Privacy policy

Scope

This privacy policy covers the website wortikus.app. The Wortikus app has not been released yet; before it is, I will extend this policy to everything that concerns the app.

“GDPR” refers to the EU General Data Protection Regulation.

Last updated: 14 October 2026

Controller

Tommy Drzewosz, Eichenweg 17, 56751 Polch, Germany

E-mail: info@wortikus.app, phone: +49 159 01325284

I have not appointed a data protection officer; as an individual I am not required to. I answer questions about data protection myself: write to me at info@wortikus.app.

Server logs

When you open a page, the web server (nginx) writes an entry to its log: your IP address, the date and time, the address requested, the status code and the amount of data, the page you came from (referrer) and your browser’s identifier (browser, version, operating system). On the invitation page, the game code is part of the address requested.

The purpose is secure and stable operation: finding errors and detecting attacks and abuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in this purpose). The logs are rotated daily and deleted after 14 days. I do not combine them with other data and only look into them in case of faults or attacks.

The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; the server is located in Nuremberg. Hetzner processes the data on my behalf (Art. 28 GDPR).

Audience measurement with Umami

To see how often the website is visited and which pages are read, I use Umami, an open-source tool for audience measurement. It runs on my own server in Germany (analytics.web-puls.de). No other provider receives the data.

How it works: when you open a page, your browser loads a small script from analytics.web-puls.de and reports the visit there. Umami sets no cookies and stores nothing in your browser. From your IP address, your browser’s identifier, the website and a secret value that changes every month, Umami computes a checksum (hash). This lets it count visits from the same device in the same month as one visitor. Using a database on the same server (GeoLite2), Umami also derives the country, region and city from the IP address. Umami does not store the IP address itself, and no profile of you is built.

If you have switched on “Do Not Track” in your browser, Umami does not count your visit.

Umami stores:

• the address visited (including everything after the “?”) and the page title,
• the date and time,
• the page you came from (referrer),
• browser, operating system, device type, screen size and language,
• country, region and city, derived from the IP address,
• the checksum described above.

The invitation page is counted with its full address too, for example wortikus.app/join/ABC234. The game code in it identifies a game room, not you. I do not link these counts to the game data of the app.

Before a request reaches Umami, it passes my reverse proxy. The proxy keeps a log with IP addresses that is rotated weekly and kept for four weeks, so it is deleted after five weeks at the latest.

The legal basis is Art. 6(1)(f) GDPR: my legitimate interest is to improve the website based on visitor numbers without tracking you. You can object at any time (Art. 21 GDPR): write to me, switch on “Do Not Track” in your browser or block the script with a content blocker; the website works without it.

There is no fixed period after which Umami deletes the visit data. I keep them because they contain no IP address and no name.

No cookies

The website sets no cookies, uses none of your browser’s storage and embeds no third-party content. Fonts, images and scripts come from my server. The only connection to another server is the audience measurement described above.

If you write to me

If you write to me at info@wortikus.app, I use your address and your message to answer you (Art. 6(1)(b) or (f) GDPR) and keep them for as long as I need them for that.

Your rights

You have the right to

• access your data (Art. 15 GDPR),
• have incorrect data corrected (Art. 16 GDPR),
• have your data erased (Art. 17 GDPR),
• have the processing restricted (Art. 18 GDPR),
• data portability (Art. 20 GDPR): on request I send you your data in a common, machine-readable format,
• object (Art. 21 GDPR): to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation, and to the audience measurement at any time and without giving reasons.

To do so, write to info@wortikus.app.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate), Hintere Bleiche 34, 55116 Mainz, Germany, phone +49 6131 8920-0, e-mail poststelle@datenschutz.rlp.de

Changes

I update this privacy policy when the website or the law changes, and I will extend it to the app before the app is released. The current version on this page applies.

What already holds for this website

This refers to these information pages, not to the game itself.

• The website sets no cookies and stores nothing in your browser.
• For privacy-friendly audience measurement it uses Umami on the provider’s own server: no cookies, nothing stored in your browser, no personal profiles.
• It embeds no third-party services: no advertising, no embedded content.
• Fonts, images and scripts come from the provider’s own servers only.