Privacy policy

Who is responsible

Florian Fischer
Hauptstraße 17c
85395 Attenkirchen

Email: info@brezel-bub.de

Our principle

As little data as possible. You can play all of World 1 without an account, and we do not store anything that identifies you while you do. Your own browser remembers your progress; none of it is sent to the server.

What we store when you create an account

• Your chosen player name. It appears on the leaderboard. A nickname is enough — your real name is explicitly not required.
• Your password is stored only as a one-way hash (bcrypt). It is never stored as plain text, including by the operator.
• Your email address. It is required to create an account and is stored immediately, initially marked unconfirmed. We send a confirmation link to the address; it is confirmed only when you click it. We use it solely to send a password reset link at your request and to associate future unlocks with your account — no advertising, no notifications, no sharing with third parties. Password resets require a confirmed address. If you change it on your account page, the new address takes effect only after confirmation, so a typo cannot lock you out. Deleting your account also deletes your address immediately.
• Your game progress — unlocked worlds, collected pretzels and defeated enemies.
• Your leaderboard entries with score, world and date.

The legal basis is Article 6(1)(b) GDPR: these details are needed to provide a game account.

Contact form

When you write to us using the Contact form , your name, email address, subject and message are emailed to info@brezel-bub.de — and a confirmation is sent to you. Nothing is stored in the database; the message remains only in our inbox and is deleted once your enquiry is resolved, after six months at the latest. It is not shared. The legal bases are Article 6(1)(a) GDPR (your consent, given by ticking the form's checkbox) and Article 6(1)(f) — our interest in answering questions about the game.

To prevent spam, we also briefly record your IP address when you submit the form (see the next section). The security code is stored only in your session and expires after half an hour.

Sign-in attempts and form rate limits

If a sign-in fails — or the contact form is submitted — we briefly store the time and your IP address to prevent password guessing and spam. These entries are automatically deleted after one hour at the latest. The legal basis is Article 6(1)(f) GDPR — our legitimate interest in protecting accounts.

Server logs

The web server records requests with the IP address, time and requested page, as usual. This supports secure operation and troubleshooting.

Cookies

A single cookie, used after signing in, keeps your session active. It contains no personal details, only a random identifier. There is no advertising, no tracking cookies and no third-party advertising networks.

Audience measurement with Umami

We use Umamito see which pages on brezel-bub.de are visited and whether the game is reliably accessible. Umami runs at umami.search-optimizer.de and works without cookies. We do not create advertising profiles or use the analysis to recognise you across other websites.

We collect technical request data such as the requested page, time, referrer, browser, operating system, device type and approximate location based on the IP address. The IP address is not stored in plain text. The legal basis is Article 6(1)(f) GDPR — our legitimate interest in measuring usage and technical availability while minimising data collection.

Retention periods

Your account, progress and leaderboard entries remain for as long as your account exists. Deleting it removes them immediately. Failed sign-in attempts disappear automatically after one hour at the latest. The host deletes web server logs according to its retention periods.

Sharing data

Your data is not sold or shared with third parties. It is stored on this website's web server. The hosting provider processes it on our behalf under a binding agreement (data processing under Article 28 GDPR).

The website does not load resources from third-party servers — no fonts, libraries or analytics. Everything the browser loads comes from brezel-bub.de.

Children

The game is also intended for children. It therefore uses a nickname and password. If you are under 16, ask your parents before creating an account.

Your rights

• Access to your stored data — when signed in, you can see it at any time under Your account.
• Rectificationif something is incorrect.
• Erasure. You can have your account deleted completely, including progress and leaderboard entries. Do this yourself under Your account, or simply email info@brezel-bub.de .
• Lodge a complaint with a supervisory authority. The competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach.