1. Who is responsible
The controller is the operator named in the Impressum. Contact: kontakt@play-minesweeper.games. We have not appointed a data protection officer and are not required to.
2. Hosting and delivery (Cloudflare)
The site runs on Cloudflare Workers with a Cloudflare D1 database, operated by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open a page, your browser sends your IP address and technical request data (requested address, time, browser type) to Cloudflare, which needs them to deliver the site and protect it against attacks. We do not store your IP address. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a secure and reliable website. Cloudflare processes these data on our behalf under a data processing agreement (Art. 28 GDPR) and keeps them according to its processor terms.
Transfer to the USA: Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, and the transfer relies on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). Cloudflare's data processing agreement also includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which apply if the certification ends.
3. Cloudflare Web Analytics
We use Cloudflare Web Analytics to see which pages are visited, from which websites visitors arrive (including sites that embed the game) and how fast pages load. A small script from Cloudflare measures the page load and sends the page address, the referring address, browser and device type and timing values to Cloudflare. It sets no cookies, stores nothing in your browser and does not create a profile of you. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is understanding how the site is used and keeping it fast. Cloudflare acts as our processor (see section 2).
4. Data stored in your browser
We store the current game, your settings (such as theme and difficulty), statistics, best times, achievements and your daily-challenge streak in your browser's local storage. A service worker keeps a copy of the site's files so the game also works offline. These data stay on your device; they reach us only if you use an account (section 6). This storage is strictly necessary to provide the game you opened (§ 25(2) No. 2 TDDDG). You can delete it at any time through your browser's settings.
5. Anonymous game statistics
To see how the game is played, the page sends short events to our own server, for example "game started", "game won", the difficulty, the game duration, whether an embedded board was viewed or played, and the path of the page. We store no IP address, browser details or referrer with them, and no cookie or ID, unless you are signed in, in which case the event is linked to your account ID. If your browser sends "Do Not Track" or "Global Privacy Control", no events are sent. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is improving the game. We keep the events as long as they are useful for comparing how the game is used over time.
6. Optional account
You can create an account without an email address or password. We create a random account ID and a
recovery code, which we show you once and store only as a hash. When you sign in, we set a session cookie
(__Host-ms_session, valid for up to one year) that keeps you signed in. We store your
statistics, best times, daily-challenge results and achievements on our server so you can use them on
other devices; signed-in daily results also count towards the day's public statistics. Legal basis: Art.
6(1)(b) GDPR (providing the account you asked for) and, alternatively, Art. 6(1)(f) GDPR. The session
cookie is strictly necessary for the sign-in you requested (§ 25(2) No. 2 TDDDG). Creating an account is
voluntary; without one, your progress stays on your device.
We keep account data until you ask us to delete the account at kontakt@play-minesweeper.games (please include your account ID from the account page). If you lose your recovery code, we cannot restore the account.
7. Public leaderboard
When you win on one of the classic boards (Beginner, Intermediate, Expert), on this site or in an embedded board, the game sends the difficulty, your time, the board's 3BV value and the date to our server, and the time appears on the public leaderboard. Without a name, the entry is anonymous. You can add a name of up to 20 characters, either your own or a suggested one such as "Swift Otter 417"; it is shown publicly next to the time. Names containing links or offensive words are rejected, and we remove any name or entry on request. Your browser remembers which entries are yours so it can highlight them; that information stays on your device. To prevent abuse, we use your IP address briefly in memory, salted and hashed, for rate limiting; it is not stored. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is offering a fair public leaderboard. Entries stay on the all-time list; ask us at kontakt@play-minesweeper.games and we remove an entry.
8. When the game is embedded on other websites
Other websites, including school pages, can show the game in a frame. It is then loaded from our server through Cloudflare, and sections 2 to 5 and 7 apply in the same way. The website that embeds the game decides to load it and is responsible for its own page; please also read that site's privacy notice.
9. Contacting us
If you email us, we use your address and message to answer you (Art. 6(1)(f) GDPR) and delete the conversation once the matter is closed, unless the law requires us to keep it.
10. Children
The game is suitable for children and used in schools. It needs no personal information: no email, no real name, no age and no location. A leaderboard name is optional and public; children should use a made-up name, and the name field suggests one. Children under 16 should ask a parent or teacher before creating an account. We do not use anyone's data for advertising or profiling.
Notice for users in the United States (COPPA): we use persistent identifiers only to support the internal operations of the site: an account ID and session cookie to authenticate signed-in players and keep their scores, and IP addresses for network communication and abuse prevention (rate limiting). We do not use them to contact anyone, for behavioural advertising or to build profiles, and we share them only with our hosting processor, Cloudflare, Inc. Parents can ask us to review or delete their child's data at kontakt@play-minesweeper.games.
11. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Because we don't know who you are, please tell us your account ID or describe the leaderboard entry when you contact us. You can also complain to a data protection supervisory authority, in particular in the EU member state where you live.
Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. Write to kontakt@play-minesweeper.games.
12. No automated decisions, no selling of data
We make no automated decisions with legal or similarly significant effects (Art. 22 GDPR), and we do not sell or share data for advertising.
13. Changes
We update this policy when the site changes. The date at the top shows the current version.