Privacy policy
This English version is provided for convenience. Only the German version is legally binding.
As of: November 2026
1. Controller
Dominik Rothke, Tillmann-Siebel-Stasse 27, 57258 Freudenberg · kontakt@bodenchronik.de
2. Playing without an account
If you do not sign in, the game automatically creates an anonymous guest account with our service provider Supabase (data centre in Frankfurt). No email address and no name are stored – only a random identifier, your game progress (balance, finds, rechargeable batteries, permissions) and technically necessary log data (e.g. IP address when accessing). The purpose is fair, tamper-proof gameplay (Art. 6(1)(b) GDPR). The identifier is kept in your browser (local storage). If you delete it or reset your game progress, the guest account can no longer be reached; we regularly delete guest accounts that are no longer used. If the server cannot be reached, the game saves only locally in your browser.
3. Cloud save with an account
If you back up your game progress in the cloud, we process your email address (for signing in via a link), an internal user ID and your game progress (progress, finds, in-game settings). The settings also include your language choice (German or English); we additionally note it with your account so that sign-in emails reach you in your language. The legal basis is Art. 6(1)(b) GDPR (provision of the function you requested). The data is stored until you delete your account. You can do this yourself at any time in the game under “Cloud save → Delete account”.
Player market
If you offer or buy finds in the player market, other players see the trader name you have chosen (if you have not chosen one, an automatic short name such as “Sondler 4F2A”), the find, the price as well as the rough find area and the day of the find. Your email address, exact find spots and other account data are never public. Trading takes place exclusively with play money; there are no real-money payments or payouts. Purchase and sale transactions are stored for traceability.
Hall of Fame and public find showcase
Finds appear in the Hall of Fame only if you expressly publish them in the game. The following are then publicly visible – also without signing in, at /hall-of-fame: your trader name (or an automatic short name), the find with picture and description, the date of the find, the rough find area, the first finder, the current owner and your optional short text. Email addresses, exact find spots and other account data are never published. You can withdraw entries at any time; if you sell a find, its entry ends automatically. Other players can report entries; we review reported entries and hide them if necessary. The legal basis is your decision to publish (Art. 6(1)(a) and (b) GDPR).
Player name, online status and running the game
You can set a player name of your choice; it is visible to other players. As long as the game is open, it reports about once a minute that you are active and in which area (e.g. at home or in a search area). From this, only the operators see who is currently playing; other players do not see this. For running the game (e.g. help with problems, protection against misuse, corrections), the operators can view your account, your game progress and your transactions and, in the event of violations, block trading and publications. The legal basis is Art. 6(1)(b) and (f) GDPR.
Museum, find stories, votes and research project
The following remain private: your notes in the find chronicle, the internal find spot of a find (only you can see it) and your progress in find stories and jobs. Notes belong to you, not to the object – if you sell a find, the new owner does not see them. Only what you expressly publish becomes public: a public museum (name, description, exhibited finds with your titles and texts, your player name), a told find story for a Hall of Fame entry, your contributions to the joint project (player name and number in the list of contributors) and – only with your consent – your placing in the “Oldest find” and “Most helpful player” rankings. Votes and appreciations are stored so that everyone can vote only once; who voted for what is not public. Email addresses and exact find spots are never published. The legal basis is Art. 6(1)(b) GDPR.
Inviting friends
Every player can share a personal invite link. The link contains only a random code – no name and no email address. If someone opens the link, their browser stores the code locally; when the game is started for the first time, it is stored who invited whom, and the game progress (account yes/no, number of trips and days played) is checked in order to pay out the play-money reward. The person who invited sees only the invited person’s player name and this progress. The game does not send any invitation emails. The legal basis is Art. 6(1)(b) GDPR. When the account is deleted, the invitation data is deleted as well.
Signing in with Steam and the full version
The game is sold through the Steam platform of Valve Corporation (10400 NE 4th St, Bellevue, WA 98004, USA). In the Steam version you are signed in automatically with your Steam account; in the browser you can choose to sign in via “Sign in with Steam” on the Steam website. In doing so, we receive from Steam only your Steam ID (a number) and whether you own the full version – no password, no email address and no payment data. We store the Steam ID with your game account, whether the full version is unlocked and when this was last checked. For Steam-only accounts we create an internal placeholder address of the form SteamID@steam.bodenchronik.de; no email is ever sent to it. The check is made by our server (Vercel, see below) with Steam. The purpose is signing in and unlocking the full version you bought (Art. 6(1)(b) GDPR). The data is deleted when you delete your account. Valve is itself responsible for the purchase and your Steam account; Valve’s privacy policy applies (store.steampowered.com/privacy_agreement). When you sign in via the Steam website, we set a technically necessary cookie for at most ten minutes that only checks that the sign-in was started in your browser.
4. Service providers (processors)
Supabase (Supabase Inc., USA) – database and sign-in, as well as storage of the articles and images of the magazine “Feldnotizen” (Field Notes, in German). When article images are displayed, your IP address is transmitted to Supabase so that the image can be delivered. The data is stored in a data centre in Frankfurt am Main (EU). The basis is a data processing agreement with EU standard contractual clauses.
united-domains (united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Deutschland) – sending of the sign-in emails via our own email server. The email address and the content of the sign-in email are transmitted. The data is processed in Germany. Basis: data processing agreement pursuant to Art. 28 GDPR.
Vercel (Vercel Inc., USA) – hosting of the website. When the site is accessed, technically necessary data such as IP address, time and browser identifier are processed (Art. 6(1)(f) GDPR, secure operation). Basis: data processing agreement, EU standard contractual clauses or the EU-US Data Privacy Framework.
5. No trackers
The game and the website do not use any analytics tools or tracking cookies. Fonts are loaded locally from our server, not from Google.
The English version of the game and website (Finder’s Chronicle) is available at finderschronicle.com; this privacy policy applies to both addresses. If your browser’s language differs from the language of a page, the website shows a note pointing to the other language version. If you close it, your browser remembers this locally (local storage); nothing is sent to us.
The “Feldnotizen” (Field Notes, in German) may contain advertising links (affiliate links), which are marked as such. Only when you click such a link are you taken to the website of the respective provider; its privacy policy applies there.
6. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. To exercise them, contact datenschutz@rothke.de. You can also lodge a complaint with a data protection supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).