Privacy policy

This translation is provided for convenience. Only the German version is legally binding. German original: Datenschutzerklärung.

1. In short

• No user accounts, no registration, no names to type.
• No cookies, no tracking, no analytics or advertising services.
• No requests to third parties: fonts, images and scripts come exclusively from our own server.
• Every person in a room gets a random animal name (e.g. “Happy Jaguar”). This name and the votes are held only in our server’s memory and are deleted no later than 4 hours after the room was created.
• Our application processes IP addresses only transiently in memory to fend off abuse and does not log them. The hosting platform keeps access logs (section 3 d).

2. Controller

Techspace Software GmbH, Am Eckle 26, 77723 Gengenbach, Germany
Represented by Christian Berger and Christian Feurer
E-mail: info@techspace.de, phone: +49 7803 980 623

No data protection officer has been appointed because there is no legal obligation to do so (§ 38 BDSG, the German Federal Data Protection Act). Please send data protection enquiries to info@techspace.de.

3. What data we process

a) Random name and votes. You do not enter a name. When you enter a room, our server derives an animal name from the room’s identifier and a random identifier of your browser (see b), e.g. “Happy Jaguar” with the initials “HJ”. This name applies only in this one room; in every other room you get a different one. Your name, your initials, whether you have already played a card and, after the reveal, your card are shown to everyone in the same room. The server holds this information exclusively in memory and writes it neither to a database nor to a file. It is deleted when the room expires, no later than 4 hours after the room was created, earlier if nobody has been connected for 30 minutes. These are pseudonymous personal data: we ourselves cannot attribute a random name to a person without additional information; people in the same room often can, for example because someone speaks up in the meeting under their animal name.

b) Random participant ID and moderator token. For every room you enter, your browser creates its own random identifier so that you keep the same seat in this room across several tabs, after a lost connection or after a restart of our server, and are not counted twice. For another room it creates another identifier; rooms cannot be linked to one another through it. Whoever creates a room additionally receives a random token that identifies them as the moderator. Both are sent to the server when you enter the room and are held there in memory only for the lifetime of the room. We never show the identifier to other participants, only an identifier derived anew for each room.

c) IP address in our application. When you open the page and when the real-time connection (WebSocket) is established, your IP address is transmitted for technical reasons. Our application uses it exclusively in memory to fend off abuse and overload: it counts how many rooms are created per address within one hour and how many connections per address are open at the same time (IPv6 addresses are shortened to their first 64 bits for this). These counters are discarded after one hour at the latest or when the connection ends. The application does not log or store IP addresses.

d) Access logs of the hosting platform. The platform of our hosting provider STACKIT (Schwarz Digits Cloud GmbH & Co. KG, section 6) receives the requests, forwards them to our application and keeps access logs while doing so. Such logs typically contain your IP address, the time of the request, the requested path (without the room ID, see below), your browser’s identifier (user agent) and the status code of the response. The purpose is the operation and security of the platform; the legal basis is Art. 6(1)(f) GDPR (section 4). STACKIT processes these data as our processor (section 6). The entries we can retrieve are held by the platform only in a buffer of limited size in which older entries are continuously overwritten by newer ones. How long STACKIT keeps logs beyond that for operating the platform is set by STACKIT within the scope of the data processing agreement; we have asked for the period and will add it here as soon as we have it. Techspace itself does not store these logs permanently and evaluates them only when there is a specific reason, to find faults or to fend off abuse. We do not combine the logs with other data. In room links the room ID appears only after the “#” (/r#<room ID>). Your browser does not send this part of the address to the server, and the real-time connection does not name the room in its address either. The logs therefore show that someone used this service, but not in which room. Exception: if you open a link in the outdated format /r/<room ID>, the room ID is in the path for this one request; our server answers it with “not found”.

e) Contact by e-mail. If you write to us at info@techspace.de (for example with a data protection request, a report of abuse or of an accessibility barrier), we process your e-mail address, your name if you give it, and the content of your message in order to deal with your request. The legal basis is Art. 6(1)(c) GDPR where we are legally obliged to deal with it (Art. 12 et seq. GDPR, Art. 11, 12, 16 DSA), otherwise Art. 6(1)(f) GDPR (our legitimate interest is answering your request). Our mailbox is operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as our processor. A transfer to Microsoft Corporation in the USA cannot be ruled out in the process; it is based on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR). We delete your message once your request has been dealt with, unless statutory retention obligations prevent this.

4. Legal bases

• a) and b): Art. 6(1)(b) GDPR, because this is the only way we can carry out the vote you asked for under our terms of use. If you take part on behalf of your organisation, we rely in the alternative on Art. 6(1)(f) GDPR; our legitimate interest is providing the service you called up.
• c) and d): Art. 6(1)(f) GDPR. Our legitimate interest is protecting the service against abuse, attacks and overload and fixing faults (recital 49 GDPR).
• e): Art. 6(1)(c) GDPR where we are legally obliged to deal with your request, otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your request (section 3 e).

5. Storage in your browser

We do not set cookies. In your browser’s local storage (localStorage) we keep only:

• ezv.participant.<room ID>: the random participant ID for this one room (see 3 b). It is created when you first enter the room and deleted at the latest the next time you open the start page or a room page once the room has expired (4 hours after it was created), and immediately when our server reports that the room no longer exists.
• ezv.moderator.<room ID>: the moderator token for rooms you created yourself. It is created only when you click “Create room” and deleted at the latest the next time you open the start page or a room page once the room has expired. (An entry ezv.facilitator.<room ID> from an earlier version is moved to the new name or deleted on that occasion.)

If you do not open any of these pages again, an expired entry stays in your browser without any function until you delete the site data; we never read it again.

In addition, the browser tab keeps in sessionStorage under ezv.resume.<room ID> the last known state of the current round (round ID, whether the cards were revealed, and your own card in this round) so that the room can be restored after a restart of our server. This entry is deleted when you close the tab or our server reports that the room has expired.

The appearance (light or dark) follows your system setting; nothing is stored for it.

These entries are strictly necessary for us to provide the service you expressly requested (§ 25(2) no. 2 TDDDG, the German Telecommunications and Digital Services Data Protection Act); consent is therefore not required. You can remove them at any time in your browser settings (“delete site data”).

6. Hosting and processing on our behalf

The service is operated by Schwarz Digits Cloud GmbH & Co. KG, Am Campus 1, 74177 Bad Friedrichshall, Germany (STACKIT), in data centres in Germany. The provider processes the data listed in section 3 a to d exclusively on our behalf and on our instructions on the basis of a data processing agreement (Art. 28 GDPR). For development and operations it uses further processors, all of which are established in the European Union. Operating the service involves no transfer to countries outside the EU and the EEA; for e-mails to us see section 3 e.

The service is reachable at https://poker.techspace.de and at https://ez-poker.apps.01.cf.eu01.stackit.cloud. STACKIT has the TLS certificates of both addresses issued by certification authorities; when issuing, they learn only the domain name, no data about you. For https://ez-poker.apps.01.cf.eu01.stackit.cloud this is SwissSign AG, Sägereistrasse 25, 8152 Glattbrugg, Switzerland. For https://poker.techspace.de STACKIT creates the certificate automatically; your browser shows who issued it in the certificate details. If a certificate names an address for revocation checks (OCSP), as SwissSign's does, your browser, depending on its settings, asks there while connecting whether the certificate has been revoked. The certification authority then learns your IP address and which certificate is checked, but not the page or the room. Your browser makes this request itself; we do not cause it and receive no data from it. For Switzerland there is an adequacy decision of the EU Commission (Art. 45 GDPR).

7. Recipients

Your random name, your initials, whether you have played a card and, after the reveal, your card are visible to everyone who knows the link to the room and enters it. Share the link only with people who are meant to take part. As processors, STACKIT receives data for operating the service (section 6) and, if you write to us, Microsoft Ireland Operations Limited for our mailbox (section 3 e). Beyond that we do not pass on any data to third parties unless we are legally obliged to do so.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). As we keep no accounts, know no names and delete all room data automatically after 4 hours at the latest, we can usually not attribute data to you, or none is left (Art. 11 GDPR). If you give us additional information that makes attribution possible, we will look into your request.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Heilbronner Straße 35, 70191 Stuttgart, Germany (postal address: Postfach 10 29 32, 70025 Stuttgart), www.baden-wuerttemberg.datenschutz.de.

10. Obligation to provide data, no automated decisions

You are under no legal or contractual obligation to provide data. Without the IP address that is transmitted for technical reasons and without the random participant ID, however, the service cannot be used. There is no automated decision-making and no profiling (Art. 22 GDPR).

Last updated: 19 October 2026