Privacy Policy

1. General information

Protecting your personal data is very important to me. I only process your data in accordance with applicable laws (GDPR, German DDG). This privacy policy explains the key aspects of how data is processed on this website.

2. Controller

Tommy Kammerer
Raiffeisenstr. 30
77743 Neuried, Germany
Email: [email protected]

3. Hosting

This website is hosted by Cloudflare, Inc. (USA). When you visit the site, Cloudflare may process your IP address for technical reasons. This is necessary to deliver the website and protect it from attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Cloudflare is certified under the EU-US Data Privacy Framework (DPF), ensuring an adequate level of data protection for transfers to the USA.

4. Analytics, tracking, and cookies

This website uses Cloudflare Web Analytics, a cookie-free analytics tool provided by the hosting provider Cloudflare (see section 3). Only aggregated usage data is collected (page views, referrer, browser, operating system, country). There is no individual visitor tracking or cross-site tracking. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing website usage). For more information, see Cloudflare's privacy policy.

Beyond that, this website uses no additional tracking tools, analytics services, or advertising cookies. No cookies are set at all.

The site uses your browser’s localStorage for functional data: your theme preference, your learning progress (completed and last visited chapters, start and completion time, quiz results, unlocked badges, interaction milestones), the name you enter for your certificate, display settings of the live block view, and the leaderboard and heartbeat settings described in sections 6 and 7. This data stays in your browser. Only the parts named in sections 6 and 7 are ever sent to the server, and only in the situations described there. You can remove the local data at any time with the “Delete all stored data” button on the Cookie Settings page.

5. Client-side processing

This is an educational website. The simulators and quizzes run entirely in your browser. Your inputs in them and your quiz answers are not transmitted to any server. Your certificate name also stays in your browser, unless you submit it to the leaderboard: the submit form pre-fills it as your nickname (section 7).

Three exceptions reach the server:

6. Anonymous activity heartbeat

Once you have unlocked at least one badge, your browser sends a small anonymous request to /api/lb-ping at most once every twelve hours. This lets the leaderboard page show how many learners are progressing through the journey without having joined the leaderboard yet ("ghost count").

What is transmitted and stored:

Your IP address is processed transiently only for rate limiting and is not stored. The stored row contains nothing else.

Retention: a heartbeat row that has not been updated for 30 days is deleted by the next daily cleanup run.

Opt-out: the toggle "Don't send anonymous activity pings" on the Cookie Settings page stops further pings from this browser. The “Delete all stored data” button on the same page only clears data stored in your browser. It does not change data on the server, but afterwards the heartbeat row can no longer be linked to your browser and is deleted under the retention rule above. Your opt-out choice is kept when you use that button.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in pseudonymous usage statistics for the operation of the site).

7. Leaderboard (optional)

The /leaderboard page lets you publish a nickname and your current score (badges collected, speedrun time if you completed the journey, count of perfect first-try quiz scores) to compare with other learners. Participation is strictly opt-in: your nickname and score are only transmitted when you tick the consent checkbox and submit the form. Opening the submit form already loads Cloudflare Turnstile (see below). Loading the leaderboard itself requests the public list from this site’s server, including whether you chose to show only verified entries. That filter choice is remembered in your browser.

What is stored on the server when you submit:

Your IP address is processed transiently only for rate limiting and bot detection (Cloudflare Turnstile). It is not stored in the leaderboard database. Legal basis: Art. 6(1)(a) GDPR (consent).

Right to deletion: the "Remove me" button on the leaderboard page deletes your entry within seconds. Additionally, entries that have not been updated for more than 12 months are automatically deleted by a scheduled cleanup job.

The leaderboard form embeds Cloudflare Turnstile for bot detection, which loads a script from challenges.cloudflare.com. Turnstile is a privacy-respecting CAPTCHA alternative (no cookies, no tracking).

8. Third-party services

All fonts, images and other site assets are self-hosted and served from this domain. Your browser additionally connects to Cloudflare services on other domains: the Web Analytics script from static.cloudflareinsights.com (section 4) and, on the leaderboard page, Cloudflare Turnstile from challenges.cloudflare.com (section 7). Requests to Koios (section 5) are made by this site’s server, not by your browser. Links to external websites are only followed when you click them.

9. Your rights

Under GDPR, you have the right to access, rectification, erasure, restriction, data portability, and objection regarding your personal data. If you believe your data is being processed unlawfully, you may lodge a complaint with a supervisory authority:

Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg
www.baden-wuerttemberg.datenschutz.de

10. Objection to unsolicited emails

The use of contact data published in connection with the legal notice obligation for the purpose of sending unsolicited advertising and information materials is hereby expressly prohibited. The operator of the pages expressly reserves the right to take legal action in the event of unsolicited advertising information, such as spam emails.