Privacy Policy

Datenschutzerklärung pursuant to GDPR (EU 2016/679)

  The short version: We don't use cookies. We don't collect your name, email, or any personal data. We use privacy-friendly analytics that cannot identify you. That's it.

1. Responsible Party (Controller)

Pranav Jaju
Kopernikusstr. 6, 86179 Augsburg, Germany
jajupranav01@gmail.com

2. What We Collect

2a. Hosting (Server Logs)

This website is hosted by Vercel Inc., with source code stored on GitHub Inc. When you visit, the hosting provider automatically processes:

Your IP address (temporarily, for technical delivery — not stored long-term by us)
Date and time of access
Requested page URL
Browser type and operating system
Referring URL

This data is processed for the purpose of delivering the website to your browser and ensuring security. It is not combined with other data sources.

Legal basis	Art. 6(1)(f) GDPR — legitimate interest in providing and securing the website
Retention	Edge access logs are retained for a short period (typically up to 30 days) by the hosting provider for security and abuse prevention, then deleted
Third party	Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA — bound by EU Standard Contractual Clauses (SCCs) for international data transfers under Art. 46 GDPR
Data Processing Agreement	Vercel offers a GDPR-compliant DPA: vercel.com/legal/dpa

2b. Analytics — Vercel Web Analytics

We use Vercel Web Analytics, a privacy-first analytics service built into our hosting platform, to understand aggregate usage of our city guides. The service collects only the following non-identifying information:

Page URL visited
Referrer source (e.g., "from WhatsApp," "from Google," or "direct")
Approximate country (derived from IP at request time — the IP is never stored)
Browser type and device category (mobile / tablet / desktop)
Aggregate visit counts

  Vercel Web Analytics does NOT: set any cookies, store your IP address, fingerprint your device, track you across other websites, build user profiles, or collect any personally identifiable information. Visitors are counted using a daily rotating, hash-based identifier that resets every 24 hours and cannot be linked back to an individual.

Because no cookies are set, no personal data is stored, and no cross-site tracking takes place, this analytics service does not require prior consent under Art. 5(3) of the ePrivacy Directive (2002/58/EC), § 25 TDDDG (Germany), or Art. 6 GDPR. Processing is justified under our legitimate interest in understanding aggregate usage of the website.

Legal basis	Art. 6(1)(f) GDPR — legitimate interest in measuring aggregate website usage
Cookies	None
Personal data stored	None
IP address	Processed in-memory only for country lookup; never written to storage
Cross-site tracking	None
Third party	Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA
More info	vercel.com/docs/analytics/privacy-policy

Compliance reference: This implementation aligns with guidance from the European Data Protection Board (EDPB) and the French CNIL, which both confirm that aggregated, cookieless analytics that do not store IP addresses or unique identifiers may be operated without prior user consent.

2c. Local Storage (Your Browser)

The game version of the scavenger hunt stores your score and progress in your browser's localStorage. This data:

Never leaves your device
Is not sent to any server
Is not accessible by us
Can be cleared by you at any time (clear browser data)

Legal basis	§ 25 Abs. 2 Nr. 2 TDDDG — strictly necessary for the service requested by the user (saving game progress)
Consent required	No — localStorage for game state is technically necessary
Data stored	Score, current stop, answered riddles (per-city key, e.g. `germany-munich-game-v1`)

3. What We Do NOT Collect

Names, email addresses, or phone numbers
Location or GPS data
Photos or camera access
Payment information
Social media profiles
Advertising identifiers

4. Cookies

This website does not use cookies.

No first-party cookies, no third-party cookies, no tracking cookies, no session cookies. None.

5. External Links

This website does not load any third-party fonts, scripts, or trackers. The only external service involved is:

Google Maps — when you tap an address link, your browser is redirected to Google Maps in a new tab. No request is made to Google until you actively tap the link. Once you leave our site, Google's own privacy policy applies. See Google's Privacy Policy.

All fonts used on this site are system fonts already installed on your device — nothing is downloaded from any external font CDN.

6. Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to information (Art. 15) — request what data we hold about you
Right to rectification (Art. 16) — correct inaccurate data
Right to erasure (Art. 17) — request deletion of your data
Right to restrict processing (Art. 18)
Right to data portability (Art. 20)
Right to object (Art. 21) — object to processing based on legitimate interest
Right to lodge a complaint with a supervisory authority (in Bavaria: Bayerisches Landesamt für Datenschutzaufsicht)

To exercise any of these rights, contact us at the email address above.

In practice, since we store no personal data, there is likely nothing to provide, correct, or delete — but we respect your right to ask.

7. Changes to This Policy

We may update this privacy policy from time to time. The date below indicates the last revision.

Last updated: April 2026

Impressum (Legal Notice) →

Liability Disclaimer (Haftungsausschluss) →