Privacy

What is stored

• Which cases you have solved and how many questions you needed for them.
• Whether you have a subscription and until when.
• The history of a case you are playing, so you can stop and come back. It belongs to your account and is deleted with it.
• Your questions to the raven, in a separate copy without an account ID and without a time of day, to improve the game and later the language models behind it. Email addresses, phone numbers, bank details and web addresses are redacted beforehand. Because you write freely and the same wording is also in your game history, we treat the copy as pseudonymous, not anonymous.
• Your email address, but only if you secure your account.
• For a purchase, the payment provider's confirmation as it reaches us. It never contains card details; those never reach us at all.

Cookies and browser storage

• On your first visit the site creates a cookie with your anonymous ID (from Supabase, the name starts with sb-, lasting up to 400 days). It holds your progress and your account. Without it the site cannot let you play without signing in. The legal basis is § 25(2) no. 2 TDDDG and Article 6(1)(b) GDPR.
• The cookie NEXT_LOCALE remembers your language and ends with your visit.
• The consent service stores your choice in your device's browser storage so that the banner does not come back on every visit.
• All other cookies, such as those from Google Analytics, are set only after you agree in the banner. If you decline, it stays with the three above.

Legal grounds

• We process your account, your progress and your subscription to provide the game to you. The legal basis is Article 6(1)(b) GDPR.
• We analyse your questions to the narrator in order to improve the game and the language models behind it. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. The copy of the questions carries no account ID, but the wording can lead back to you if you write personal details. So do not write names or data that identify you or others.
• We record stopped input in order to prevent misuse and to protect our access to the services involved. This also rests on our legitimate interest.

For how long

• Your account, progress and subscription record stay until you delete the account. After that they are gone.
• Blocked inputs are kept no longer than your account and are deleted with it.
• The copy of your questions without an account ID is kept for at most twelve months and deleted after that. If you want it gone sooner, send us the wording and we will delete it.

Who else is involved

For accounts, the database, the raven's answers and serving the site we work with providers. They process the data on our instructions. Where a service also pursues purposes of its own, it says so in its line.

• Supabase: account, sign-in and database. The data is held in Paris.
• Vercel: serving the site. Sees your IP address and which pages you open.
• Cloudflare: protection against automatically created accounts (Turnstile, invisible), plus name resolution for the domain. The protection evaluates your IP address and signals from your browser. The legal basis is our legitimate interest in warding off automated sign-ups (Article 6(1)(f) GDPR). Cloudflare's Turnstile Privacy Addendum applies (https://www.cloudflare.com/turnstile-privacy-policy/).
• OpenRouter: passes every question on to the language model.
• Google: answers your questions as the language model. By its own account Google keeps inputs and outputs for fifty-five days to detect misuse.
• Mistral: checks every input before it reaches the raven. Deliberately a different provider: what is meant not to reach someone must not be checked by that same someone.
• Google: only if you sign in with it. We then receive your email address and profile name, nothing else.
• Resend, a mail delivery service from the United States, sends sign-in links and confirmations, for example for cancelling a subscription. It receives your email address and the content of the mail for that.
• consentmanager shows the consent banner and stores your choice with proof of it. Your IP address is processed for that. The legal basis is the duty to be able to prove consent (Article 6(1)(c) in conjunction with Article 7(1) GDPR).
• Google (Google Analytics 4) measures how the site is used, with your consent. Cookies may be set and details such as your IP address and your device may be sent to Google, including to the USA.

Part of this processing takes place in the United States, above all at Vercel, OpenRouter, Cloudflare, Google, Resend and Stripe. We base this on the European Commission's adequacy decision on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses. Where we can, we choose processing in the EU.

We count how often a step happens in the game, for example how many visits there were and how many cases were solved. These are daily counters without an identifier, without a cookie and without any link to you. For visits that come through an ad we also count the word in the address that names the channel. There are no ad networks and no fonts from other servers.

With your consent, Google Analytics 4 measures how the site is used: which pages you open, where you click and how you reached the site, for example through an ad. Google sets cookies for this and receives details such as your IP address and your device. The legal basis is your consent (Art. 6(1)(a) GDPR, section 25 TDDDG). Nothing is sent to Google without your consent. A consent banner asks on your first visit, and you can change the choice at any time, with effect for the future, at the bottom of the page.

Stripe, and why it sits differently

When you take out a subscription, Stripe is the seller and therefore itself responsible for the payment data, not our processor. What Stripe collects is described in Stripe's own privacy policy.

From Stripe we only receive the confirmation that payment was made, plus amount, currency and a reference number. Your card details never reach us.

Automated, but without consequences for you

The narrator decides by machine whether an answer is yes or no and whether a case is solved. That only affects your game. There is no automated decision with legal effect under Article 22 GDPR.

Responsible for the content