Privacy

Controller

[please fill in config.php → operator], [please fill in config.php → operator], email: [please fill in config.php → operator]

What this is about

Bulli guides you along GPS puzzle trails from stop to stop. This notice describes which data is processed. You need no account and give no email address.

What we process

• Group name and progress: The name you enter, your answers, points and the time of the trail. Once the trail is finished, the group name appears in the trail's leaderboard – do not choose a name that identifies you. Legal basis: Art. 6(1)(b) GDPR (performing the trail).
• Location: During the trail your device sends your position to our server every few seconds so that it can tell when you reach a stop. We only keep the latest position of the running trail. It is deleted when you finish the trail, after one day at the latest. No history or movement profile is created. The game master (the operator or whoever runs the trail) can see this last position, your group's progress and score while you are on the way, and can adjust points or skip a station; such interventions are logged. Location access has to be allowed in your browser and can be withdrawn at any time; the trail then cannot tell where you are. Legal basis: Art. 6(1)(a) GDPR (your permission in the browser).
• QR cards: For events the game master can set up groups beforehand. The QR code on a card holds a personal link with a random value; whoever has the card plays as that group. Do not pass the card on if you do not want that.
• Local storage: In your browser we store which trail you are playing (so it continues after a reload), your last used group name and your language setting (a small cookie when you switch the language). This stays on your device. A session cookie is set only when an admin signs in.
• Abuse protection: To protect against overload we count requests per internet address. The IP address is stored only as a salted hash, not traceable back, and overwritten after one hour at most.
• Server logs: Our host (all-inkl.com, Germany) logs technically necessary access data (IP address, time, requested file) for a few days.

Sharing

• Map tiles: You load the map directly from the map server (OpenStreetMap tiles). The map server thereby learns your IP address and which part of the map you view.
• Requests to the routing service, place data (Overpass), address search (Nominatim) and Wikidata are made by our server only, when a trail is created. No player data is sent.
• No other sharing takes place.

Retention

Finished and abandoned trails with group name, points and answers are deleted after 90 days. On request we delete entries earlier.

Your rights

You have the right of access, rectification, erasure, restriction, objection and data portability, and the right to lodge a complaint with a supervisory authority. Write to us at [please fill in config.php → operator].