Privacy Policy

Controller

Creationes Virtuales CV GmbH, Bremsstrasse 1a, 50969 Köln, Germany. Email: [email protected]

Represented by the Managing Director: Christian Strang. We have not appointed a data protection officer, as we are not legally required to do so.

Server log files

When you visit this website, our hosting provider automatically collects and stores information in server log files that your browser transmits. This includes the IP address, date and time of the request, the requested resource, the referrer URL, and the browser and operating system used. This data is processed to ensure a smooth connection, comfortable use of the website, and to evaluate system security and stability.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the technically error-free presentation and optimisation of our website). The data is stored only for as long as necessary for these purposes.

Hosting

This website is hosted by DigitalOcean, LLC. When you visit the website, DigitalOcean processes the server log data described above on our behalf as a processor under Art. 28 GDPR. Where data is transferred to servers outside the European Economic Area, the transfer is safeguarded by the EU Standard Contractual Clauses.

Local storage on your device

Mental Royale saves your game progress, scores, streaks and settings directly in your browser using local storage. This data stays on your device, is not transmitted to us or to any third party, and is strictly necessary for the games to work as you expect. Because it is purely functional first-party storage, it does not require your consent under § 25 (2) TDDDG. You can delete this data at any time by clearing your browser's site data.

Analytics (Plausible)

We use Plausible Analytics to understand how our website is used. Plausible is a privacy-friendly analytics tool that does not use cookies and does not store any personal data. It does not track you across websites or devices, and all measurement data is aggregated so that individual visitors cannot be identified. The data is processed on servers within the European Union.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the statistical analysis of usage to improve our website). As no personal data is processed and no information is stored on or read from your device that is not strictly necessary, no consent is required.

Language preference cookie

If you explicitly choose a display language, we store that choice in a cookie (mr-locale) on your device so the site can suggest the right language on your next visit. The cookie contains only the language code, is not used for tracking, and is strictly necessary to provide the function you requested (§ 25 (2) TDDDG). It expires after one year and you can delete it at any time in your browser.

User accounts

If you create an account, we process the data you provide: your email address, a password (stored only as a salted hash, never in plain text), your chosen nickname, your preferred language, and technical metadata such as the verification status of your email address, session data (a session cookie plus IP address and browser information of active sessions) and timestamps. We use this data to operate your account: logging you in, letting you recover your password, and showing your nickname to other players in features such as leaderboards.

The legal basis is Art. 6 (1) (b) GDPR (performance of a contract). The session cookie is strictly necessary for the login function you request (§ 25 (2) TDDDG), so no consent banner is required. Account data is stored in a managed PostgreSQL database operated by DigitalOcean in Frankfurt, Germany. Your account data is kept until you delete your account; you can delete it yourself at any time on the account page, which permanently removes your data.

Sign-in with Google

You can optionally sign in with your Google account. In that case Google transmits your name, email address and profile picture to us; we do not receive your Google password. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is responsible for the processing on Google's side; details are available in Google's privacy policy at policies.google.com/privacy. The legal basis for our processing of the transmitted data is Art. 6 (1) (b) GDPR.

Transactional emails (Brevo)

For account-related emails (email verification, password reset) we use the sending service Brevo, operated by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. Brevo processes your email address and the content of these emails on our behalf as a processor under Art. 28 GDPR. The legal basis is Art. 6 (1) (b) GDPR, as these emails are necessary to operate your account.

Newsletter

You only receive our newsletter if you have expressly opted in, for example via the optional checkbox when creating an account. Registration works without this consent. We use a double opt-in procedure: the subscription only becomes active once you have confirmed your email address via the link we send you. We log the consent (timestamp and the wording of the consent text) to be able to demonstrate it.

The legal basis is your consent, Art. 6 (1) (a) GDPR. You can withdraw it at any time with effect for the future, either on your account page or via the unsubscribe link in every newsletter; your contact is then removed from our newsletter list. The newsletter is sent via Brevo (see above).

Bot protection (Cloudflare Turnstile)

To protect the sign-up and password-reset forms against automated abuse we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Turnstile evaluates technical signals of your browser (such as IP address and browser characteristics) to distinguish humans from bots; it does not use advertising cookies and does not track you across websites. Where data is transferred to the USA, the transfer is safeguarded by the EU Standard Contractual Clauses.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in protecting our services against spam and abuse).

Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). To exercise any of these rights, contact us using the details in the “Controller” section above.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your residence, workplace, or the place of the alleged infringement.

Changes to this policy

We may update this privacy policy to reflect changes to our services or legal requirements. The current version is always available on this page.