Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

wortgewandt-spiel - Frank NO-SPAM-PLEASE Kuc sur2hta
c/o Online-Impressum #8734
Europaring 90
53757 St Augustin
Germany
E-mnonoail: wortgewandt.no-bots-spiel.invalid@realares.isat-rap.de

This English text is a convenience translation. The legally binding version is the German one, available at /datenschutz. In the event of any discrepancy, the German version prevails.

2. General information on data processing

As a matter of principle we process personal data of our users only to the extent necessary to provide a functioning website as well as our content and services. Personal data of our users is regularly processed only with the user’s consent. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by statutory provisions.

3. Legal bases for processing

• Art. 6(1)(a) GDPR – consent of the data subject (e.g. registering as a player, displaying your name in the ranking).
• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures (e.g. providing the game after connecting your Twitch account).
• Art. 6(1)(c) GDPR – compliance with legal obligations to which we are subject.
• Art. 6(1)(f) GDPR – protection of legitimate interests, provided that the interests, fundamental rights and freedoms of the data subject do not override them (e.g. IT security, abuse detection, server logs).

4. Provision of the website and creation of log files

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected:

• the user’s IP address (truncated / anonymised where technically feasible)
• date and time of access
• the URL accessed and the volume of data transferred
• HTTP status code
• referrer (the previously visited page)
• user agent (browser type, browser version and operating system used)

This data is stored in the log files of our system. It is not stored together with other personal data of the user. The legal basis is Art. 6(1)(f) GDPR. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected, at the latest after 7 days.

5. Hosting

We host the Service with netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. When you visit our website, the provider records the server log files listed above. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. The legal basis is Art. 6(1)(f) GDPR.

6. Sign-in via Twitch (OAuth)

To play or to view personal statistics you can connect your Twitch account using the OAuth 2.0 procedure of Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA. Depending on the permissions (scopes) granted, the following data is transmitted to us and stored by us:

• Twitch user ID
• display name and login name
• profile picture URL
• OAuth token (stored encrypted, used solely to communicate with the Twitch API)
• chat read/write permissions

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) for providing the game functionality and Art. 6(1)(a) GDPR (consent) for displaying your name in public leaderboards. You may withdraw your consent at any time with effect for the future, e.g. by disconnecting the Twitch connection in your user profile or by sending us an e-mail.

Note on transfers to third countries: Twitch is a US provider. Personal data may therefore be transferred to the USA. The transfer takes place on the basis of the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the basis of standard contractual clauses pursuant to Art. 46(2)(c) GDPR. Twitch privacy notice: https://www.twitch.tv/p/legal/privacy-notice/ .

7. Twitch chat integration

During a live round the Service reads messages written publicly by viewers in the connected Twitch chat in order to detect proposed solutions. The data processed in this context comprises the Twitch display name, the Twitch user ID and the message content. The processing serves to run the game and award points and is based on Art. 6(1)(f) GDPR (legitimate interest in a functioning chat interaction); for permanent storage in the ranking, consent is obtained pursuant to Art. 6(1)(a) GDPR.

Viewers may object to the storage of their display name in the ranking at any time, e.g. by e-mail to the contact address given above.

8. Cookies and local storage

We use only technically necessary cookies and entries in the browser’s local storage (e.g. session cookie, authentication token, language settings). These are required to operate the Service; the legal basis is section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR. No tracking, analytics or advertising cookies are set.

9. SignalR / real-time connections

We use WebSocket/SignalR connections to update the game state live. Technical connection data (connection ID, IP address) is processed in order to deliver messages to the correct recipient. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR respectively (technical provision).

10. Storage period

We store personal data only for as long as is necessary for the respective purposes or as prescribed by statutory retention periods. Specifically:

• server log files: a maximum of 7 days
• Twitch account and connection data: until the account is deleted or the connection is revoked
• game statistics: until consent is withdrawn or a deletion request is made
• statutory retention (e.g. section 147 AO, section 257 HGB): up to 10 years

11. Recipients and processors

Personal data is passed on only to the following categories of recipients: hosting and infrastructure service providers, Twitch (for API communication) and, where legally required, the competent authorities. Agreements pursuant to Art. 28 GDPR are in place with processors. A transfer to third countries takes place only under the conditions set out in section 6 above.

12. Rights of data subjects

You have the right at any time to:

• information about the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (“right to be forgotten”, Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to the processing (Art. 21 GDPR)
• withdraw consent given, with effect for the future (Art. 7(3) GDPR)

An informal message to the contact address given in section 1 is sufficient to exercise these rights.

13. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement (Art. 77 GDPR). A list of the supervisory authorities in Germany is available at www.bfdi.bund.de .

14. Automated decision-making

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.

15. Data security

We employ technical and organisational measures pursuant to Art. 32 GDPR to protect your data against accidental or intentional manipulation, loss, destruction or unauthorised access. In particular, the connection between your browser and our server is encrypted using TLS.

16. Currency of and changes to this privacy policy

This privacy policy is dated 6 September 2026. As the Service is developed further, or as a result of changed legal or regulatory requirements, it may become necessary to adapt this privacy policy. The current version is available at /privacy.