Privacy policy

Last updated: [DD.MM.YYYY]

This policy covers the game Cheese Tycoon for iPhone, iPad and Android, the website www.cheesetycoon.com and the newsletter. It follows the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

Controller

Joel Horlacher
[home address: street, postcode, town, Switzerland]
Email: [datenschutz@cheesetycoon.com]

The game

Cheese Tycoon does not collect personal data. The game has no account, no server, no ads, no analytics and no crash reports that reach me. Saves and settings stay on your device. If you delete the game, they are gone.

Purchases. Apple (App Store) and Google (Google Play) handle the purchase of the game and any additional purchases, under their own privacy policies. Apple and Google send me sales reports; I never see payment details such as card numbers. [check: which order data the Play Console shows]

Operating system data. If you allowed your device to share analytics with app developers, Apple or Google provide me with crash reports and aggregated usage figures. The operating system collects this data, not the game. You can turn it off in your device settings.

Links from the game. If you open a link in the game (for example to this page), your browser takes over. The section "The website" applies there.

The website

The website sets no cookies, uses no advertising services and loads nothing from third-party servers. Fonts, images and scripts are served from the same server as the page.

Hosting. The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, Vercel processes technically necessary data: IP address, location derived from it (city, country), date and time, requested address, browser and operating system. This is needed to deliver the site and to fend off attacks. These logs are visible in my account for one day. How long Vercel keeps them internally is up to Vercel; its privacy notice does not state a period. Vercel processes the data as a processor under its Data Processing Addendum. Data may be transferred to the USA. Vercel is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework.

Visitor statistics

To see how many people visit the website and how many sign up for the newsletter, I use Vercel Web Analytics. Its script comes from the same server as the page and sets no cookies. For each page view it records: time, the page, the page you came from (if your browser shares it), country, region and city (derived from the IP address), browser, operating system and device type. After a sign-up an event named «Anmeldung» (sign-up) is added, with the language and the form you used (top or bottom of the home page). Your email address is not sent to the statistics.

To count visits, Vercel derives a hash from the request and discards it after 24 hours. According to Vercel, it stores no IP addresses and no identifiers that would allow visits to be followed across other websites. I only see aggregated figures, not individual visits. The pages for confirming and unsubscribing do not load the script.

The legal basis is my legitimate interest in knowing whether the website does its job (Art. 6(1)(f) GDPR). Vercel processes the data as a processor, as described under hosting. If you do not want to be counted, block the script in your browser; the website and the sign-up work without it.

When you sign up for the newsletter, I store your email address, the language you chose, the time of sign-up and the version of the sign-up text you agreed to.

For now you are subscribed as soon as you send the form. There is no confirmation email yet. Once sending is set up, new sign-ups will first receive an email with a confirmation link (double opt-in) and are only subscribed after clicking it. I delete unconfirmed addresses 30 days after that email. I will name the sending service here before it starts.

Before storing an address, I check in the DNS whether its domain has a mail server. Only the part after the @ is looked up, not the whole address. This keeps typos and made-up addresses off the list, and no email goes nowhere.

The newsletter comes about once a month: a short update from the dairy, the invitation to the beta and a note when the game is released. I do not track whether you open it or click links.

You can unsubscribe at any time via the link in every email or by emailing me. I then delete your address.

To keep anyone from flooding the form, I count sign-ups per hour and sender. I do not store your IP address for this, only a key derived from it that cannot be reversed and changes every hour. These counters are deleted after one day.

The legal basis is your consent (Art. 6(1)(a) GDPR). Sign-ups are handled by a Vercel function in Frankfurt. Addresses are stored in a database by Neon, LLC (USA, a Databricks, Inc. company) in Frankfurt; Neon is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework. Your browser only connects to this website.

Every morning, Claude, an AI assistant made by Anthropic, compiles how many new sign-ups came in. To do so, Claude reads the new entries from the database: email address, language and time of sign-up. Anthropic Ireland, Limited (Ireland) processes this data under its own privacy policy and may transfer it to the USA, relying on standard contractual clauses.

For sending the newsletter later I will use a mailing service based in Switzerland or the EU. I will update this policy before that.

Emailing me

If you write to me (support, press, privacy), I use your address and message only to reply. I delete the message once the matter is closed, at the latest after [two] years. The mailboxes are hosted by Hostpoint AG, Switzerland, on servers in Switzerland.

Transfers abroad

Data may be transferred to Germany (newsletter function and database in Frankfurt), to Ireland (daily sign-up report) and to the USA, because Vercel and Neon are US companies and Anthropic may transfer data there. Under the FADP, Germany and Ireland provide adequate protection. For the USA this applies to companies certified under the Swiss-U.S. Data Privacy Framework (Annex 1 of the Data Protection Ordinance); Vercel and Neon are certified. Anthropic relies on standard contractual clauses for transfers to the USA.

Your rights

You can ask what data I hold about you, have it corrected or deleted, and object to its processing. You can withdraw consent at any time. Write to [datenschutz@cheesetycoon.com].

You can lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your country of residence.

Changes

If anything here changes, I update this page. The version with the latest date at the top applies.