Privacy Policy

Controller

Marvin Bay

c/o Online-Impressum.de #6018, Europaring 90, 53757 Sankt Augustin, Germany

General information

This website is operated for the Humppadle puzzle. We only process personal data as needed to provide the service.

Hosting

The site is hosted in Germany at netcup. Server logs may include technical access data (IP address, date/time, requested pages) to ensure secure operation. Legal basis: Art. 6(1)(f) GDPR.

Storage

We use essential storage (localStorage) to keep your game progress and stats in your browser and to remember your privacy decision, including the consent version, analytics choice, and timestamp. We also set essential session cookies for attempt limiting, account sessions, and secure sign-in state. This essential storage is required to provide Humppadle and is based on Art. 6(1)(f) GDPR and Section 25(2) TDDDG.

Optional analytics

With your express consent, Humppadle uses the self-hosted analytics software Umami for statistical reach measurement. The legal basis is Art. 6(1)(a) GDPR and, as a precaution, Section 25(1) TDDDG. The analytics script is not loaded and no analytics request is sent before consent.

Umami may process the hostname, page path without search parameters or URL fragments, page title, referrer, time of access, browser language, screen size, browser, operating system, and device type. The IP address can be processed by Umami to derive an approximate location and a pseudonymous session, but is not stored permanently by the application.

The Umami instance is operated by Marvin Bay on separate infrastructure hosted by netcup in Germany at stats.marvinbay.de. Analytics data is not sent to an external analytics SaaS provider and no third-country transfer is intended.

The implementation does not use marketing cookies, advertising profiles, free-text entries, custom user identifiers, URL search parameters, or URL fragments. Your browser's Do Not Track setting is respected. Analytics data is deleted after no more than 90 days.

You can withdraw consent at any time using the Privacy Settings control at the top of this page. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Optional account data

You can use Humppadle without an account. If you register, we store username, email, hashed password, optional OAuth account identifiers (Google), and your personal game history to show private account statistics.

Completed anonymous results can be transferred to your account after sign-in within the same browser session.

OAuth providers can be linked later in account settings so one account can be used with credentials and OAuth sign-in.

Profile avatars are resolved via OAuth provider image or Gravatar (email hash) when enabled.

Local credentials accounts require email verification. Verification and password-reset emails are sent via our mail provider. Verification/reset tokens are stored as hashed, expiring server-side values.

Credentials sessions can be persistent (30 days, optional "stay logged in") or short-lived (24 hours without "stay logged in").

A public leaderboard is available. By default, your username can appear there based on daily score points. You can opt out in your account settings at any time.

Authorized admin accounts can access account metadata and gameplay history in the internal admin area for moderation, support and abuse-prevention purposes.

If an account is hard-banned for abuse prevention, login IPs and user agents may be stored as one-way HMAC hashes to enforce the ban without storing the raw values.

Usage counts

We store aggregated daily usage counts without personal identifiers. We also store aggregated solve stats (attempt counts and give-ups) per song to calculate the public par score. No personal or device identifiers are stored in these aggregates. We also record anonymized timestamps of completed plays to determine peak hours. For signed-in users, usage is counted once per user per day after you start a preview. These internal usage counts are separate from optional Umami analytics.

External media (Deezer)

Audio previews are loaded from Deezer. When you play a preview, a connection to Deezer is made and technical data (such as IP address) may be transmitted. Legal basis: Art. 6(1)(f) GDPR.

Your rights

You have the right to access, rectification, erasure, restriction of processing, and data portability. You also have the right to lodge a complaint with a supervisory authority.

Account deletion is available in-account. This removes personal profile data; aggregated global puzzle stats remain only in anonymized form.