As of September 2026. This policy covers real-world-games.com, the games on real-world-games.com (web app) and our apps for iOS and Android.
1. Controller
Real World Games GbR
Rosa-Kempf-Str. 19
81248 München
Germany
Email: hello@real-world-games.com. We are not required to appoint a data protection officer; write to us directly with any question.
2. Visiting the website
When you open a page, our hosting provider Cloudflare processes the technically necessary data (IP address, time, page, browser) to deliver the page and protect it from attacks. The legal basis is our legitimate interest in running the site securely (Art. 6 (1) (f) GDPR). Cloudflare keeps these logs only as long as delivery and security require. We serve fonts and scripts ourselves; visiting the website loads nothing from third parties. We set no cookies for analytics or advertising.
Reach and error analysis with PostHog. To understand how the website and the games are used and to find errors, we use PostHog (PostHog Inc., data processed in the EU, Frankfurt) without cookies and without storing anything on your device. The data passes through our own server. PostHog derives a daily-rotating, irreversible hash from your IP address and browser details to count visits, and a rough country and city; the IP address itself is not stored. We record pages viewed (without access codes in links), clicks on "Play", that a form was sent (not what was in it), and technical errors. There is no session recording and no profile across days. The legal basis is our legitimate interest in a working, improving service (Art. 6 (1) (f) GDPR); you can object at any time (see below), for example by email, by turning on "Do Not Track" in your browser, or by blocking trackers.
Whether you dismissed the "also available in …" notice is stored only in your browser's local storage.
3. Requests and waitlists
When you write to us through a form or by email, we store your details (such as name, company, email, city, date, group size, message) to answer your request and prepare a quote (Art. 6 (1) (b) GDPR). When you join a waitlist, we store your email address to tell you about the game (Art. 6 (1) (a) GDPR); you can leave at any time. We delete requests that did not lead to an order after twelve months at the latest, and waitlist entries once the game is out or you withdraw.
4. Playing
- No account: to play you only need a nickname and a figure. We store a random player id so you can rejoin after losing the connection.
- Location: during a game your device sends your position once you allow it. It only goes to your team, to everyone during certain game events (such as a rally), and to the organizer view. For the replay at the end, the game keeps a point of your route about every 20 seconds; after the game all players can see the routes, and we delete them seven days after it ended. No positions are kept for longer.
- Photos, audio and video: what you record for challenges is stored so your team and the game can see and check it. We delete it when the game ends, except the winning pictures of teams that agreed to the recap, which we delete after seven days.
- AI checks: to judge challenges we send recordings (photos, audio, video), typed answers (such as words or riddle solutions) and the text of an appeal to AI services: Anthropic (Claude) for the verdict, Cloudflare Workers AI for speech recognition. Under their contracts the providers do not use the data for training.
- No automated decision-making under Art. 22 GDPR: the AI check only decides game results such as Credits, and your team can appeal a result. It has no legal or similarly significant effect.
- Game analytics: we analyse game events (such as a game started, a challenge solved, a field claimed, the stars of a rating) with the random player id through PostHog to improve rules and challenges. Names, positions, texts and media are never included. For AI checks we record only the model, duration and size of the request, not its content.
- Feedback: ratings are stored with the random player id and no name; optional free text is deleted after 180 days.
- Push notifications: if you allow them, we store your device's push token to notify you about your game (through your browser's push service, Apple or Google).
The legal basis is running the game you take part in (Art. 6 (1) (b) GDPR); for location and push also your consent in your device's permission prompt, which you can withdraw in its settings at any time.
You are not obliged to give us any data. Without a nickname you cannot play, without location access location-based tasks do not work, and without an email address we cannot answer a request.
5. Creating and buying games
For organizer accounts we store your email address and send sign-in links by email (through Resend). When you buy a game, Stripe handles the payment; we never receive full card details. We keep billing records as long as commercial and tax law requires (up to ten years). Legal bases: Art. 6 (1) (b) and (c) GDPR.
6. Maps and place data
Your device loads the in-game maps from OpenFreeMap (tiles.openfreemap.org), which sees your IP address. We build boards and challenges on our servers from OpenStreetMap and Wikipedia data without sending any personal data.
7. Recipients and third countries
We use these processors: Cloudflare (hosting, database, storage, AI), Anthropic (AI checks), PostHog (analytics and error tracking, data processed in the EU), Resend (email), Stripe (payments), Apple and Google (push notifications in the apps). Some are based in the USA. Transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. You can withdraw any consent at any time with effect for the future. Write to us at hello@real-world-games.com. You can also complain to a data protection authority, for example the one responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).
Right to object (Art. 21 GDPR)
Where we process data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you may object at any time on grounds relating to your particular situation. We then stop processing it unless we can show compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.
9. Children
Children under 16 may only play with their parents' consent, for example in a game a school or their parents set up.