The cookie is set as "httpOnly" and therefore unreadable by scripts in the browser, it is only sent to our own server ("SameSite=Lax") and it expires after 90 days. Signing out deletes it.

It is strictly necessary to provide the service you requested – signing in – and therefore requires no consent under § 25 (2) no. 2 TDDDG. For the same reason no cookie banner is needed. If you choose the "this browser only" profile, no cookie is set at all.

7. Fonts

The fonts used (Inter and Sora) are copied to our own server when the site is built and served from there. There is no connection to Google Fonts or any other external server, and no IP address is transmitted to third parties.

8. No tracking, no embeds

Apart from the session cookie described in section 6, this website sets no cookies. No analytics services such as Google Analytics or Matomo are used, no advertising networks are included, no social media buttons are embedded and no external content such as videos or maps is loaded.

A security policy in the response headers (Content-Security-Policy) technically prevents content from being loaded from third-party servers or data from being sent to them.

9. Contacting us by email

If you write to us at legal@gaeaoperations.com, we process your details solely in order to deal with your request. The legal basis is Art. 6 (1) (b) GDPR where a contract is being initiated or performed, otherwise Art. 6 (1) (f) GDPR on the basis of our legitimate interest in answering enquiries.

We delete this data as soon as it is no longer required for that purpose and no statutory retention periods apply.

10. Encryption

The website is delivered over an encrypted connection (TLS). You can see this from the padlock in your browser's address bar and from "https://" at the start of the address.

11. Disclosure to third parties

Your data is not passed on to third parties, apart from the technically necessary processing by our hosting provider and our database provider (see section 3). No transfer to countries outside the European Union takes place for our own purposes.

Note: a data processing agreement under Art. 28 GDPR must also be concluded with the database provider, and their name entered here once operation is settled.

12. Your rights

You have the following rights regarding your personal data:

• •access (Art. 15 GDPR)
• •rectification (Art. 16 GDPR)
• •erasure (Art. 17 GDPR)
• •restriction of processing (Art. 18 GDPR)
• •data portability (Art. 20 GDPR)
• •objection to processing (Art. 21 GDPR)

To exercise them, write to legal@gaeaoperations.com. If you have an account, please state the profile name. If you play without an account, we cannot provide information about your progress – it then exists only in your browser and is unknown to us.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, https://datenschutz-hamburg.de/

13. Changes to this policy

We update this privacy policy when the application or the legal situation changes. The version published here is the one that applies.