Privacy Policy
Status: this page as currently served
What this page does
The foyer is a reading space. You do not need an account here; if you like, you can become a regular (see below). Otherwise, personal data is only stored if you submit it yourself via two forms: upcoming case pre-registration and the newsletter (both detailed below). Standard web server logs are retained briefly by our hosting provider strictly for server operations and are never analyzed.
One exception: under /tisch you can enter a five-character room code. It is sent to this server, matched against active rooms, and routes you to the corresponding game — it is not stored anywhere. It appears in the URL and therefore in the host's server log entry.
Release notifications
The release notification acts as a radar: a brief message whenever a new case, board game, or table goes online. You choose what to receive — new escape cases, new board games, new arena tables, or several of them. You must check at least one of the three categories; without a check mark, the server does not accept the address. Messages are sent only to confirmed addresses and only for selected categories: as soon as something is released there, a message is sent — selecting only new cases means you hear nothing about a new table. No newsletter, no disclosure to third parties, no advertising, no account. The legal basis is your consent (Art. 6(1)(a) GDPR).
Confirmation. After registration, we send an email with a confirmation link. The address is only recorded once that link is clicked — unconfirmed entries are deleted after two days. This is not a formality: it is the only way to verify that the address belongs to the person who entered it. If you expand your consent later — for example by adding another category —, you confirm again; an expanded consent counts as a new one. (In the code, this registry is still called drahtbericht; that is a filename, not a separate list.)
Stored alongside. Your selections, the language in which you signed up (used for every message), the timestamps of entry and confirmation, two random tokens — one for the confirmation link, one for the unsubscribe link —, the number of the last message you received (preventing duplicates), and a salted hash of your IP address — irreversible and used solely to prevent third-party sign-ups.
Retention period. Until you unsubscribe. Every message contains an unsubscribe link: it leads to a button, and one click unsubscribes you. Where your email client provides an “Unsubscribe” option next to the sender, that single click is also sufficient; an informal message to the address in the legal notice works as well. Unsubscribing deletes your entry completely — address, selections, and tokens; nothing is retained.
Feedback & bug report
The footer of every page has “Feedback & bug report”, and the foyer also has a “Feedback” button in the bottom right corner. What you send there reaches the workshop of this house: the kind of message (feedback, bug or idea), your text, your star rating if you give one, the address of the page without the part after the question mark, the game it is about, the size of your window, the pixel density, the language of the page and the family of your browser (Chromium, Gecko, WebKit or another, without a version number and without the full identifier). We also store a salted hash of your IP address so that nobody floods the form; the address itself is not stored. We ask for no name and no e-mail address. The operator also receives the message by e-mail, without the hash. It is deleted after two years. The legal basis is our legitimate interest in finding bugs and making the games better (Art. 6(1)(f) GDPR).
Pre-registration for an upcoming case
The file of a case that has no room yet contains a second field — with a different purpose: exactly one message when the case is ready, after which the record is deleted. It is therefore kept in a separate file and never merged with general release notifications. Stored data includes email address, date, and the same salted IP hash; the legal basis is likewise your consent, revocable informally.
The Optional Account: Regular
If you like, you can become a regular: an optional account made of a nickname and a password, with an email address only if you want one. In return, your nickname is protected at the arena tables and carries a seal there, and every round you finish there appears under “My rounds”. The legal basis is the contract for this account, which you enter into by creating it (Art. 6(1)(b) GDPR). You can find a Die Luftnummer table, your seat in an escape game and every saved case again under “Open case files” on any device. Every game can still be played without an account.
What is stored. Your nickname, a comparison key derived from it, your password only as a bcrypt hash, when the account was created and when you were last here. One session per sign-in: a checksum of your cookie rather than the cookie itself, whether you chose to stay signed in, and when the session ends. For each round in the arena: the game, your place, how many people played and whether you won — no other players, no chips, no points. For each open Die Luftnummer case: the room code, the chapter and when that last changed; which seat is yours is kept by the table itself, and when the case is over, the line goes. For each seat in an escape game: the room code and a reference to the seat, which goes with the room. For each saved case, a case file (see below). To stop password guessing, a brake counts new accounts and failed attempts per connection, with the IP address only as a salted checksum and, for a failed attempt, the nickname or account concerned. Anything there older than 24 hours is deleted at the next sign-in.
The cookie. You stay signed in through a cookie named tr_stammgast: a random identifier that only travels over HTTPS, cannot be read by scripts and is never attached to a form on another site. Without “Keep me signed in on this device” it ends when you close the browser, and the session expires after 24 hours without use; with the box ticked it lasts 90 days. It is strictly necessary for the sign-in you explicitly request (Section 25(2) No. 2 TDDDG), which is why no consent banner is needed. If you are not signed in, you get no cookie.
What you can do yourself. At /en/stammgast you can change your password, sign out everywhere, add or remove an email address, make your profile public or hide it, discard a saved case file, download your rounds as a CSV file (Art. 20 GDPR) and delete your account: completely, including sessions and rounds, after which the nickname is free again. We delete an account that has not been used for 24 months, as well as one whose nickname is offensive or impersonates someone else. Nothing is passed on.
The email address. If you like, you can give an email address when creating your account or later in your account, in case you forget your password. We do not store the address itself, only a fingerprint of it (HMAC-SHA256 with a secret key of the house) from which it cannot be recovered; to reset, you type it in again. It receives one email to confirm it and afterwards only one whenever you request a new password with your nickname and the address. The link in it is valid for one hour and only once, the confirmation link for 24 hours. Emails are sent from the house mailbox. The legal basis is your consent (Art. 6(1)(a) GDPR): you give it by entering the address when creating your account or by ticking the box in your account, and withdraw it with “Remove email address”. If you also tick the box for new games when creating your account or in your account, the same address is added to the newsletter (above), with its own confirmation and its own unsubscribe link.
The public profile. If you make your profile public in your account, the address /@nickname shows anyone who knows it your nickname, since when you have been a Regular and how many rounds you have played and won, per game — no other players and no times. It is not public by default, is in no search engine and can be hidden again with one click. The legal basis is your consent (Art. 6(1)(a) GDPR). You pass on your invite link (/@nickname?freund=1) yourself: whoever opens it sees your nickname and an invitation, even if your profile is not public, but never your rounds.
Friends and calls. Who you sat with at an arena table appears for 30 days under “Recently at the table”, and only if their round is also in their account; “Your regular crew” shows the Regulars you have played with most often. The house reads both from your rounds and stores nothing new for them. If you ask someone to be friends, from that list, by nickname or through their invite link, we store who asked whom, the status (open, friend or blocked) and when; your friend sees your nickname and you see theirs. If you call a friend to a table, the call stays in the database for ten minutes with the room code and the game, and your friend sees it on the next tableroom page they open. Either of you can end a friendship with one click, a block stops every request and every call, and everything goes with the account. The legal basis is the contract for this account (Art. 6(1)(b) GDPR).
Favourite games and ratings. If you mark a game with the star, we store the game and when, so that it appears at the top of your account as a way to the table. If you rate a round while signed in, at an arena table, after a match in an action, sport or co-op game, in the debriefing of an escape game or at the board, your rating and your line also belong to your account: under “My ratings” you see and change them, and for an arena game a new rating replaces the old one. Both go with the account. The legal basis is the contract for this account (Art. 6(1)(b) GDPR).
Saved cases. If you sit at an escape game table while signed in, the house puts the game state into your account as a case file at every checkpoint, that is after a solved act, in every break and when the host saves the case: the room code, when the room was opened, the act, the mission time, the state of the case and your chair, but no names of your fellow players. A game that runs in the browser stores its game state in the same way when you play signed in. Under “Open case files” you continue the case or discard the file; it goes by itself when the case is over or when nobody has saved it for 90 days, and with the account. The legal basis is the contract for this account (Art. 6(1)(b) GDPR).
No Cookies for Guests, Cookieless Analytics
Unless you are signed in as a regular, this site sets no cookies and writes nothing to your browser's local storage. Visits are still counted: with Matomo on a server we operate ourselves, without cookies and without recognising you across visits. What is stored is the page requested, date and time, the referring page and coarse browser and device details; the IP address is truncated and never stored in full. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in seeing whether this site is found and used. Nothing is passed on to third parties and there is no advertising. Because the counting sets no cookie and builds no fingerprint, and the regular's cookie carries nothing but the sign-in, there is no consent banner here.
No requests to third parties
Images, video, and stylesheet reside on the same server as this page. Fonts from third-party providers are never loaded — typography relies entirely on fonts already installed on your device. As long as you do not click a button, no request leaves this site to any third party.
What happens when clicked: buttons and links leading to external sites — the tip jar options in the footer and the reference to the studio liesener.de — are standard links. Clicking one opens the respective provider's page, transmitting your IP address and timestamp to that provider — but not the referrer, ensured by rel="noreferrer". Nothing is transmitted beforehand.
Sharing: Below every magazine article, on its card in the overview, and on the page of every table, there is a share button. “Share” opens your device's native dialog, “Copy link” places the address onto your clipboard — nothing leaves your device until you select an app yourself. “Share on WhatsApp”, by contrast, is a standard link, not an embedded service: clicking it opens WhatsApp and transmits your IP address and the prepared text to WhatsApp — but not the referrer, ensured by rel="noreferrer". Nothing is transmitted beforehand.
Numbers on the shelf
Beneath each case, the number of initiated rounds and average completion time are displayed. These metrics originate from the game log. They contain no names, no addresses, and no IP addresses — only room code, station reached, player count, and duration.
Voices from the table
If the home page shows the section “Voices from the table”, these are authentic quotes from real teams taken from a game's debrief form. They appear there only if both conditions are met: the team gave explicit consent — via an unselected checkbox — and the studio read and approved the text beforehand. There are no fabricated reviews; if nothing authentic is available, nothing is displayed.
Displayed are the quote, a chosen team name, the rating, the case, and the time taken in minutes. No real name, no address, no photo. The legal basis is consent (Art. 6(1)(a) GDPR); it can be revoked at any time — in the form itself by unchecking the box (removing quote and name) or informally to the address in the legal notice.
The average rating on a case tile is different and does not depend on this consent: it calculates across all submitted ratings for that case — including those where no text was approved for publication. An individual rating never appears; what is shown is an anonymous, unassigned average, appearing only once at least three ratings exist. The number next to it counts rounds, not feedback forms: each seat submits its own, with a match having two to four.
Inside the games
Opening a table leaves the foyer and enters the respective game. There, a chosen display name is stored, the IP address is reduced to a salted hash to curb abuse, and a processor handles real-time connections on our behalf. Full details appear in the privacy notice of each game.
Your rights
Access, rectification, erasure, restriction, objection, and complaint to a supervisory authority — informally to sascha@liesener.de. Responsible party is Sascha Liesener; see legal notice for address.
