← Back to the game

Privacy policy

KAIJUMIETZ – as of October 2026 · Deutsche Fassung

1. Controller

2. In short

• You can play without an account. We use no cookies, no tracking, no ads and load no external fonts. Music, sounds and fonts come from our own server.
• The address you enter is not stored by us. It is only sent to the map service OpenStreetMap, which turns it into the map.
• You only get onto the leaderboard if you want to – with your consent, either with just a player name or additionally with an email address to claim the name. Only the player name, points and neighbourhood are public – never the email address and never the street or house number.
• Friends’ leaderboards: if you play via an invite link, your player name and points appear in that leaderboard – visible only to people with the link. Creators can delete their leaderboard at any time.
• You can delete all your leaderboard data in the game at any time.

3. Hosting and server log files

The website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. When the site is accessed, the server processes technically necessary data (including IP address, time, requested file, browser identifier) in log files in order to deliver the website securely and reliably. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). A data processing agreement is in place with the host.

4. Map data and address search (OpenStreetMap)

When you enter an address or use “My location”, our server requests the map data for you: the address search from Nominatim of the OpenStreetMap Foundation (United Kingdom, adequacy decision of the EU Commission), the address suggestions while typing from Photon by komoot GmbH (Germany) and the building and street data from public Overpass servers (overpass-api.de, overpass.private.coffee, overpass.kumi.systems). Only the address you entered or the coordinates are transmitted – not your IP address.

So that the same place doesn't have to be loaded again and again, we keep the map responses on our server for up to 30 days (a cache with no reference to you: only the search term or coordinates and the public OpenStreetMap data). If our server is ever unavailable, your browser exceptionally contacts these services directly; for technical reasons they then receive your IP address.

The legal basis is Art. 6(1)(b) GDPR (providing the game you actively start). Location sharing only happens after you allow it in your browser. Alternatively you can play the “Demo city” without any request. Privacy notice of the OpenStreetMap Foundation: osmfoundation.org/wiki/Privacy_Policy.

5. Local storage in your browser

The game stores in your browser's local storage (localStorage): the sound setting, your language choice, your personal records per place, if applicable your leaderboard status (random session token, player name, guest or claimed), the cat you picked, a copy of your profile picture (claimed names only, so it shows instantly), whether you collapsed the “claim your name” hint and, if needed, the result of your last run until you enter it after logging in. This data does not leave your device by itself and is strictly necessary for the functions you request (Section 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act). You can delete it at any time in your browser settings.

6. Leaderboard

There are two voluntary ways onto the leaderboard. Without an entry you can always play normally.

a) Quick entry (guest)

You only enter a player name of your choice. We store: player name, time and version of your consent, the game language (so that emails reach you in your language), a hashed session token (so this device stays linked to your entry) and, per place, your best result (points, share destroyed, number of buildings and defeated vehicles, name of the neighbourhood/place, time). You don't need an email address for this.

b) Claim your name (registered)

In addition we store your email address. Your name is then reserved for you and you can log in on any device – without a password: you receive a link or a 6-digit code by email (valid for 24 hours on first sign-up, otherwise 30 minutes; stored only as a hash). Registration only becomes valid after confirmation (double opt-in); unconfirmed sign-ups are deleted after 48 hours at the latest.

Overtake notification (optional): Only if you tick this separately will you receive an email when someone overtakes you in your neighbourhood – at most once a day. Each of these emails contains an unsubscribe link; you can also switch them off in the game.

News by email (optional): Only if you tick this separately will we occasionally send you news about the game (e.g. new features). You can unsubscribe at any time via the link in every email or in the game.

What is public?

Only the player name, points, share destroyed and neighbourhood/place, plus the label “guest” or “claimed”. Never public: email address, entered address, street or house number.

Legal basis, withdrawal, storage period

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future – most easily in the game via “Delete my data” (removes name, email and all results immediately) or by emailing us. The data is kept until you delete it. Guest entries whose device has not been in touch for a year and that had no new result during that time are deleted automatically. Stored game runs (random identifier + start time, no personal reference) are deleted after 2 days. Emails are sent via our host's mail server.

6a. Sharing challenges

When you tap “Challenge friends” at the end of a round, we store the following for the share link: the name you enter on the card (freely chosen, can be a made-up name), your points, the share destroyed, the number of buildings, the neighbourhood/place, the game language (for the preview in messengers) and – so friends can play at the same place – your search input or the rounded coordinates of the play area. Anyone with the link can see the name, points and place. So better not enter your exact home address if you want to share the link – “just a city” or a street name is enough. Anyone who opens a duel link and plays can add themselves to the duel table with a freely chosen name and their points; it is visible to everyone who has the link. We delete these entries after 12 months. The share image is created only in your browser. The legal basis is Art. 6(1)(b) GDPR (you actively use the share function).

6b. Profile: cat, stats and profile picture

If you are on the leaderboard, we additionally store the cat you picked (the look of your game character) and simple game stats (number of rounds and the totals of points, destroyed buildings and defeated vehicles). Only you can see these in your profile.

Profile picture (optional, claimed names only): If you upload a picture, your browser first scales it down to 256 × 256 pixels; our server then saves it again and removes all metadata (e.g. camera or location data). The picture is not public: it does not appear on the leaderboard or in shared challenges, only in your own profile. For moderation (e.g. unlawful content) the operator can view and remove it. Please only upload pictures you hold the rights to and that don't show other people without their consent.

Coins, shop and World Tour: As soon as you have a player name (guest or claimed), we store with your account: your coin balance, shop items you bought and wear (cats, hats, laser colours), upgrade levels, your best destruction rate per World Tour city and your “City of the Day” streak. Every coin transaction (earned, spent) is logged with date, amount and reason so that errors and abuse can be traced. On your first sign-in we take over the progress stored in your browser once. Without a player name, this data stays only in your browser’s local storage. “Delete my data” removes all of it.

City of the week and collars: If you play the city of the week with a claimed name, your player name and your best score of that week appear in the public weekly ranking. Whoever is number 1 on Sunday at 9:30 pm (Berlin time) is shown with player name, city and score in the list of weekly winners (👑 next to the name in the rankings) and receives an email at the account address. Won collars and the collar you wear are stored with your account; your choice is also kept in your browser's local storage.

Before/after picture: This picture is created only in your browser and is only transmitted if you share or save it yourself.

The legal basis is your consent (Art. 6(1)(a) GDPR) or providing the profile features you use (Art. 6(1)(b) GDPR). You can remove the picture at any time under “Settings”; “Delete my data” immediately deletes the picture, the stats and all other data.

6c. Feedback

Via “Feedback & ideas” you can send us a message. We store the message, its type (idea, bug, praise, other), your player name if available and – only if you provide it – your email address for a reply. If you are logged in with a claimed name, you can instead tick that we may reply to your account email. If we reply, we also store our answer. The message is also delivered to us by email. We delete feedback once it has been dealt with, at the latest after 24 months. The legal basis is Art. 6(1)(f) GDPR (improving the game, answering your request).

6d. Weekly City reminder by email

After a round you can voluntarily enter your email address to find out once a week which city is the new Weekly City and who won last week. You do not need an account for this. We only store your email address, your game language, when you signed up and confirmed, and which week you last received.

The reminder only starts once you click the link in our confirmation email (double opt-in). Unconfirmed addresses are deleted automatically after 48 hours. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in every email; your address is then deleted immediately. Occasionally you may also receive other news about the game at this address, again with an unsubscribe link.

7. Protection against abuse

To prevent mass sign-ups and spam, we briefly store an irreversible hash of your IP address or email address, created with a secret key, for registration, login and the submission of results. These entries are deleted after 24 hours. The legal basis is Art. 6(1)(f) GDPR.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), as well as the right to withdraw consent given (Art. 7(3) GDPR). You can also lodge a complaint with a data protection supervisory authority, e.g. the Hamburg Commissioner for Data Protection and Freedom of Information.

← Back to the game · Legal notice (Impressum)