Privacy

This is a translation. Only the German version is legally binding.

This page explains which personal data is processed when you visit feoren.com. In short: no sign-up, no third-party content and a cookie only when you open the contact form or the message in a bottle.

Controller

Hosting and server log files

The website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. On every request the web server automatically stores technical details in log files:

• IP address of the requesting device
• date and time of the request
• requested address, HTTP status code and amount of data transferred
• previously visited page (referrer), if the browser sends it
• browser and operating system (user agent)

This is necessary to deliver the pages, find errors and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in secure and stable operation. The log files are deleted after 7 days.

The website also writes error and operating messages to its own logs on the server. They are used only to track down errors and are deleted after 30 days at the latest.

Audience measurement

To see which pages are visited and how often, this website uses Umami, a privacy-friendly web analytics tool. It runs on its own server (tracking.erenware.com, operated by Ferhat Eren); the data is not passed on to third parties. When a page is visited, the following is recorded:

• requested address and previously visited page (referrer)
• browser, operating system, device type and screen size
• language setting of the browser
• country, derived from the IP address

The IP address itself is not stored. To tell visits apart, the software forms an irreversible checksum from the IP address, the browser identifier and a regularly changing random value. No cookies are set and no profiles across several websites are created.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in knowing the reach of the website and improving it. The statistics are stored for 24 months. You can object to the measurement at any time: by email or, without giving reasons, by blocking scripts from tracking.erenware.com in your browser, for example with a content blocker.

Cookies and third-party content

This website sets only one technically necessary cookie, and only when you open the contact form or the message-in-a-bottle form. It contains a random session identifier that lets the form recognise forged requests from other sites (protection against cross-site request forgery) and is deleted when you close the browser. On the server, the session only holds a protection key and the time at which the most recently submitted form was opened, so that the same form cannot be submitted more than once; this data is released for deletion after two hours without use. The legal basis is Section 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR; the legitimate interest lies in protecting the form against misuse. There are no other cookies.

Fonts, images and scripts come from our own server; there are no embedded maps, videos, font services or social media buttons from third parties.

The weather on the beach is real and matches your area without the website ever asking for your location: when you visit the home page, your browser only sends the name of its time zone (such as “Europe/Berlin”) to our server. From that, the server determines the main city of the time zone and fetches weather data for it from the Norwegian Meteorological Institute (MET Norway, api.met.no) about every 15 minutes. The request comes from the server; MET Norway only receives the rounded coordinates of that city and no data about you, not even your IP address. Like every requested address, the time zone name appears in the server log files and is not stored beyond that; the weather cache only knows the place. To limit mass requests, a pseudonymised checksum of your IP address (for IPv6 only the network part) is kept in the database with an hourly counter for at most two hours; the IP address itself is not stored. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in bringing the home page to life with the weather of your area and in protecting the interface against misuse. Weather data: MET Norway, licence CC BY 4.0 (creativecommons.org/licenses/by/4.0).

The space station ISS and the northern lights in the sky of the home page follow real data, without the website ever asking for your location. For the next visible passes of the ISS, your browser sends the coordinates that the page derives from your time zone (the main city of the zone), rounded to one decimal place (about 10 km), to our server. The server calculates the passes from orbital data that it fetches from CelesTrak (celestrak.org) at most every 12 hours. For the northern lights, it fetches the current Kp index from the Space Weather Prediction Center of the US agency NOAA (services.swpc.noaa.gov) at most every 15 minutes; your browser sends no data for this. Both requests come from the server; CelesTrak and NOAA receive no data about you, not even your IP address. To limit mass requests for the passes, a pseudonymised checksum of your IP address (for IPv6 only the network part) is kept in the database with an hourly counter for at most two hours; the IP address itself is not stored. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in bringing the sky of the home page to life and in protecting the interface against misuse.

If you discover a secret on the beach, the website counts it anonymously: only which secret was found how often on which day is stored, with no link to you and without a cookie. To limit mass requests, a pseudonymised checksum of your IP address (for IPv6 only the network part) is kept in the database for at most two hours together with an hourly counter, separate from the count; the IP address itself is not stored. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in seeing which secrets are found and protecting the count from abuse. Which secrets you have already discovered, and when, is remembered only by your browser in its local storage; this information never leaves your device.

So that the collection album can show how many visitors discovered something today, your browser sends an empty message to the server once, at your first find of the day. Only one number per day is stored, without an identifier, without a cookie and without any reference to you; whether you have already been counted today is remembered only by your browser. Against mass messages, at most three messages per connection and day are counted; for this, two pseudonymised checksums of your IP address (for IPv6 only the network part) are kept in the database until the end of the day (UTC) and deleted afterwards. The number shown is never larger than the number of different networks that sent a message. The numbers are deleted after 30 days and only shown from three discoverers on. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is to show visitors that they are not exploring alone and to protect the count from abuse.

For the riddle of the week, the server checks your answer to the riddle of the day and gives you a letter for it; if you type in a solution word, your browser sends it to the server to be checked. Answer and word are only compared, neither stored nor logged; against mass guessing, the same limit applies, using a pseudonymised checksum of your IP address for at most two hours. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is to offer the riddle without revealing the solution word in the browser.

Local storage in your browser

So that the home page remembers your game and your settings, it keeps a few details in your browser’s local storage (localStorage, the session markers in sessionStorage):

• game progress and finds: which secrets you have discovered, each with the time of the first find, the Dragon Balls and carp you have collected, the state of the riddle and the treasure hunt, and whether you have read the owl’s letter
• the riddle of the week: the letters you collected this week and whether you solved it, plus the day your browser was last counted in the daily count of discoverers
• the history of Son Goku: how often each form has already appeared in the sky
• your wishes to Shenlong: which wish was granted last and when, whether day or night is held, whether the cloud follows you and how many times a wish has been granted to you so far
• your settings: sound on or off, volume for overall, music and sounds, and announcements for screen readers on or off
• a visit counter on the beach that counts how often you have visited the home page (from the third visit on, the owl brings a letter), and whether you have already seen the captain’s welcome
• session markers that disappear when you close the tab: whether this visit has already been counted, a random identifier of the visit for the treasure hunt, whether a riddle has already been asked during this visit, and a safeguard against repeated reloading

These details serve only the game and your settings. They stay in your browser and are not transmitted to our server, with a few exceptions: when you find a secret for the first time, the browser sends its name to the server once so that it is counted anonymously, and at most once a day an empty message for the daily count of discoverers; for the riddle of the week, your answer to the riddle of the day and your solution word go to the server to be checked (see above). All of this happens without a time, without an identifier and without any reference to you. So that pages load faster and an offline page appears without a connection, the website also keeps its own files such as scripts, fonts and sounds in the browser cache (service worker); they do not leave your device either. You can delete all of this at any time by clearing the site data of feoren.com in your browser; the page also works without local storage, but then remembers nothing. The legal basis for storing on your device is Section 25(2) No. 2 TDDDG, because it is strictly necessary for the functions you use.

Contact form

Through the contact form you can send a message, an idea, a bug you found or some praise. We store the type you chose, your message, the language of the page and the time, plus your name and email address if you choose to give them because you would like a reply. Only the controller reads the submissions, in the protected admin area; they never appear on the website. For the type “Message”, the content including name and email address is also sent as an email via the hosting provider’s mail server to the controller; the email is deleted once the matter is settled and no statutory retention obligation applies. For the other types, if notifications are set up, the controller only receives a short notice with the type, number, time and language, without your message, your name or your email address. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in answering enquiries and improving the website with your feedback. If the matter concerns a contract or steps prior to entering into one, the legal basis is Art. 6(1)(b) GDPR.

Submissions are deleted no later than 365 days after they are sent, or earlier on request by email to hello@feoren.com (Contact form). To protect against mass submissions, two pseudonymised checksums of your IP address are also stored (for IPv6 only of the network part, once narrower and once wider), created with a secret key; the IP address itself is not stored, and the checksums are deleted after 24 hours. As soon as you open the form, a separate pseudonymised checksum of your IP address with a counter per hour is kept in the database for at most two hours, so that the number of times a connection loads the form can be limited, and the website sets the technically necessary session cookie. The legal basis for this is Art. 6(1)(f) GDPR; the legitimate interest lies in protection against misuse.

Message in a bottle

On the beach of the home page you can throw a short message (up to 140 characters) into the sea as a message in a bottle and read bottles from other visitors. We store the message, a first name or initials if you choose to give them, the language of the page and the time; no e-mail address is requested and links are not accepted. Every message is published only after the controller has checked it and then appears at random for other visitors, with first name or initials and date. Please do not include anything that identifies you or others. The legal basis is your consent given by sending (Art. 6(1)(a) GDPR); you can withdraw it at any time by e-mail, and the message will then be deleted. After you throw it in, the form shows you a deletion code once; quote it in your e-mail to hello@feoren.com (Contact form) so that we can find and delete the message. We do not store the code itself, only a checksum formed with a secret key, for as long as the message is kept.

Messages that have not been approved are deleted after 90 days, rejected ones 30 days after the decision and approved ones no later than 730 days after they were sent. To protect against mass submissions, a pseudonymised checksum of your IP address (for IPv6 only the network part), formed with a secret key, is also stored; the IP address itself is not stored, and the checksum is deleted after 24 hours. The legal basis for this is Art. 6(1)(f) GDPR; the legitimate interest lies in protection against misuse. When you open the form, the website sets the same technically necessary session cookie as for the contact form. Even when you open the message-in-a-bottle form, a separate pseudonymised checksum of your IP address is also kept in the database together with a counter per hour for at most two hours, so that the number of times one connection requests the form can be limited; the legal basis here is also Art. 6(1)(f) GDPR, for protection against misuse. When you read bottles, too, a separate pseudonymised checksum of your IP address (for IPv6 only the network part) is kept in the database together with a counter per hour for at most two hours, so that mass requests can be limited; the legal basis is Art. 6(1)(f) GDPR.

Contact by email

If you write an email, your address and your message are used only to answer your request. The legal basis is Art. 6(1)(f) GDPR, for enquiries about a contract Art. 6(1)(b) GDPR. The message is deleted once the matter is settled and no statutory retention obligation applies.

Your rights

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR).

An informal email to the address above is enough.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

Last updated: 31 October 2026