← Back to the game

Privacy and Impressum

Privacy (Datenschutz)

In short: your card, your ticks and the names you write down stay on your own phone. They are never sent to us. We only count anonymously how many people play. No cookies, no ads.

What stays on your phone

Your card, the squares you tick, the names and words you enter, your own name and a random player code are saved in your browser's local storage on this device only. Nobody else can see them, including the host. You delete them by clearing this site's data in your browser. A card also resets itself three hours after a game ends.

Scan to tick

Your QR code under "My code" holds your name and a random player code, plus your LinkedIn, Instagram and "which describes you best" answer if you added them (see below). When another player scans it, your name and that code are saved on their phone, the same as if they had typed your name. Nothing goes to a server. The camera only runs while you scan, and the picture never leaves your phone.

What is sent

• Anonymous game counts. So the organizer can see how many people played and who won, your phone sends: a random number made for this card and this event, the card number shown under your card, whether your card is open, how many squares you ticked, how many lines you have, the time of your first line, and how many squares you ticked by scanning. The host sees the leaders by card number only, and your phone is told whether it won. No name, no player code, no squares' content. Deleted automatically 30 days after the last update. Legal basis: legitimate interest in measuring and improving the game (Art. 6(1)(f) GDPR).
• The state of the game. Every few seconds your phone asks whether the host has started, stopped or restarted the game. It only asks; it sends nothing about you.
• Events set up by organizers. When an organizer creates an event, we store its name, date, hashtag, board and settings, and a scrambled (hashed) version of the host key, with Upstash (servers in the EU), and a contact email address if the organizer chose to show one to players. Deleted after 400 days at the latest. A limit on new events per day uses a scrambled version of the network address and is deleted after one day. Legal basis: performing the service the organizer asked for (Art. 6(1)(b) GDPR) and legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).
• AI suggestions for organizers. When an organizer asks for AI help with their squares, the squares or the event description they typed, and the event's name, are sent to Anthropic PBC (USA) so its model Claude can write suggestions. Nothing from players is sent. Legal basis: performing the service the organizer asked for (Art. 6(1)(b) GDPR).
• Links from the host. The host can add up to three links under your card, for example to tickets or a feedback form. They open other websites, where those sites' own privacy policies apply.
• Your LinkedIn and Instagram, only if you add them. At networking events you can add your LinkedIn profile and Instagram name. They go into your code on your phone, and only people who scan your code receive them, on their phone. They are never sent to our server.
• "Which describes you best?", only if the host asks and you answer. Your answer (for example "Student") goes into your code, so people who scan you see it next to your name. It is also sent with your card's anonymous counts, without your name, so the organizer sees how many people chose each answer.
• Logos on the share card. The host can add up to two small logos (for example the organizer's and a sponsor's) that appear on every share card. They are the host's content, stored with the event, and contain nothing about you.
• Nothing from your share card. The share image and post text are made on your phone. They only go where you send them yourself.
• Feedback, only if you send it. Your star ratings (for the game and, if asked, for the event), whether you'd come again, and your optional answers and comment the name of the event (for example "disrupthr-3"), the organizer's own questions and the time you sent it. No name, no card number. It is stored with Upstash (servers in the EU) and deleted automatically 30 days after the last feedback for that event. Please don't write personal details in the comment. Legal basis: your consent by sending it (Art. 6(1)(a) GDPR).
• Hosting. The app is hosted by Vercel Inc. When you open the page, Vercel processes your IP address and browser information to deliver it and to keep the service secure, in short-lived server logs. Legal basis: legitimate interest in running the page safely (Art. 6(1)(f) GDPR).
• Service providers and transfers to the USA. Vercel, Upstash and Anthropic process data only on our behalf, under data processing agreements (Art. 28 GDPR). Vercel and Anthropic are US companies. Transfers to the USA are based on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Commission's standard contractual clauses in the provider's data processing agreement (Art. 45 and 46(2)(c) GDPR).

What we don't use

Buying a pass

Passes are sold by Paddle.com Market Ltd (London), our merchant of record. Paddle collects your name, email address, country and payment details, issues the invoice and handles VAT and refunds under Paddle's privacy policy. Paddle's checkout sets cookies for payment and fraud checks on the pricing page only. From Paddle we receive and store, with Upstash in the EU, for up to 400 days: the pass code, the pass type, the transaction number and your email address, so we can find your pass if you lose the code. A refund ends the pass.

No analytics tools, no cookies in the game itself, no Google Fonts. The only counting is the anonymous game counts above. The fonts and the QR code library are served with the app. Open-source parts: the fonts Bricolage Grotesque and Archivo Narrow (SIL Open Font License), qrcode.js (MIT License) and jsQR (Apache License 2.0); the license texts are in the app's assets folder. "Find on LinkedIn" only opens a LinkedIn search when you tap it. From then on, LinkedIn's own privacy policy applies.

Your rights

You can ask for access, correction, deletion or restriction of your data, and object to processing (Art. 15–21 GDPR). Because feedback is anonymous, we usually can't link it to you. You can also complain to a data protection authority, in Hamburg the HmbBfDI.

Responsible (Verantwortlich)

Brooke Gazdag, gazdag.brooke@gmail.com. When the game runs at an event, the event organizer decides to use it.

Impressum

Angaben gemäß § 5 DDG

Prof. Dr. Brooke A. Gazdag
Hamburg
E-Mail: gazdag.brooke@gmail.com
Website: brookegazdag.com

Verantwortlich für den Inhalt nach § 18 Abs. 2 MStV: Prof. Dr. Brooke A. Gazdag

Schmingo is a personal project of Brooke Gazdag. It is not a service of Kühne Logistics University.

Last updated: 7 November 2026 (card number and first-line time for the winners; service providers, transfers to the USA, open-source notices)