Privacy policy

Last updated: October 2026

In short: the game stores nothing about what you say or do. We use no third-party tracking or analytics tools, no advertising cookies, and we load nothing from other companies’ servers while you use the site (fonts and scripts are hosted on our own server). That’s why there’s no cookie banner.

1. Controller

Simon Marko Johan – PromptLab Einzelunternehmen
Magnus-Niedermair-Str. 11
89407 Dillingen a.d. Donau
Germany
Email: simonjohan06@gmail.com

2. Hosting

This website runs on servers in Germany operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, under a data processing agreement (Art. 28 GDPR). Legal basis: our legitimate interest in secure, reliable operation (Art. 6(1)(f) GDPR).

3. Server logs

To deliver a page, the server necessarily processes your IP address. We do not store full IP addresses in our logs: the application only logs time, requested path (without parameters or access links), status code and response time. The web server in front truncates IP addresses before storing them. Logs are deleted after 7 days at the latest. To prevent abuse (limiting the number of requests), the IP address is held briefly in memory only and is never stored permanently. Legal basis: Art. 6(1)(f) GDPR.

4. Cookie-free audience measurement

We want to know which of our social media channels people come from and how many of them try the free sample or buy. Our links therefore carry source labels (e.g. “utm_source=ig_en_1”). On your first page view, our server creates a random visit ID that is carried only in the page address (URL). We count the steps “visit”, “sample started”, “checkout clicked” and “purchase”, together with language and source label. We store no IP addresses and no device or browser identifiers, set no cookies, store nothing on your device and do no fingerprinting. The random visit ID cannot be linked to you. Automated requests (such as link previews generated by messaging apps) are not counted. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring how well our channels work). Counts are deleted or aggregated after 26 months at the latest.

5. Purchase and payment via Stripe / Link

To buy the full version you are redirected to a Stripe payment page. Payment is handled through Stripe Managed Payments, with Link (“Sold through Link”, a Stripe group service, including Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, and Link SMP / Sold through Link, LLC, USA) acting as the reseller. Stripe/Link processes your payment, billing and contact data as an independent controller, calculates taxes, sends receipts and handles refunds and payment disputes. See Stripe’s privacy policy (stripe.com/privacy) and Link’s (link.com/privacy). Transfers to the US rely on the EU-US Data Privacy Framework or standard contractual clauses.

We pass the language, the visit ID and the source labels (see section 4) to Stripe so we can attribute a purchase to the right channel. After the purchase, Stripe sends us your email address, amount and currency, payment status and payment identifiers. We never receive card details. We use this data to provide your access, handle refunds and withdrawals and comply with legal obligations (Art. 6(1)(b) and (c) GDPR). We keep it while your access exists and beyond that only as long as commercial or tax retention periods require (up to 10 years).

6. Emails (access link, restore, withdrawal)

We email you your access link, a new access link when you ask for one, and a confirmation when you withdraw. No external email service provider is currently involved. Legal basis: Art. 6(1)(b) GDPR. There is no newsletter.

7. What is stored on your device (strictly necessary)

• Access cookie “acc” (only after purchase or after opening your access link): holds your random access key so you can play without a password. Lifetime 400 days.
• Local browser storage: saved cards (favorites), cards you’ve already seen and, as a backup, your access key. This data never leaves your device.

This storage is strictly necessary to provide the service you asked for (Section 25(2)(2) TDDDG), so no consent is required. You can delete it at any time in your browser settings.

8. Withdrawals and enquiries

If you withdraw via our withdrawal function or write to us, we process the details you give us (name, email, order number, message) to handle and document the request (Art. 6(1)(b) and (c) GDPR), and keep them for the statutory limitation and retention periods.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Contact simonjohan06@gmail.com. You may also lodge a complaint with a data protection supervisory authority.

10. No automated decisions

We make no automated decisions and create no profiles. Cards are shuffled randomly without using any data about you.

Website: couple.mypromptlab.org