Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) for this website and the “track. with ads” platform is:

Linus van Doren, Schönleinstraße 8, 10967 Berlin, Germany. Phone: +49 176 42959504, email: linus@nosedivestudio.com.

“track. with ads” is a collaboration between Nosedive Studio and Office of the Pandemonium. The platform is operated by the controller named above, who is therefore responsible for the processing described here (see also the Impressum).

For questions about data protection or to exercise your rights, an informal message to linus@nosedivestudio.com is sufficient.

• We only process personal data where this is necessary for the website, the workshops and the use of the platform.
• We do not use advertising, tracking or analytics services, build no advertising profiles and sell no data.
• The movement data, people and profiles analysed in the game are fictional. They were generated artificially and do not relate to real people.
• The platform does not collect your own location.

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. On every request, Vercel automatically processes information transmitted by your browser:

• IP address
• date and time of access
• requested page or file and referrer URL
• browser type, browser version and operating system (user agent)
• HTTP status code and amount of data transferred

This processing is necessary to deliver the website, ensure its stability and security, and fend off attacks. The legal basis is our legitimate interest in doing so (Art. 6 (1) (f) GDPR). Log data is stored only briefly and then deleted automatically. Vercel processes the data as a processor (Art. 28 GDPR); for the transfer to the USA see the section “Transfers to third countries”.

We only use technically necessary cookies and entries in your browser’s local storage, for example for login, language preference, appearance (light/dark) and storing your cookie decision. We currently set no cookies that require consent.

The names, purposes, retention periods and legal bases of the individual entries are listed in our cookie policy, where you can also change your cookie settings at any time.

Taking part in a workshop requires a user account. You receive access through a join link from your university or the workshop organiser, or through an invitation. We process:

• your email address and password (the password is only stored as a cryptographic hash, never in plain text)
• a display name (by default the part of your email address before the “@”, changeable at any time) and, optionally, a profile picture
• the university or workshop you joined and your role (e.g. participant or workshop lead)
• technical login data such as the time of registration and last login and the IP address used (in the login service’s logs)
• the time at which you accepted the terms of participation and acknowledged this privacy policy (when registering or when joining through an invitation)
• if you set up two-factor authentication: the factor data required for it

To manage your account we send you emails, for example to confirm your email address, for invitations or to reset your password. These are sent via the email service Resend.

The legal basis is the performance of the user relationship under our terms of participation (Art. 6 (1) (b) GDPR). Logging of login events additionally serves the security of the platform (Art. 6 (1) (f) GDPR). We store the time at which you accepted the terms of participation so that we can demonstrate that they were agreed (Art. 6 (1) (b) and (f) GDPR).

Your email address and password are required to use the platform; without them you cannot take part. All other information is voluntary.

We store your account data for as long as your account exists. You can delete your account yourself in the app at any time, even if you do not (or no longer) belong to a university or workshop; regardless of that, you can request deletion by emailing linus@nosedivestudio.com. Deleting the account also deletes your game progress, notes and leaderboard entries. Accounts that are no longer used are deleted automatically after the periods listed under “Retention”.

When you play a scenario, we process:

• your player name (a nickname of your choice, separate for each university)
• your onboarding progress, e.g. whether you completed the tutorial
• your game sessions: scenario, attempt, game phase and status, start and submission time, time taken, score, result and the grading of the individual tasks
• your in-game input: tags, notes and your submitted solution

This data is processed to run the game, grade your solution, show the leaderboard and debrief the workshop. The legal basis is Art. 6 (1) (b) GDPR.

Your tags and notes can be seen by the workshop leads of your university. Please do not enter personal data of real third parties or sensitive information about yourself there; notes are only intended for working on the fictional cases.

We store game data for as long as your user account exists, and at most until the account of your university or workshop is deleted from the platform (for the periods, see “Retention”).

Your player name, score and playing time are shown to other participants of the same university or workshop on a leaderboard. Other participants cannot see your solutions, tags or notes. Nothing is published outside the platform.

Your display name, email address and, if set, profile picture can be seen by the other members of your university or workshop, similar to a list of participants.

The leaderboard is part of the game (Art. 6 (1) (b) GDPR). If you do not want to appear under your real name, choose a nickname that does not identify you.

The platform is provided to universities and workshop organisers. People with management rights for the university or workshop you joined (e.g. lecturers or the workshop lead) can see the following data:

• display name, player name, email address and, if set, profile picture
• the time you joined and all game sessions, including sessions in progress (scenario, phase, status, start time)
• your in-game tags and notes
• the results of completed sessions, including score, playing time, submitted solution and grading

Workshop leads can also remove participants from the university or workshop. The purpose is organising, supervising and debriefing the workshop. The legal basis is Art. 6 (1) (b) GDPR and the legitimate interest in running the workshop properly (Art. 6 (1) (f) GDPR).

People who administer the platform on behalf of the operator have access to the stored data where this is necessary for operation, support, troubleshooting, managing university licences and enforcing the terms of participation (e.g. resetting inadmissible player names). Administrative accounts are protected by two-factor authentication. The legal basis is Art. 6 (1) (b) and (f) GDPR.

If you contact us via the contact form or by email, we process your name, your email address and the content of your message in order to answer your enquiry. Messages from the contact form are delivered to our mailbox via the email service Resend.

The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to the use of the platform or a contract, and otherwise our legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR).

We delete your enquiry once it has been dealt with conclusively, unless statutory retention obligations apply.

Signed-in users can send us questions, bug reports or suggestions via the feedback feature. We process the type of feedback, your text, optionally your email address for a reply (for questions) and optionally an uploaded screenshot.

So that we can reproduce technical problems, your user ID, browser identifier (user agent), browser language, window size and the title of the current page are sent automatically. Feedback can only be viewed by the operator’s administrators.

The legal basis is our legitimate interest in improving the platform and handling your feedback (Art. 6 (1) (f) GDPR). We delete feedback once it has been handled and is no longer needed, or earlier on request. Please make sure screenshots do not contain third-party data.

On the landing page and in the game map we embed map material from CARTO (CartoDB Inc.), loaded from servers at basemaps.cartocdn.com. For technical reasons, your IP address, browser identifier and the requested map tiles are transmitted to CARTO. CARTO does not set any cookies in this process. The legal basis is our legitimate interest in a working map display (Art. 6 (1) (f) GDPR). More information: https://carto.com/privacy

The in-game location search first searches a list of places loaded with the scenario. If that returns too few results, your search term is sent directly from your browser to the Nominatim service of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. When you click an empty spot on the game map, the coordinates of that point are also sent to Nominatim to display the corresponding address. In both cases your IP address and browser identifier are transmitted as well; your own location is not. An adequacy decision of the European Commission exists for the United Kingdom (Art. 45 GDPR). The legal basis is our legitimate interest in a working location search (Art. 6 (1) (f) GDPR). More information: https://osmfoundation.org/wiki/Privacy_Policy

The fonts used are embedded locally. No connection to servers of Google or other font providers is established when you visit the website.

We use the following service providers, who process personal data on our behalf and according to our instructions (Art. 28 GDPR):

• Vercel Inc., USA: hosting and delivery of the website (https://vercel.com/legal/privacy-policy)
• Supabase Inc.: database, login and file storage; the data is stored in a data centre in Frankfurt am Main (EU) (https://supabase.com/privacy)
• Resend, Inc., USA: sending emails such as account confirmations, invitations, password resets and contact form messages (https://resend.com/legal/privacy-policy)

Further recipients are the workshop leads of your university (see “Access by workshop leads and the operator”) and CARTO and the OpenStreetMap Foundation when maps are loaded or the location search is used (see “Maps, location search and fonts”).

Beyond that, we only disclose personal data where we are legally obliged to or you have given consent. We do not pass data to advertising partners or data brokers.

Vercel, Supabase, Resend and CARTO are based in the USA or may process data there. Transfers are based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified under it, and otherwise on EU standard contractual clauses (Art. 46 (2) (c) GDPR).

An adequacy decision exists for transfers to the United Kingdom (OpenStreetMap Foundation) (Art. 45 GDPR). You can request a copy of the relevant safeguards at linus@nosedivestudio.com.

We only store personal data for as long as necessary for the respective purpose:

• account data (email address, display name, password hash, profile picture) and game data: until you delete your account or request its deletion, at the latest automatically after the following periods
• accounts of members of a university or workshop: 18 months after the last use (signing in or using an existing session). Workshops usually take place once a year; this period lets you keep using the account in the next round. We notify you by email beforehand, usually 30 days before deletion. If you sign in by then, the account is kept. The account a university was set up with is an exception: it is kept for as long as the university account exists and is then deleted like an account without a membership.
• accounts without a membership in a university or workshop, for example after an unfinished join, after removal by the workshop lead or after the university was deleted: 30 days after sign-up or after the last membership ended. We notify you by email beforehand.
• accounts of universities or workshops, including all memberships and game data: 24 months after the last licence ended. The workshop lead is notified by email beforehand, usually 30 days before deletion.
• server and login logs: briefly, then deleted automatically
• contact enquiries and feedback: until they have been dealt with conclusively
• cookies and local storage entries: see the cookie policy

Where statutory retention obligations apply, we restrict processing until the period expires and delete the data afterwards.

For technical reasons, deleted data may remain in our database provider’s backups until these are overwritten in the regular cycle.

Under the GDPR you have the following rights towards us:

• access to the data we process about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR, see next section)
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, an informal message to linus@nosedivestudio.com is sufficient. You can also change or delete much of your information directly in your account settings.

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

The supervisory authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, https://www.datenschutz-berlin.de

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The in-game score is calculated automatically; it serves only the game, the leaderboard and the debriefing and is not a decision with legal or similarly significant effects.

All connections to the platform are encrypted via TLS (HTTPS). Access rights in the database are designed so that each person only sees the data they are authorised to see.

We update this privacy policy when the platform, the services we use or the legal situation change. The version published on this page applies.