Privacy

01Controller

02The short version

There is no account and no email list held here. The game runs in your browser and your saved run stays in it. Three things leave your machine while you play: the hosting provider’s own logs, a plain count of how the site is used that identifies nobody and writes nothing to your device, and two optional measurement scripts that do not run at all unless you say yes.

03Kept in your browser, sent nowhere

Local storage holds your saved run, whether you chose to continue on a small screen, and your answer to the measurement question. None of it is transmitted, none of it has an account behind it, and clearing your browser’s site data removes all of it, as does the button below, which works here without the game running.

Everything Powerstate keeps about you is in this browser, and this is all of it. There is no account behind these and no copy on a server. Clear them and the game has forgotten you.

• wattmark.save.v1your saved run: the whole world, in this browser only
• powerstate.gate.dismissedthat you chose to play on a small screen anyway
• powerstate.tour.sentthat a small screen has already been shown the gameplay page once
• powerstate.consent.measurement.v3this consent decision, so you are not asked again
• powerstate.install.v1a random id your finished runs are filed under, only if you agreed to that
• powerstate.runlog.v1your own finished runs, so the end screen can compare them, in this browser only
• powerstate.commendations.v2which commendations you have been awarded, per world, in this browser only
• powerstate.commendations.v1the same record in its old shape, kept only so this button can erase it
• powerstate.scenarios.v1the scenarios you wrote in the editor, in this browser only
• powerstate.lesson.opened.v1that you have opened the lesson, so the console stops holding the worlds shut
• powerstate.units.v1that you picked metric or US units yourself, written only if you overrode the guess

Storage strictly necessary to provide a service you explicitly requested is exempt from consent under Art. 5(3) ePrivacy Directive and §25 Abs. 2 TDDDG. It is disclosed here rather than negotiated in a banner.

04Hosting

The site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Serving a page necessarily processes your IP address and request metadata. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in operating a reachable website. Transfers to the United States are covered by the EU Standard Contractual Clauses and Vercel’s certification under the EU-US Data Privacy Framework.

05Counting how the site is used

A small number of counts are kept without asking, because they do not do the thing consent exists to protect you from. Nothing is written to your device and nothing is read off it. Each page load is given a random number that is held in memory for as long as the page is open and then lost, so reloading this page makes you a different one and there is no way to recognise you on a second visit, or on a second page.

Six things are counted, and this is the whole list:

• a page was opened, with which page it was, whether the link came from this site or elsewhere, and which of five size bands the window fell into
• which card of the gameplay tour was on screen, and for how long
• how far through the tour someone got before leaving, and how long they stayed
• which of the three links out of the tour was clicked
• a run was begun, and in which world
• the answer given to the measurement question above, so the rest of this page has a denominator

What is deliberately not recorded: your IP address, the page address you came from, your browser’s user agent string, and any free text of any kind. The referrer is read in your browser to decide one of five words and is never sent. The exact width of your window is turned into a band for the same reason.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing whether the site works. §25 Abs. 1 TDDDG does not apply, because no information is stored on or read from your terminal equipment. If your browser sends a Global Privacy Control signal or a Do Not Track header, none of it happens at all, and you can also object at any time by writing to info@powerstate-game.com. The individual counts are deleted after ninety days. The daily totals they are rolled into contain no identifier of any kind and are kept.

06Measurement, only with consent

If, and only if, you accept, two Vercel scripts run: Web Analytics, which counts the page view, and Speed Insights, which reports how quickly the page rendered on your device. Both are cookieless. Neither builds a profile, follows you across sites, or feeds any advertising.

Between them they record the page, the referrer, a coarse country, the class of device and browser, and page-load timings. The visitor identifier is derived from the request and rotated daily, so nothing links one day to the next.

Legal basis: Art. 6(1)(a) GDPR (your consent), together with §25 Abs. 1 TDDDG. Decline and neither script is fetched, so there is nothing left running to opt out of. Consent can be withdrawn at any moment from the About panel inside the game; withdrawal takes effect on the next event rather than the next visit, and does not affect the lawfulness of what was processed beforehand.

07Your rights

Under Art. 15–21 GDPR you may request access to your data, a copy of it, correction, deletion or restriction, object to processing based on legitimate interests, and receive your data in a portable form. Where processing rests on consent you may withdraw it at any time. Requests go to info@powerstate-game.com.

In practice the answer to “what do you hold about me” is short: nothing that identifies you exists here at all.

You also have the right to complain to a supervisory authority, which in Germany is the data protection authority of the federal state in which you live.

08Retention

The individual usage counts described above are deleted after ninety days by a scheduled job. What survives is a table of daily totals with no identifier in it, which is kept for as long as the site runs. Data from the two consented scripts is aggregated and retained by Vercel under its own retention windows.

Nothing else is retained here.