Privacy Policy

Last updated: September 25, 2026

1. Data controller

Richard Scheffler
Diesdorfer Privatweg 9
39110 Magdeburg
Germany
Email: richard.scheffler.design@gmail.com

2. General information

This website provides a browser game (“NiNjAttack”). We process personal data only where this is technically necessary to provide the website or where you actively contact us.

3. Hosting and server log files

This website is hosted by an external hosting provider (currently Cloudflare Pages). When you access the website, the hosting provider automatically collects information in server log files. This is technically necessary to deliver the website and to maintain security.

The log files may in particular contain the following data:

• IP address (possibly shortened or truncated, depending on the provider)
• Date and time of access
• Page or file requested
• Referrer URL
• Browser type/version and operating system

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in technical provision, stability and security). Log data is stored in accordance with the hosting provider’s requirements, or only for as long as necessary for the purposes stated above.

4. Advertising integration / cookies / tracking

Google Analytics is not used on this website. Selected editorial/content pages currently load the Google AdSense client script as part of the site's advertising integration and review setup. The game, smartphone controller, privacy/legal pages, contact page and sitemap do not include that AdSense script in the current source.

Google advertising services may process technical request information and, once advertising is active, may use cookies, identifiers or similar technologies depending on region, configuration and consent status. Where consent is legally required, NiNjAttack will use a Google-certified consent management platform / Google Privacy & Messaging before consent-based Google advertising is enabled.

The Privacy Settings page explains the current site-side setup. It does not provide a custom replacement for Google's required consent mechanism.

5. Local and Global Scroll of Fame

NiNjAttack keeps a local score list in your browser so that your best runs on this device can be displayed under “Local”. This local list is stored in browser storage and is not sent to the global leaderboard merely by viewing it.

The optional global leaderboard (“Scroll of Fame”) displays up to the top 100 best scores. When you choose a public ninja name, NiNjAttack stores a random browser player identifier locally so that the global list can keep only one best score per browser player while still allowing different players to use the same public nickname.

Once a ninja name has been chosen, completed runs are checked automatically for a new personal global best. The random player identifier, chosen nickname, best score and update time may be stored in a Cloudflare D1 database. Only the nickname and score are displayed publicly. No user account is required. Please use a nickname rather than information you do not want displayed publicly.

The leaderboard application itself does not store a separate IP-address field. Normal hosting and security logs remain subject to section 3 above. A separate short-lived random run identifier is used to reduce obvious automated or fabricated score submissions and is not intended to identify you.

You can change the public nickname from the global Scroll of Fame. Global best scores may remain stored until manually removed. You can request removal of a leaderboard entry by contacting the address listed above and providing enough information to identify the entry.

6. Contact

If you contact us by email, we process the information you provide in order to handle your request. The legal basis is Art. 6(1)(b) GDPR (pre-contractual/contractual communication) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

7. Your rights

Under the GDPR, you have, among others, the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)

8. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. A list of supervisory authorities can be found, for example, via the website of the German Federal Commissioner for Data Protection and Freedom of Information (BfDI).

---

This page reflects the current source configuration. It should be reviewed again when ad serving, consent messaging or other tracking/marketing technologies are materially changed.