Privacy Policy
Last updated: October 2026 · applies to the game “Grauwacht” at grauwacht.web.app and the app installed from it. This is a translation of the German privacy policy. If the two versions differ, the German version applies.
1. Controller
Nico Meischner
Sportplatzweg 9
01855 Sebnitz, Germany
Email: n.meischner@web.de
2. In short
- The game itself shows no ads and contains no tracking. We only count anonymously which link visitors came from and whether they come back – without an identifier and without a stored IP address (section 3, “Audience measurement”). If your browser sends “Do Not Track” or “Global Privacy Control”, nothing is counted.
- With “Play without signing in” we create an account for you without a name, password or email address – with a random identifier only. Your save is kept on our server from the start. If you later secure the account with a name, an email address or Google, it stays the same account; until then you can reach your save only on this device.
- For an account you only need a player name and a password – no email address, no phone number.
- Optionally you can add an email address or link your Google account. Both serve one purpose only: getting back in if you forget your password. If you do not want that, you play without it – with no disadvantage.
- The data is stored with Google Firebase, the game database in Frankfurt am Main, Germany.
- You can delete your account yourself in the game at any time.
- On CrazyGames you play as a guest only, without an account and without purchases; your save stays in your browser. What is different there is set out in section 5.
3. What data, for what purpose, on what legal basis
“GDPR” is the EU General Data Protection Regulation. “TDDDG” is the German Telecommunications Digital Services Data Protection Act.
| Data | Purpose | Legal basis |
|---|---|---|
| Player name and password (the password only in encrypted form; internally a technical address of the form name@spieler.grauwacht.invalid is formed from the name, which is not a real email address) | Sign-in, save on several devices | Art. 6(1)(b) GDPR (use of the game) |
| Email address – only if you add it yourself. It then replaces the technical address above and becomes your sign-in name. We confirm it by email first. | Sign-in; resetting your password if you forget it | Art. 6(1)(b) GDPR |
| Account without a sign-in method – only if you choose “Play without signing in”: a random identifier, nothing else – no name, no password, no email address | Storing your save on our server without you signing in | Art. 6(1)(b) GDPR |
| Google account – only if you link it yourself. Google sends us an identifier and your email address. Not your profile picture, not your contacts, nothing else from your Google account. | Sign-in without a password; access if you forget your password | Art. 6(1)(b) GDPR |
| Save (buildings, equipment, progress, settings), a random device identifier and the device class (rounded memory as reported by the browser, and whether the device supports WebGL graphics – no model, no serial number) | Saving and continuing the game; preventing two devices from overwriting each other; the device class decides whether the town view is offered and shows us how many players do not get it | Art. 6(1)(b) GDPR |
| Leaderboard entries: player name, coat of arms, figures (e.g. power, beasts slain) | Friends and hunter leaderboards – visible to other players | Art. 6(1)(b) GDPR |
| Guilds: membership, rank, contributions to guild goals, gifted items | Playing together – visible to guild members | Art. 6(1)(b) GDPR |
| Guild applications: player name, coat of arms, power, keep level, your optional text and the status (open, accepted, declined) | Joining guilds that require an application – visible only to the master and deputies of that guild. The application is deleted when you join, when you withdraw it and after you have read a refusal. | Art. 6(1)(b) GDPR |
| Chat messages with player name and time, plus a list of your private conversations (with whom, preview of the last message, time). In groups: group name, members with player names, who founded it, time of the last message, open invitations (from whom, to which group) | Exchange between players – visible to everyone in the respective room (open chat, guild, private, group). Only its members see a group; you only join a group by accepting an invitation. When a group is dissolved its messages are deleted; when you delete your account you leave all groups. | Art. 6(1)(b) GDPR |
| Fairness check: the game checks whether a save can have been reached in the time played, and compares leaderboard entries with the save. If something stands out, the entry does not appear on the leaderboard; the game supervision can also exclude an account from leaderboards and guild contributions (block note with reason and date) or clear a false alarm. | Fair leaderboards and protecting other players from manipulation. Your game and your save stay untouched; you can see the reason for a block in the game. | Art. 6(1)(f) GDPR |
| Reports of chat messages (who reports, what, when) | Protection against insults and abuse; only the game supervision sees them | Art. 6(1)(f) GDPR (safe chat) |
| Technical access data (IP address, time, browser) when the page is loaded | Delivering the page, protection against attacks | Art. 6(1)(f) GDPR |
| Abuse protection (Google reCAPTCHA Enterprise / Firebase App Check): checks in the background whether requests come from the real app; device and browser characteristics are sent to Google for this | Protecting the database from automated access and costs | Art. 6(1)(f) GDPR |
| Local storage in the browser (save, settings, device identifier; for an account without a sign-in method, when we last reminded you to secure it) | Playing offline, fast start; not showing the reminder to secure your account too often | § 25(2) no. 2 TDDDG (technically necessary) |
| Audience measurement (since September 2026): on your first visit your browser remembers in local storage where you came from (a short code from the link, e.g. “reddit”, otherwise the name of the referring website) and on which day you first visited. From this it reports to our server, without any identifier: a visit, tapping “Play” on the start page, starting without signing in (until 30 September 2026: trial mode), creating or securing an account, returning on day 1, 3, 7, 14 and 30, and the language. Since 26 September 2026 also, once per start, the rough device class (e.g. “iOS” or “Android with 4 GB memory”) and short stalls of the game (game area and duration, rounded to 0.3 / 0.6 / 1 second, at most five per start) – so we can see whether the game runs smoothly on players’ devices. The server only increases daily counters (“source reddit: 12 visits”) and stores neither IP address nor identifier in the database; the IP address is only held briefly in memory to fend off mass reports (at most one hour). No one can be identified from the numbers. | Knowing which routes bring new players and whether they stay. No profile, no sharing, no advertising. If your browser sends “Do Not Track” or “Global Privacy Control”, nothing is reported. | Art. 6(1)(f) GDPR (legitimate interest in anonymous audience measurement) |
4. Recipients and service providers
The game runs on Google Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as a processor: hosting, sign-in (Firebase Authentication), database (Cloud Firestore, located in Frankfurt am Main), App Check and automatic backups. A transfer to Google LLC in the USA cannot be ruled out; it is based on the adequacy decision for the EU-US Data Privacy Framework, under which Google is certified.
Sign-in with Google: if you link your Google account, Google processes this sign-in as a separate controller – not as our processor. What happens at Google is governed by Google’s privacy policy. Google only sends us an identifier and your email address. You can remove the link in the game at any time; name and password keep working independently of it.
Emails to you: if you add an address or reset your password, Firebase sends an email to that address on our behalf (sender noreply@grauwacht.firebaseapp.com). We do not send advertising – there is no newsletter and there are no game notifications by email.
The fonts are stored on our own server; no data is sent to font providers when they load.
Discord: the game and the start page link to our Discord server. No data is sent to Discord while you play. Only when you open the link do you go to Discord (Discord Inc., USA), where Discord’s privacy policy applies.
Posts on our Discord server: so that bug reports and questions are not missed, a program reads new posts in the server’s public channels (category “GAME”, including the forums) and has them summarised by an AI service. This is Claude by Anthropic Ireland, Limited (6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland), which processes the data as a separate controller; Anthropic’s privacy policy applies. Anthropic also processes data in the USA and bases the transfer on the European Commission’s standard contractual clauses (Art. 46 GDPR). What is sent: the text, time and display name of a post. Private messages and non-public channels are not read. The posts are not released for training AI models. The legal basis is our legitimate interest in looking after the community and answering reports (Art. 6(1)(f) GDPR). You can object: write to the address in the legal notice and we will leave your posts out.
There are no other recipients (for the version on CrazyGames see section 5). Data is not sold.
5. Version on CrazyGames
Grauwacht is also available on the games website CrazyGames. This version is deliberately leaner: there you play as a guest only – without an account, without signing in (not with Google either), without the shop and without purchases. There are no leaderboards, no guilds and no chat, and the game does not connect to our database; Firebase is not even loaded. What section 3 says about player name and password, email address, Google account, leaderboards, guilds, chat, reports, the fairness check and abuse protection therefore does not apply to this version, nor does section 7 (Deleting your account).
Save: it is kept only in your browser’s local storage, together with the settings and the audience-measurement marker, and is not sent to us. If you clear the website’s storage (or your browser clears it), the save is gone. Before that you can take it with you as text under Settings → Privacy → Your data. Legal basis: § 25(2) no. 2 TDDDG (technically necessary).
Audience measurement: it also runs here as described in section 3, only with the fixed source “crazygames”. Reported without any identifier: the first visit with the language, starting to play, returning on day 1, 3, 7, 14 and 30, once per start the rough device class, and at most five short stalls per start. The reports go to our own counting service at Google (located in Frankfurt am Main, Germany), not to CrazyGames. “Do Not Track” and “Global Privacy Control” are respected here too. Legal basis: Art. 6(1)(f) GDPR.
Signals to CrazyGames: the game loads the CrazyGames program library (the “SDK”, from sdk.crazygames.com). We only tell it when loading starts and ends and when the game is running or paused – no player name, no save. No advertising is built into the game. When the library loads, CrazyGames necessarily receives the usual connection data (such as IP address and browser). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in offering the game on CrazyGames and letting loading time and playing time be measured there). If loading fails, for example because of an ad blocker, the game keeps running unchanged.
CrazyGames itself: the website, the frame the game runs in and the delivery of the game files are operated by Maxflow BV (Philipssite 5 bus 001, 3001 Leuven, Belgium), the operator of CrazyGames, as a separate controller – not as our processor. This applies in particular to the technical access data when the game loads, to cookies and the consent request on the website, to the advertising shown there and to a CrazyGames account. A CrazyGames account is not connected to Grauwacht; the game does not request it. According to CrazyGames, usage data about a game is only passed on to game developers in anonymised form. What CrazyGames processes is set out in CrazyGames’ privacy policy.
6. How long data is kept
- Account, save, leaderboards, guild data and chat messages: until you delete the account or withdraw the message.
- Added email address and Google link: until you remove them yourself or delete the account.
- Account without a sign-in method: like any other account, until you delete it.
- Automatic backups: daily (kept for 14 days) and weekly (kept for 8 weeks). After a deletion your data is therefore gone from the backups after 8 weeks at the latest.
- Reports: until the game supervision has dealt with them, at most 90 days.
- Summaries of Discord posts: only on the developer’s computer, without display names, at most 90 days. How long Anthropic keeps the posts it receives is set out in its privacy policy.
- Block notes and clearances: until the game supervision lifts them. If you delete your account, the game supervision also removes the note.
- Technical access data: according to Google’s retention periods, usually a few weeks.
- Audience measurement: the marker in the browser stays until you clear the website’s storage. The daily counters on the server contain no personal data.
7. Deleting your account
In the game under Profile → Delete account. This deletes the sign-in account (together with an added email address and a Google link), the save, leaderboard entries, guild membership and all your own chat messages. Without access to the game: send an email with your player name to n.meischner@web.de. More under Delete account (in German).
8. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). A message to the address above is enough. You can also take your own save with you as text at any time under Settings → Privacy → Your data.
You can also complain to a data protection supervisory authority, in particular in the country or German state where you live or where the controller is based.
9. Minimum age
The game with account and chat is intended for people aged 16 and over. Younger players need their parents’ consent.
10. Changes
If the game changes so that other data is processed, this policy will be updated. The version published here applies.