Privacy policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

MW Apps GmbHRheinpromenade 1040789 Monheim am RheinGermanyManaging director: Maurice WirthEmail: info@scratchadventure.com

We are not required to appoint a data protection officer. For all questions about data protection, please write to the email address above.

When you open our website, your browser automatically sends information to the server. The following is processed:

• ♥IP address of your device
• ♥date and time of the request
• ♥page or file requested and amount of data transferred
• ♥the website you came from (referrer)
• ♥browser type and version, operating system
• ♥technical error reports if a page fails to load

Our website and its backend are hosted by:

Lovable Labs Sweden ABRegeringsgatan 25111 53 Stockholm, Sweden

Lovable acts as our processor under Art. 28 GDPR and uses sub-processors such as cloud hosting and content delivery providers, some of which are located in the USA. The current list of sub-processors is published at trust.lovable.dev. Our hosting provider also gives us summarised visit statistics (for example the number of page views, referring websites, countries and device types); we only see these in aggregated form and cannot identify you from them.

Purpose and legal basis: delivering the website, keeping it stable and secure, and finding errors. This is our legitimate interest under Art. 6 (1) (f) GDPR. Log data is deleted as soon as it is no longer needed for these purposes, unless it must be kept longer to investigate a specific security incident.

Your language. To show the website in your language, our server reads the language settings your browser sends and the country our hosting provider derives from your IP address. Neither is stored by us. If you choose a language yourself, your choice is remembered in a small cookie named “cg_lang” on your device for one year; it contains only the language code and is sent to our server with each page request. Legal basis: § 25 (2) No. 2 TDDDG, because the cookie is strictly necessary to keep the language you asked for, and Art. 6 (1) (f) GDPR. You can delete it at any time in your browser settings.

Couple Gallery saves everything you create in the storage of your own browser (local storage and IndexedDB), so that your gallery is still there next time:

• ♥gallery title, dedication, signature, notes and captions
• ♥names, outfits and skin tones of your two characters
• ♥the photos, films and audio files you add, and their order
• ♥the place you met (including the finished map image) and your song
• ♥settings such as sound on or off, the Christmas theme and which partner you played in an online room

This data stays on your device and is not transmitted to us unless you create an online invite (section 4). We do not use this storage to recognise or track you.

Legal basis: § 25 (2) No. 2 TDDDG, because storing this data is strictly necessary to provide the gallery you asked for, and Art. 6 (1) (b) GDPR.

Deleting: you can remove this data at any time by deleting the site data for our website in your browser settings, or by removing items on the build page. Please note that this permanently deletes your gallery on that device.

Creating an invite. When you tap “Create the invite”, a copy of your gallery is stored on our servers so that your partner can open it on their own device. This includes: your own photos (reduced in size), films and audio files, the map image, the gallery texts, the names and looks of the characters, the arrangement, the details of your song and which partner you play. Sample content is not uploaded.

The files are kept in private storage. They can only be found with the random invite code; there is no public list of galleries. Your partner's browser receives time-limited links (valid for 24 hours) to load the files. Anyone who knows the invite link can open the gallery, so please only share it with your partner.

Playing together. While you are both in the gallery, our servers pass live information between your devices: position and movement of the characters, jumps, gestures and couple interactions, the room you are in, the characters' names and looks, and whether someone is present. This information is only relayed in real time and is not stored permanently.

Legal basis: Art. 6 (1) (b) GDPR, because the processing is necessary to provide the online feature you requested.

Particularly sensitive photos. Photos, especially in the private room, can reveal details of your intimate life (special categories of data under Art. 9 GDPR). Such content is only uploaded if you deliberately create an invite; this is your explicit consent under Art. 9 (2) (a) GDPR. You can withdraw it at any time with effect for the future by asking us to delete the shared gallery.

People in your photos. Please only upload photos and films of other people if they agree.

Storage period: a shared gallery is kept until you ask us to delete it. Simply email us the invite code or link at info@scratchadventure.com; we will delete the gallery and all its files without undue delay, at the latest within one month. If we discontinue the online feature, we will delete all shared galleries.

Processor: the hosting provider named in section 2, which stores the data on our behalf.

If you search for the place you met on the build page, your browser sends your search term to the place search (Nominatim) of the OpenStreetMap Foundation and loads the map tiles from its servers:

OpenStreetMap FoundationSt John's Innovation Centre, Cowley RoadCambridge, CB4 0WS, United Kingdom

In doing so, your IP address, the search term, the map area shown and your browser details are transmitted to the OpenStreetMap Foundation. This only happens when you use the map feature. The finished map is saved as an image on your device; when you walk through the gallery later, no connection to OpenStreetMap is made.

Legal basis: Art. 6 (1) (b) GDPR and § 25 (2) No. 2 TDDDG, because you actively request this feature. The United Kingdom has an adequate level of data protection recognised by the European Commission (Art. 45 GDPR). Privacy policy: osmfoundation.org/wiki/Privacy_Policy

If you search for your song, your browser sends your search term directly to Apple's iTunes Search service. Album covers and 30-second previews are loaded from Apple's servers when they are displayed or played. This also applies to the sample song in the demo gallery.

Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, IrelandApple Inc., One Apple Park Way, Cupertino, CA 95014, USA

Apple receives your IP address, the search term or the requested cover or preview, and your browser details. Apple Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). If you would rather avoid this, upload your own audio file instead; it stays on your device like your photos.

Legal basis: Art. 6 (1) (b) GDPR when you search for a song or play it, and otherwise Art. 6 (1) (f) GDPR (our legitimate interest in showing the sample song). Privacy policy: www.apple.com/legal/privacy/

The fonts on our website are stored on our own servers. Your browser does not connect to Google or any other font provider.

If you write to us by email, we process your email address, your name if you give it, and the content of your message in order to answer you. Legal basis: Art. 6 (1) (b) GDPR if your message relates to a contract or its preparation, otherwise Art. 6 (1) (f) GDPR (our legitimate interest in answering enquiries). We delete your message once your enquiry has been dealt with, unless statutory retention obligations under commercial or tax law apply (up to six or ten years).

If you report illegal content (see the legal notice), we process the details of your report to review it and to inform you and, where required, the person concerned of our decision (Art. 6 (1) (c) GDPR in conjunction with Art. 16 and 17 DSA). We do not pass on your name to the person concerned unless this is necessary to handle the report.

• ♥no tracking or advertising cookies and no analytics tools such as Google Analytics
• ♥no social media plugins or advertising networks
• ♥no sale of your data and no use of your photos for advertising or for training AI
• ♥no automated decision-making or profiling within the meaning of Art. 22 GDPR

We only pass on personal data to the service providers named in this policy, and to authorities if we are legally obliged to do so.

Some of our hosting provider's sub-processors are located in the USA. Transfers take place on the basis of the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on the basis of the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR). Data is transferred to the United Kingdom on the basis of the adequacy decision for the UK.

You have the following rights regarding your personal data:

• ♥access (Art. 15 GDPR)
• ♥rectification (Art. 16 GDPR)
• ♥erasure (Art. 17 GDPR)
• ♥restriction of processing (Art. 18 GDPR)
• ♥data portability (Art. 20 GDPR)
• ♥objection (Art. 21 GDPR, see below)
• ♥withdrawal of consent at any time with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, an email to info@scratchadventure.com is enough. As you do not have an account with us, please send the invite code or link of your shared gallery so that we can find your data. Data that is only stored in your browser is under your own control; we cannot see or delete it.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)Kavalleriestraße 2–440213 Düsseldorfwww.ldi.nrw.de

Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object at any time, on grounds relating to your particular situation (Art. 21 (1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Our website is only delivered over an encrypted connection (TLS/HTTPS). Shared galleries are kept in private storage that can only be reached with a random invite code and time-limited links. Please note that emails are not end-to-end encrypted; do not send us your private photos by email.

You are not legally or contractually obliged to provide personal data. Without the technical connection data, however, we cannot show you the website, and without uploading your gallery we cannot create an online invite.

Couple Gallery is intended for people aged 16 and over; the private room is intended for adults only. We do not knowingly process data of children.

We update this privacy policy when our service or the law changes, for example when we start offering orders or payments. The version published on this page applies.