Legal
Privacy notice
Draft with placeholders. Provider details and actual server settings still need to be fully checked.
Controller
MiTSCHO, sole proprietorship
Proprietor: [full legal name]
[serviceable address]
Email: [public contact address]
Website delivery
When you visit this website, the server processes connection data needed to deliver it. The Apache access log configured for this subdomain records the IP address, time, HTTP method, requested path without URL query parameters, protocol version, response status, and data volume. Error logs may contain additional technical information needed to investigate faults. Access codes and submitted form contents are not recorded in the access log.
These data support secure delivery, troubleshooting, and abuse prevention. The intended legal basis is Article 6(1)(f) GDPR (legitimate interest in secure and reliable operation). Apache logs rotate daily; the current server configuration keeps 14 older rotations. Data may be retained longer for a specific security incident. [check any further backups and actual deletion periods]
Hosting and recipients
The website runs on a dedicated server at Hetzner. The hosting provider may have access to technical data while operating and maintaining the service. [confirm the exact provider entity, server location, and processing agreement]
Protected playtest area
Invited testers enter a shared access code to open the download area. The server checks the code against a password hash stored outside the webroot and website repository. An essential session cookie remembers this access; it is scoped to /playtest/, is transmitted only over HTTPS, and is unavailable to scripts. Server authorization ends after at most eight hours, at logout, or when the code changes. The cookie normally ends with the browser session; browser restore settings can affect this. To prevent guessing, the server temporarily retains keyed hashes of peer IP addresses and login-attempt times for a rolling 15-minute quota window; stale entries are removed on the next attempt. No individual tester account is created. [add invitation and contact process when established]
Cookies, analytics, and external content
The public website pages set no cookies. The playtest area uses only the essential session cookie described above. There are no analytics or third-party fonts, videos, or scripts. A local script controls Pip's clickable voice companion and the optional music player. No audio starts when the page opens. After you press Play, the player may automatically continue with the next local track. Pip's voice is requested only when you click her. The video spaces currently load no YouTube content. A future external Steam link will be opened only when clicked; Steam's own privacy notice applies to the site it opens.
Your rights
Subject to the GDPR, you may request access, correction, erasure, restriction of processing, and, where applicable, data portability. You may object to processing based on legitimate interests for reasons arising from your particular situation. You also have the right to lodge a complaint with a data protection authority. Please use the contact address above for requests.
Draft dated September 2026.