Magic Bomb privacy policy

1. Summary

• Magic Bomb uses no cookies, no analytics or tracking tools and no ad networks.
• There is no user account. Progress and settings stay on your device.
• The bombs you build live in the link. They are not stored on our server.
• Personal data only reaches us if you send something yourself: feedback, a leaderboard entry or an email.

2. Controller

The controller under the General Data Protection Regulation (GDPR) is:
Shannon & Thomas Pfalzgraf, Magic Camelot, Gifhorner Str. 19, 38442 Wolfsburg, Germany
Email: info@magic-camelot.com

We are not required to appoint a data protection officer. If you have questions about privacy, just write to the address above.

3. Website and hosting

The website and the game Magic Bomb are hosted on servers of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. We have a data processing agreement with IONOS under Art. 28 GDPR.

When you open a page, your browser sends technically necessary data to the server: IP address, date and time, the address requested, the amount of data transferred, browser and operating system and the page you came from. The server needs this to deliver the page and to detect attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation. The logs are deleted automatically after a short time; IONOS sets the period. We do not use them for any other purpose.

The website and the game set no cookies and load nothing from third-party servers. We serve the fonts and the physics engine ourselves. Links to other providers (such as PayPal) only take effect when you click them.

4. Storage on your device

Magic Bomb stores in your browser’s storage: language, chosen level, your sender name in the builder, today’s daily bomb result, your campaign stars, your endless-mode record, your leaderboard nickname and the ids of your own entries (so the list can highlight them), and any feedback text not yet sent. Installed as an app, it also keeps the game files for offline play.

This data does not leave your device. Storing it is strictly necessary for the functions you ask for (Section 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

5. Bombs in the link

A bomb you build lives entirely in the link, in the part after the # sign: the modules, the payload, the time and, if you enter them, your sender name and your message. Browsers do not send this part of the address to the server, so we don’t see it. For the personal number lock, the link holds only the question and a check value of the answer, not the answer itself.

You decide where to send the link. Whoever receives it sees the name and the message. If you send it by messenger or email, that service’s terms apply.

6. Feedback form

If you send a message via “Feedback”, we store on our server at IONOS:

• the kind of message and your text,
• optionally your email address, if you would like a reply,
• a short description of the bomb you were playing (mode, level, case, modules), the game version and the language,
• browser identifier and screen size, so we can reproduce bugs,
• an anonymised sender id.

The sender id is a hash of your IP address made with a secret key. We do not store the IP address itself. The id is only used to fend off spam and floods of messages.

The purpose is improving the game and – if you wish – replying to you. The legal basis is Art. 6(1)(f) GDPR, and Art. 6(1)(b) GDPR for replying to your request. We delete feedback once it has been dealt with, after 12 months at the latest. We reply from our mailbox info@magic-camelot.com.

7. Leaderboard (Top 100)

If you enter the leaderboard after defusing a daily or seasonal bomb, we store:

• the nickname you choose,
• your time, the date and the game version,
• the anonymised sender id described above.

Only nickname, time and date are public. They appear in the game and on this website. The sender id makes sure you have one entry per name and helps against abuse.

Entering is voluntary. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by entering and can withdraw at any time. Write to us and we will delete the entry. Entries that drop out of the Top 100 are deleted automatically, daily lists after 60 days. Please use a nickname, not your full name.

To fend off spam and overload, we keep the anonymised sender id with the time of the request for 24 hours at most (Art. 6(1)(f) GDPR).

8. Support via PayPal

Magic Bomb is free. If you would like to support us voluntarily, a link takes you to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. You only leave our site when you click it. PayPal’s privacy policy applies to the payment.

From PayPal we receive name, email address, amount and any message. We use this data only for processing and our accounts (Art. 6(1)(b) and (c) GDPR) and keep it as long as tax law requires (up to 10 years).

9. Contact by email

If you email us, we process your address and the content to answer your request (Art. 6(1)(b) or (f) GDPR). We delete messages once they have been dealt with and no retention obligations apply.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

An email to info@magic-camelot.com is enough. You can also complain to a data protection authority (Art. 77 GDPR), for example the one where you live or the one responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen (data protection authority of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany.

There is no automated decision-making or profiling. You are not obliged to provide data; without it you simply cannot send feedback or enter the leaderboard. Magic Bomb is meant for teenagers from 16 and adults. We do not sell personal information or share it for advertising.