Privacy Policy

The controller responsible for processing personal data on this website and in this service is:

Jens Bösche
Am Piepenbrink 16A
29379 Wittingen
Deutschland

kappaxbeta@gmail.com

We have not appointed a data protection officer, as the statutory thresholds for doing so are not met. For any privacy matter, please contact us at the address above.

This service is built so that as little personal data as possible comes into existence in the first place. That is not a statement of intent — each of the following can be checked:

• There are no advertising, tracking or marketing cookies, and no third-party analytics are embedded (no Google Analytics, no Meta pixel, no consent-management service).
• There is no content delivery network in front of the site. Every page is served directly from our own server.
• Fonts are served locally from our own server. No connection is made to Google Fonts or any comparable service.
• Your IP address is not stored for analytics purposes (see section 6).
• No account is needed to enter a room (see section 8).

The application and the database run on servers we rent in Germany. No transfer to a third country takes place for hosting.

• Application server: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. This runs the website itself and the TLS proxy that encrypts your connection.
• Database, authentication and file server: STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. This runs our self-hosted Supabase installation, which holds accounts, content and files.

We have a data processing agreement under Art. 28 GDPR with both providers. Neither has access to the content of the data; they process it solely in order to operate the servers.

TLS certificates for encrypted transport are obtained automatically from Let’s Encrypt (Internet Security Research Group, USA). Only domain names are transmitted in that process — no visitor data.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the technically secure and reliable operation of this service.

When a page is requested, the web server automatically records log data transmitted by your browser:

• IP address
• date and time of the request
• the address requested and the HTTP status code
• volume of data transferred
• referrer URL, where one is sent
• browser type, browser version and operating system

This data is technically necessary to deliver the page and additionally serves to detect and defend against abuse and attacks. It is not combined with other data sources and is not evaluated for analytics. The legal basis is Art. 6(1)(f) GDPR. Logs are deleted, or their IP addresses anonymised, after 14 days at the latest.

We use strictly necessary cookies only. There is therefore no consent banner: under § 25(2) no. 2 TDDDG, no consent is required for cookies that are strictly necessary to provide a service the user has expressly requested. No cookies are set for analytics or advertising.

• sb-…-auth-token— keeps you signed in. Set only when you sign in. Lifetime depends on your “keep me signed in” choice: until the browser is closed, or up to 30 days.
• kxb.keep — remembers that choice, so the session gets the right lifetime each time it is renewed.
• unkown_last_space — remembers which space you opened last, so that signing in takes you there rather than to a picker. Lifetime: several weeks.
• unkown_invite — holds an open invitation while you create the account that accepts it. Not needed afterwards.

You can delete or block cookies in your browser at any time. If you do, you will not be able to sign in or use the protected areas of the service.

We measure how often which pages are opened, in order to understand what is being found and what is not. We use no third-party analytics tool and no cookie for this. One record is stored per page view, containing:

• the path requested, without the query string — identifiers, invitation tokens and search terms are discarded before the path is stored, so they never reach the database at all;
• the host of the referring site, e.g. “discord.com”, not the full address. Referrals from our own pages are not stored;
• the country, as a two-letter code;
• the preferred language, as a language tag from the Accept-Language header;
• the device class, only ever as one of four buckets — “desktop”, “mobile”, “tablet” or “bot”. The user agent string itself is not stored;
• a pseudonymous daily value (see below);
• your user id, if you are signed in at the time.

Views of our administrative area are not counted. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is in designing this service to meet actual demand. Given the design described above, the impact on your rights is low.

If you create an account, we process your email address and your password. The password is stored only as a hash; we do not know it in plain text. In addition, we process the details you enter in your profile, such as a display name and your choice of character, along with the spaces you are a member of and your role in them.

If you invite others to a space by email, we process the address you provide in order to deliver the invitation. Please only invite people who are happy to receive one.

The legal basis is Art. 6(1)(b) GDPR, as this processing is necessary to perform the user agreement.

Rooms can be entered via a guest link without creating an account. In that case we process the name you give yourself, the character you choose, and a technical identifier that identifies your session for its duration. We do not ask for an email address.

Guest access is time-limited and is deleted automatically once it expires. The legal basis is Art. 6(1)(b) GDPR.

What you create in the service is stored: pages and their content, rooms you build, chat messages, game state and comparable input. This content is visible to the members of the space in question and to guests who have been granted access. Please note that chat messages and things you build are visible to everyone present.

If you write to us via the contact form or the event enquiry form, we process the details you provide there — in particular your name, email address and the content of your message — in order to deal with your enquiry.

The legal basis is Art. 6(1)(b) GDPR where the enquiry is aimed at entering into a contract, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in answering enquiries. We delete enquiries once they have been dealt with, unless statutory retention obligations apply.

For paid subscriptions we use Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. You enter payment details — card details in particular — directly with Stripe. We neither receive nor store them.

In our own database we store only the Stripe customer id, the subscription id and its status, so that we know which features are unlocked. Stripe may also transfer personal data to the USA; that transfer is based on standard contractual clauses and certification under the EU-US Data Privacy Framework.

The legal basis is Art. 6(1)(b) GDPR. Invoice-related data is retained under Art. 6(1)(c) GDPR for the statutory periods of up to ten years.

System messages such as sign-up confirmations, password resets and invitations are sent via a mail server we run ourselves on our own infrastructure. No external mail delivery provider is involved. There is no open or click tracking, and we do not send a newsletter.

Beyond the parties named in sections 3 and 11, we do not pass your data to third parties. Disclosure occurs only where we are legally obliged to make it. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR, and your data is not sold.

• Server logs: 14 days at most.
• Analytics: the daily value ceases to be attributable at the turn of the day; the remaining fields are anonymous and are evaluated in aggregate on an ongoing basis.
• Account and content: until the account is deleted.
• Guest access: until the guest access expires.
• Form enquiries: until dealt with, unless a retention obligation applies.
• Invoice records: up to ten years, under commercial and tax law obligations.

You have the following rights in relation to us:

• access to the data we hold about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of any consent given, with effect for the future (Art. 7(3) GDPR).

We update this policy when the service or the legal position changes. The version available here is the one that applies.

Last updated: August 2026