Privacy Policy

Controller

c/o Online-Impressum.de #6018, Europaring 90, 53757 Sankt Augustin, Germany

General information

This website is operated for the Humppadle puzzle. We only process personal data as needed to provide the service.

Hosting

The site is hosted in Germany at netcup. Server logs may include technical access data (IP address, date/time, requested pages) to ensure secure operation. Legal basis: Art. 6(1)(f) GDPR.

Storage

We use essential storage (localStorage) to keep your game progress and stats in your browser. We also set essential session cookies for attempt limiting, account sessions, and secure sign-in state. No tracking cookies are used.

Optional account data

You can use Humppadle without an account. If you register, we store username, email, hashed password, optional OAuth account identifiers (Google), and your personal game history to show private account statistics.

Completed anonymous results can be transferred to your account after sign-in within the same browser session.

OAuth providers can be linked later in account settings so one account can be used with credentials and OAuth sign-in.

Profile avatars are resolved via OAuth provider image or Gravatar (email hash) when enabled.

Local credentials accounts require email verification. Verification and password-reset emails are sent via our mail provider. Verification/reset tokens are stored as hashed, expiring server-side values.

Credentials sessions can be persistent (30 days, optional "stay logged in") or short-lived (24 hours without "stay logged in").

A public leaderboard is available. By default, your username can appear there based on daily score points. You can opt out in your account settings at any time.

Authorized admin accounts can access account metadata and gameplay history in the internal admin area for moderation, support and abuse-prevention purposes.

Usage counts

We store aggregated daily usage counts without personal identifiers. We also store aggregated solve stats (attempt counts and give-ups) per song to calculate the public par score. No personal or device identifiers are stored in these aggregates. We also record anonymized timestamps of completed plays to determine peak hours. For signed-in users, usage is counted once per user per day after you start a preview.

External media (Deezer)

Audio previews are loaded from Deezer. When you play a preview, a connection to Deezer is made and technical data (such as IP address) may be transmitted. Legal basis: Art. 6(1)(f) GDPR.

Your rights

You have the right to access, rectification, erasure, restriction of processing, and data portability. You also have the right to lodge a complaint with a supervisory authority.

Account deletion is available in-account. This removes personal profile data; aggregated global puzzle stats remain only in anonymized form.