Privacy Policy

Last updated: June 2026

1. Controller

Christian Böhm
Dorfstraße 80c
07639 Tautenhain, Germany
Email: mindhoax@posteo.de

No data protection officer has been appointed because the statutory requirements for such an appointment currently do not apply.

2. General Principle

MindHoax processes personal data only as far as necessary to operate the game, provide login, protect the application and make the gameplay features available. The current codebase does not implement client-side tracking scripts, advertising pixels, advertising profiles, IndexedDB, or Service Worker / Cache API storage.

3. Data We Process

• Account data: email address for magic-link login, optional username, login timestamps and internal user ID.
• Login and security data: hashed magic-link tokens, CSRF tokens, session ID and rate-limiting information.
• Game data: unlocked and completed levels, number of attempts, progress, saved hint/puzzle answers and solve states.
• Invite data: invite codes in hashed or encrypted form, assignment to inviting or redeeming user accounts, reservations in the invite portal and related timestamps.
• Technical access data: IP address, date and time of access, hostname of the accessing computer, referrer, requested page or file, websites accessed via MindHoax, status message for successful or failed retrieval, transferred data volume, browser type and version, operating system, language settings and technical error messages.

4. Purposes and Legal Bases

We process data to provide the game, enable magic-link login, store game progress, prevent abuse, protect the application, manage the invite system and technically deliver the website. Legal bases are Art. 6(1)(b) GDPR where processing is necessary for using the game, Art. 6(1)(f) GDPR for security, troubleshooting and abuse prevention, and Art. 6(1)(a) GDPR where consent may be required.

5. Cookies and Browser Storage

MindHoax uses technically necessary cookies for sessions, login and security as well as functional browser storage for language, audio settings and UI convenience. No advertising profile is created.

First-party cookies

• mindhoax_sess: session cookie for the main site. Purpose: login session, CSRF protection and server-side demo/game states. Lifetime: until browser/session end. Attributes: HttpOnly, SameSite=Lax, Secure when HTTPS is used.
• mindhoax_invite_portal_sess: session cookie for the invite portal. Purpose: portal session, rate limiting, CSRF protection and puzzle cache. Lifetime: until browser/session end. Attributes: HttpOnly, SameSite=Lax, Secure when HTTPS is used.
• mh_lang: persistent cookie for the language choice (de/en). Lifetime: 365 days. Attribute: SameSite=Lax.

localStorage

• mh_muted: remembers whether audio on the main site/main game is muted. Lifetime: until manually deleted in the browser.
• invite_portal_mute: remembers whether audio in the invite portal is muted. Lifetime: until manually deleted in the browser.

sessionStorage

• mh_bgm_time: remembers the audio position across page changes in the main game. Lifetime: until the browser tab ends.
• mh_bgm_play: remembers whether audio was paused or playing. Lifetime: until the browser tab ends.
• invite_portal_slider_index: remembers the last visible slide position in the invite portal. Lifetime: until the browser tab ends.

Server-side session data is not directly readable in the browser. The browser only stores the corresponding session ID as a cookie.

6. Email and Magic Link

For login, we request an email address and send a magic link. The email address is normalized, hashed for lookup and stored in encrypted form. Magic-link tokens are stored as hashes and are time-limited. If you did not request a login, you can ignore the email.

7. Ranking and Game Display

The ranking may show username, solved levels, progress and number of attempts. Email addresses are not shown in the ranking.

8. External Links

The supporter page may link to Patreon. Patreon is included as an external link, not as an embedded tracking script. When you click the external link, you leave MindHoax; Patreon may then set its own cookies and apply its own privacy rules.

9. Hosting and Recipients

MindHoax is hosted by ALL-INKL.COM - Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. As a hosting provider, ALL-INKL.COM processes data required for the technical delivery, stability and security of the website. This may include server log data such as IP address, access time, requested URL, referrer, user agent and technical error messages.

ALL-INKL.COM receives this data as a hosting provider or processor where this is required to operate this website. We use ALL-INKL.COM on the basis of our legitimate interest in providing this online service securely and reliably under Art. 6(1)(f) GDPR. Further information is available in ALL-INKL.COM's privacy information: https://all-inkl.com/en/privacy-policy/.

Additional data may be processed by email delivery providers where this is necessary for magic-link login and email delivery. We do not disclose data for advertising purposes.

10. Retention

Account, game and invite data is stored as long as your account exists or storage is required for operating the game. Magic-link tokens expire after a short period and are marked as used after login. Session data regularly expires at session end. Data required only for delivering the website is generally deleted when the respective session ends. According to ALL-INKL.COM, server logfiles are deleted no later than after seven days; longer retention may be required in individual cases, for example to investigate attacks or abuse.

11. Provision of Data

Technical access data and technically necessary cookies are provided automatically when the website is accessed and are required for operation. Without this data, the website cannot be provided or cannot be provided fully. Providing an email address is only required if you want to use magic-link login. Without an email address, login and permanent storage of your game progress are not possible.

12. Third-Country Transfers

MindHoax does not currently intend to transfer personal data to countries outside the European Union or the European Economic Area. If you click external links such as Patreon, you leave MindHoax; the respective external provider is responsible for the data processing there.

13. Your Rights

Subject to the GDPR, you have the right of access under Art. 15 GDPR, rectification under Art. 16 GDPR, erasure under Art. 17 GDPR, restriction of processing under Art. 18 GDPR, data portability under Art. 20 GDPR and objection under Art. 21 GDPR. Where processing is based on consent, you may withdraw that consent at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for non-public bodies in Thuringia is the Thuringian Commissioner for Data Protection and Freedom of Information (TLfDI), Häßlerstraße 8, 99096 Erfurt, Germany, email: poststelle@datenschutz.thueringen.de, website: https://tlfdi.de.

14. Right to Object under Art. 21 GDPR

You have the right, on grounds relating to your particular situation, to object at any time to processing of personal data based on Art. 6(1)(f) GDPR. We will then no longer process this data unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims. Processing technical access data for website delivery and security is required for operation.

15. Contact

For privacy requests, contact us at mindhoax@posteo.de.