Privacy policy

Benjamin Pötschke
Wahrstedter Str. 7
Grafhorst
Email: Info@StickRun.de
Phone: 01756420917

StickRun.de is operated by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The host processes data on our behalf.

With every page view, the web server processes technically necessary information: IP address, date and time, the address requested, the amount of data transferred, the previously visited page (referrer) and the browser identifier. These server log files serve secure operation and error analysis. The legal basis is Art. 6(1)(f) GDPR. How long the host keeps these log files is set out in its own privacy notice; we do not analyse them ourselves. A data processing agreement pursuant to Art. 28 GDPR has been concluded with the host.

You can play StickRun without an account. Guest runs are not transmitted to us. Your best guest score and your "eye-friendly mode" setting are only stored locally in your browser (local storage). You can delete them at any time via your browser settings. Legal basis: § 25(2) no. 2 TDDDG.

When you sign up, we store your username, email address, your password only as a secure hash (Argon2id/bcrypt), the character you chose and the time you agreed to the terms of use and privacy notice. We also store the time of your last login. The legal basis is Art. 6(1)(b) GDPR (contract for the use of the game).

Your email address is never shown publicly. We only use it for logging in and – once set up – for password reset emails. You can change your email address under Account → Settings (confirmed with your password and – as soon as email sending is set up – via a confirmation link sent to the new address). There you can also download all data stored for your account as a file (Art. 15 and 20 GDPR).

For counted runs we store the start and end time, score, coins, distance, number of jumps, the obstacle that ended the run, and the input log (the times of your jumps and ducks). This allows the server to check every run for plausibility and manipulation. Coin transactions, purchases and inventory are assigned to your account. We also store unlocked achievements and claimed daily bonuses (day, streak, coins). If you finish a season in the top 10, we archive your rank, score and username; they appear in the public season archive as long as you are visible on the leaderboard.

Only your username and your best score on the leaderboard (can be switched off) and – if you activate it – your public profile are publicly visible. If you create a highscore card to share in your profile, your username, your highscore and your leaderboard rank can be accessed publicly via a personal link. You can deactivate this link in your profile at any time.

If you write to us via the support center, we store your request: topic, subject, your messages and the team's replies, each with a timestamp. With an account we link the ticket to your account. Without an account we additionally store the name and email address if you provide them (both voluntary); you then reach your ticket via a personal, secret link. The team can add internal notes to a ticket, which are not public. The legal basis is Art. 6(1)(b) GDPR where your account or the game is concerned, otherwise Art. 6(1)(f) GDPR (answering your request); for requests about your data protection rights Art. 6(1)(c) GDPR. We only send email notifications about tickets once email sending is set up.

We store submitted suggestions with your account; every suggestion has a ticket for questions and status messages. Internal notes by the moderation team are not public. We may publish individual suggestions without usernames on the ideas page. When your account is deleted, suggestions are kept anonymously, i.e. without any link to you; your tickets are deleted along with your account.

We only set one technically necessary session cookie, and only once you log in or use a form. It is used for logging in and to protect against forged requests (CSRF). Without "stay logged in" it becomes invalid when you close the browser or after 12 hours of inactivity; with "stay logged in" after 30 days at the latest. Legal basis: § 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR.

To protect against automated login attempts and spam, we count requests per connection. We do not store IP addresses in plain text for this, only a cryptographic, non-reversible hash that is deleted when the respective time window expires, after 24 hours at the latest. Legal basis: Art. 6(1)(f) GDPR.

To understand how many people visit StickRun and which pages are used, we count page views ourselves on our own server – without cookies, without storing anything in your browser and without external services. So that we do not count visitors twice within one day, we create a non-reversible hash from the IP address and browser identifier (user agent) combined with a random key generated anew every day. The key and hashes are deleted at the end of the day; we do not store the IP address itself. Only aggregated daily figures without any personal reference are stored permanently (e.g. number of views per page, referring website, device type, browser, operating system). If your browser sends "Do Not Track" or "Global Privacy Control", we do not count you. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in designing the service according to demand).

We do not sell data and do not pass it on for advertising purposes. The only recipient is our hosting provider (see section 2). Data is not transferred to countries outside the EU. All fonts and scripts are loaded from our own server.

If you share your highscore card via WhatsApp or Facebook, you open the respective service yourself; from then on its privacy policy applies.

• Account, runs, coin transactions, inventory, achievements: until you delete your account. Deletion takes place immediately and completely.
• Password reset links: valid for 1 hour, confirmation links for a new email address: valid for 24 hours; after that they are deleted automatically.
• Tickets: we close answered tickets without a response after 14 days and automatically delete closed tickets after 365 days; together with your account immediately.
• Protection against abuse: hashes for at most 24 hours.
• Visitor statistics: daily hashes until the end of the day, aggregated daily figures for 400 days.
• Logs of administrative changes: 730 days, technical error messages 90 days – then deleted automatically.
• Server log files: see section 2.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can do a lot of this yourself:

• Download your data and delete your account: under Account → Settings
• Leaderboard, public profile, share link: can be switched off at any time in your profile and settings

For all other requests you can reach us via the support center (our address Info@StickRun.de also leads there). You also have the right to lodge a complaint with a data protection supervisory authority.

As StickRun evolves, we will adapt this privacy policy. The version published here always applies; the date of the last change is shown at the top of this page.