PRIVACY POLICY.

1. Controller

2. Hosting and technical provision

HISTUNE is hosted on a virtual server operated by STRATO AG. We operate our own web, application and database services on this server for delivery, security and database operation. When the app is accessed, the data processed may include the IP address, time of access, requested address, browser and device information, and technical error data.

This processing is necessary to provide the app securely and reliably and is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure operation of the service.

STRATO AG privacy information

3. Game rooms and players

For each game, we process the room code, game and genre settings, randomly generated access tokens, player names or nicknames, avatar, score, timeline, guesses and timestamps. Registration is not required.

This data is required to provide the multiplayer service expressly requested by users (Article 6(1)(b) GDPR) and to prevent misuse and technical errors (Article 6(1)(f) GDPR). Wherever possible, please use nicknames instead of full legal names.

Game data is stored only for as long as necessary for operation, error analysis and protection against misuse. You may request early deletion by email, quoting the room code.

4. Local storage in the browser

HISTUNE stores the selected language and randomly generated host and player tokens locally in the browser. Your YouTube consent decision is also stored. This information is necessary for language selection, recognition within a game and consent management. The legal basis is Section 25(2)(2) TDDDG or, for YouTube consent, Section 25(1) TDDDG.

We currently do not use our own analytics, advertising or marketing cookies.

5. YouTube and YouTube API Services

Music is played exclusively on the host device through the official embedded YouTube player. The player is loaded only after the host presses the clearly labelled start button. This may transmit data including the IP address, device and browser information, and usage data to Google Ireland Limited and affiliated companies. HISTUNE uses YouTube's privacy-enhanced mode through youtube-nocookie.com, does not block advertising and does not download audio files.

The legal basis for loading the player is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw this consent directly beside the player, after which the embedded player will be removed. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Google Privacy Policy · YouTube Terms of Service

6. Recipients and international data transfers

Recipients may include the hosting and platform providers named above. Google and affiliated companies may also process data outside the European Union or European Economic Area. The applicable statutory transfer mechanisms and safeguards available at the relevant time are used for such transfers.

7. Your rights

Subject to the requirements of the GDPR and the applicable statutory conditions, you have the right to obtain access to the personal data we process about you (Article 15 GDPR), rectification of inaccurate data (Article 16 GDPR), erasure of your data (Article 17 GDPR), restriction of processing (Article 18 GDPR), and data portability (Article 20 GDPR).

Where processing is based on your consent (Article 6(1)(a) GDPR), you may withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Right to object (Article 21 GDPR): Where we process your data on the basis of legitimate interests (Article 6(1)(f) GDPR), you have the right to object to that processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.

To exercise your rights, simply send an informal email to contact.breuer.apps@gmail.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).