Privacy Policy

Last updated: July 2026

1. Controller

2. General Information

We process personal data only to the extent necessary and in accordance with the requirements of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). Below we inform you about the nature, scope, and purpose of the processing.

3. Hosting & Server Logs (Cloudflare)

The website and game server are operated via Cloudflare (Cloudflare, Inc., San Francisco, USA). When you access the site, Cloudflare processes technically necessary access data (including your IP address, the date and time, the requested resource, and your browser type) in order to deliver and secure the site. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Data may be transferred to the USA in the process; Cloudflare bases this on the EU Standard Contractual Clauses.

4. Local Storage in Your Browser

To run the game, we store data locally in your browser (including your save game, a random device-city code, the identifier of a signed-in account, and your sound and display settings). The random device-city code is additionally stored in a technically necessary first-party cookie so that your save game is not lost if the browser clears local storage. This data is technically required, remains on your device, is not analyzed for advertising purposes, and is not shared with third parties. Legal basis: Art. 6(1)(f) GDPR and Section 165(3) TKG 2021 (Austrian Telecommunications Act) (technically necessary storage); this functional cookie does not require consent.

5. User Account & Cloud Save Game

You can optionally create an account with a username and password. We store the username and a cryptographic hash (PBKDF2) of the password — the password itself is never stored in plain text. The same applies to the optional recovery code, which you can use to reset a forgotten password: it is shown to you once and stored by us only as a hash. Your save game is stored under a random code in the cloud (Cloudflare KV) so that you can load it across devices. An email address is not required for this. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Playing without an account is always possible.

To protect against automated login and reset attempts, we briefly store (for a maximum of 15 minutes) counters relating to the IP address and the affected username (Art. 6(1)(f) GDPR — abuse prevention).

You can permanently delete your account at any time directly in the game (Menu → Account → “Delete account”). This irrevocably removes your account, cloud save game, and login session from our servers.

6. Error Reports (Telemetry)

If a technical error occurs in the game, your browser sends a short error report to our server: the error message, an abbreviated technical location of the error (stack trace), the browser identifier (user agent), your language setting, and the game version. The reports contain neither names nor account or save-game data; the IP address is not stored along with them. They serve solely to detect and fix errors and are automatically deleted after 14 days at the latest. Legal basis: legitimate interest in stable, error-free operation (Art. 6(1)(f) GDPR).

7. Advertising (Google AdSense)

To fund this free-to-play offering, we show — only with your consent — unobtrusive advertising within the game (not on the other pages) via Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). In doing so, cookies or comparable technologies may be set and data (including your IP address, device and usage data) may be transferred to Google and its partners — including to third countries outside the EEA (in particular the USA) — in order to deliver, measure, and bill for ads. We request the ads exclusively on a non-personalized basis; no personalized advertising tracking takes place. The legal basis is your consent (Art. 6(1)(a) GDPR). You can find further information in the Google Privacy Policy. Without consent, no advertising script is loaded and no advertising is delivered.

8. Consent & Withdrawal

Before advertising is delivered, we obtain your consent via a consent notice (Google’s consent management platform). Advertising is voluntary: if you do not agree, no advertising script is loaded and no advertising is displayed — your access to the game remains fully unrestricted.

Your decision is stored locally in your browser. You can withdraw a consent you have given at any time via the privacy settings of the consent notice — the withdrawal takes effect immediately going forward and is as easy as giving consent. Alternatively, you can delete your locally stored data for this site; we will then ask you again.

9. Contact & Feedback

If you contact us by email (for example via the feedback link in the game menu), we process your email address and the content you submit in order to handle your request (Art. 6(1)(b) or (f) GDPR) and delete it as soon as it is no longer required for that purpose.

10. Your Rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection. You can withdraw any consent you have given at any time. To do so, please contact us at the address given above. You can also delete your account, including your cloud save game, yourself at any time in the game (see Section 5).

You also have the right to lodge a complaint with the supervisory authority: Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Wien (dsb.gv.at).

11. Updates to This Policy

We will update this privacy policy as soon as the legal situation or the processing changes.

Legal Notice · Privacy · To the Game