Privacy notice

1. Controller and contact

SkriptAtelier UG (haftungsbeschränkt)
Am Mausepfad 34
34474 Diemelstadt
Germany
Privacy requests:
General enquiries:

This privacy policy describes the processing of personal data when you visit talealley.app, buy tickets, sign up for the public test, subscribe to the newsletter and use the TaleAlley app. For data that Paddle processes under its own responsibility as an independent seller, Paddle's privacy notice at https://www.paddle.com/legal/privacy also applies.

2. Principles and legal bases

We process only the data required for the relevant purpose. Depending on the processing, the relevant legal bases are in particular Art. 6(1)(b) GDPR (providing the agreed app and game functions), (c) (legal obligations), (f) (legitimate interests in security, error correction and support) or (a) (separate consent, in particular for optional publications). Where consent is required, it is obtained separately and can generally be withdrawn with effect for the future.

Reading this notice is not consent. Permission granted through iOS or Android to access location, camera or microphone is separate from any consent required under data protection law. Access to your device is also subject to the applicable requirements of the German TDDDG.

3. Visiting the website and Cloudflare

Our website is provided through Cloudflare Workers and other Cloudflare services. IP addresses, time of access, requested resources, browser and device information, and security and network events may be processed. This serves to deliver our service, keep it working and secure it. The legal basis is generally Art. 6(1)(f) GDPR. Where legal obligations are concerned, it is Art. 6(1)(c) GDPR.

According to the most recent technical check, the website uses Cloudflare Web Analytics. In the current configuration, visits from the EU are excluded from this analysis. Cloudflare may also process technical connection and security logs. Different retention periods apply to the different categories of Workers logs, security events, analytics data and administrative logs. Processing exclusively within the EU is not promised for all Cloudflare processing.

If you are given access to a protected website preview, a strictly necessary session cookie may be used for this. The current preview concept provides for a lifetime of eight hours. A public TaleAlley service does not need this preview cookie. If cookies that are not strictly necessary, external content or analytics and marketing services are used in future, we will inform you and obtain consent beforehand where required.

4. Contact by email and support

When you contact us, we process your email address, the content of your message and necessary communication data to handle your request. Depending on the case, the legal basis is Art. 6(1)(b) or (f) GDPR. According to the current list of providers, we use Pixel X e.K., Kuhstraße 26–27, 38100 Braunschweig, Germany, for technical email hosting. Requests are deleted once they are no longer needed, unless statutory documentation or retention obligations apply.

5. Sending emails through Mailjet

We send automatic emails and our newsletter through Mailjet GmbH, Alt Moabit 2, 10557 Berlin, Germany, as our processor. The automatic emails include the ticket email with the game code after a purchase, the emails about the public test and internal notices to our own inboxes, for example about purchases that need a check or about reported AI answers. For the test, these are the confirmation email with the link, the confirmation that your place is saved, later the email with the code and, after the game, the email with our questions. For this, Mailjet receives the recipient address, a name where applicable and the content of the email and, according to Mailjet, stores the data in data centres in the EU. Open and click tracking is switched off, also for the newsletter. We therefore do not learn whether you open an email or click a link in it. The sender and reply address of the automatic emails is . The legal basis is Art. 6(1)(b) GDPR for ticket and test emails, your consent under Art. 6(1)(a) GDPR for the newsletter and Art. 6(1)(f) GDPR for internal notices.

6. Buying tickets through Paddle

Tickets are sold in the Paddle checkout by Paddle as the independent seller and merchant of record. When you pay, Paddle processes the buyer, payment, tax and transaction data required for this under its own responsibility, for example email address, country, billing address, postcode and chosen payment method. Complete card and bank details are not stored in our TaleAlley database.

The website checkout loads Paddle only after you open the payment function. To create the game code, assign the booking, handle cancellations and provide customer support, we store only the following for each purchase: the Paddle transaction number, the purchased story, the number of adult and teen tickets, the language, the version and time of your agreement to provision before the withdrawal period ends, currency and total amount, the time of purchase, the status and the issued code with its event. When an adventure starts with the code, we record how many devices for adults and for teens took part and when it started, so it stays clear which tickets were used. For a cancellation we store how many tickets were cancelled, the refund amount, the processing status and Paddle's reference number for the refund. If the code is blocked after a refund or chargeback, we also store the time and reason. We fetch your email address and, if Paddle has one, your name from Paddle only to send you the ticket email and emails about a cancellation. We store neither of them, nor your country or postcode. The legal basis for providing the service is generally Art. 6(1)(b) GDPR, for statutory records Art. 6(1)(c) GDPR and, where applicable, for technical security and justified customer requests Art. 6(1)(f) GDPR.

We keep purchase-related data for as long as necessary for providing the service, handling open claims, reversals and statutory retention obligations. Paddle's handling of purchase and payment processing data is also governed by Paddle's privacy notice.

7. Signing up for the public test

When you sign up for the public test at talealley.app/test, we process the first name, last name and email address of the person signing up, the number of adults, of teenagers aged 13 to 17 and of children under 13 in the group, the chosen story and game mode, the language, the versions of the confirmed terms and notices and your choice on the newsletter. We also process the status of the sign-up, the times of sign-up and confirmation, a hashed value of the confirmation link and its expiry time, the delivery status of our emails, the status of the newsletter subscription and, later, the assigned event code. We do not ask for the names or ages of the other players. We store the sign-up in our database at Supabase and use it to allocate places, check the story's age rules, confirm your sign-up, send you the code later, ask for your feedback after the game and write to you about the test. The legal basis is Art. 6(1)(b) GDPR.

We ask for your date of birth only to check that you are of age on the day you sign up. Our website's server at Cloudflare carries out this check, see section 3. We do not store your date of birth and do not pass it on, not even to Supabase. The legal basis here is also Art. 6(1)(b) GDPR.

After you submit the sign-up form, we email you a link. Your sign-up is complete only once you confirm it with this link (double opt-in). This way we make sure that the email address really belongs to you. As proof, we store the times of your sign-up and of your confirmation. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in preventing sign-ups with other people's email addresses and in being able to prove sign-ups.

To stop programs from taking the free places, Cloudflare Turnstile protects the sign-up form. Turnstile loads only on the sign-up page and evaluates technical signals such as IP address, TLS fingerprint, browser identifier and the calling website to tell people from automated access. For this, Cloudflare acts on our behalf. According to Cloudflare, it also uses the signals under its own responsibility to improve bot detection. The legal basis is our legitimate interest in allocating the places fairly under Art. 6(1)(f) GDPR.

We send all emails about the test through Mailjet, as described in section 5. Replies to our emails reach our inbox .

Feedback after the game is part of the test. For this, we send you an email with a few questions after the game. We use your answers to improve TaleAlley. Please do not include unnecessary personal information in your answers. The legal basis is Art. 6(1)(b) GDPR.

Whether you send us photos or videos after the game so that we can show them on our social media channels or our website is your free choice. We only show them with your separate consent and only if everyone recognisable agrees. The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future.

If you do not confirm your sign-up within 48 hours, we delete it. We delete a confirmed sign-up for which we have not yet sent a code 90 days after confirmation. Once we have sent you a code, we delete the sign-up data no later than three months after the end of your test, that is after your code expires. At your request we delete it earlier. First name, last name and email address are always removed. Other information such as story and group composition may remain for statistics without name and email address. We keep the record of a newsletter consent separately, as described in section 8. The following sections apply to the game and session data of the adventure itself.

8. Newsletter

When you sign up for the public test, you can also subscribe to our newsletter with a separate tick box. In it, we tell you by email about new stories, new cities and offers from TaleAlley. The tick box is not pre-selected. The newsletter is voluntary and not a condition of taking part in the test.

We only send you the newsletter once you have confirmed your subscription (double opt-in). The link in our confirmation email for the sign-up is all it takes. It confirms the sign-up and the newsletter together. After confirmation, we add your email address and first name to our newsletter contact list at Mailjet. We also send the newsletter through Mailjet, as described in section 5. The legal basis is your consent under Art. 6(1)(a) GDPR.

You can unsubscribe from the newsletter at any time, with the link in every newsletter or with a message to . This withdraws your consent with effect for the future. Your participation in the test is not affected.

As proof of your consent, we store your email address, the language, the times of subscription and confirmation and the fact that you subscribed when signing up for the public test. We keep this record separately from the test sign-up data. The record and the entry in the contact list are kept for as long as you receive the newsletter and afterwards only for as long as we need to prove the consent. The legal basis for the record is our legitimate interest in being able to prove the consent under Art. 6(1)(f) GDPR.

9. Participation without a permanent user account

You do not need a permanent user account with a password for TaleAlley. A freely chosen player name is enough. You do not need to use your real name. The app processes a player identifier, age group, team and event assignment and the information needed for the game session. For age checks we use age groups (under 13, 13–15, 16–17 and 18 and over). A full date of birth is not intended to be stored permanently. Children under 13 take part without their own TaleAlley player on the device of an accompanying adult.

10. Gameplay, team and session data

During an ongoing adventure, the following data may be processed: player identifier and chosen player name, event and team assignment, role and game mode, start and end of play, mission progress, answers, results, clues, tool and collected-item status, score, and technical session and synchronisation data. This data is necessary for the shared game mechanics, recovery after interruptions and protection against unauthorised actions. The legal basis is generally Art. 6(1)(b) GDPR. For additional security processes, Art. 6(1)(f) GDPR may apply.

After the final end of play, a technically limited recovery period of no more than 168 hours (seven days) is provided. If the designated devices have verifiably saved the completion data earlier, server gameplay data can be cleared earlier. Purchase and billing records, separate consent records and code status data kept for a limited time for security reasons are separate from this.

11. Content that remains on your device

After completion, your personal score and the unlocked knowledge with text, images and audio can remain on your device, and a more detailed summary of the story with selected images if the story has one. A complete archive of all missions, collected items, videos or AI conversations is not created. The app also uses protected local storage for session and recovery data. Local content can remain on your device until the app is removed. After local data has been deleted and the server session has been cleared, recovery may no longer be possible.

12. Location processing for adult participants

During active use, adult players can allow TaleAlley to access the device location. It is used for orientation, location-based missions, location checks, team presence and certain tools. Current coordinates, accuracy and timestamps may be sent to our server temporarily. We do not create a permanent movement profile and do not use continuous background location. Location-related gameplay data is removed with gameplay cleanup, unless separate records required by law are concerned.

Processing the location data needed for location-based play generally serves to provide the requested game functions (Art. 6(1)(b) GDPR). You can change the device permission in the operating system. Without suitable location data, some game functions may not be available or only to a limited extent.

13. Minors and location anchor

Individual players under 18 do not share their own device location with TaleAlley. Map, search and route functions based on their own location and the AI walkie-talkie are blocked on their devices. Location-based missions use the suitable position of an adult team member. Only necessary derived game values such as “destination reached”, direction or distance are provided on the minor's device. The adult's raw coordinates are not meant to be transmitted.

Minors are not offered newsletter, personalised advertising or photo publication features. The necessary game processing and the legal basis for participation approval are also explained in an age-appropriate way.

14. Maps and routes through Mapbox

When adult players use maps, place search and walking routes, we use Mapbox Maps, Search Box and Directions according to the current app design. Map requests, search terms, language and country information, IP address, device information, random session and billing identifiers and, for the relevant functions, start, destination or nearby coordinates may be transmitted. The processing serves to provide the map and route functions you use. Mapbox may process certain telemetry under its own responsibility. This Mapbox telemetry is switched off when you first start the app. You can switch it on in the app settings under Privacy and switch it off there again at any time. Even with telemetry switched off, the app sends Mapbox the requests required for a map, search or route function you use. The provider's information on retention periods and international processing is set out in Mapbox's current documentation.

15. Camera and optional help photos

The UV lamp, infrared and echo scanner game tools use a local live camera image. It is used for the simulation and is not uploaded to our servers as a photo or video by these tools. The directional microphone game tool uses prepared audio tracks and does not record your voice.

To report a blocked or inaccessible mission location, you can voluntarily take a help photo and send it to us. It is used only to assess and handle the report, not for AI analysis or a public gallery. Where possible, please do not photograph other people, recognisable vehicle number plates or other unnecessary personal information. The photo is deleted after handling, no later than 14 days. The legal basis for handling reports is generally Art. 6(1)(f) GDPR.

16. Optional AI walkie-talkie and ElevenLabs

The AI walkie-talkie is available only to adult players. Its use is optional. Prepared messages are available without AI. Microphone permission is requested only after you actively choose the AI contact. For the voice feature, your spoken input and the necessary story and mission context are transmitted to ElevenLabs. The context may include technical player and session identifiers, language, mission information and a limited history of the previous conversation. Personal information you say voluntarily may also be transmitted. Please do not mention unnecessary or confidential personal data.

ElevenLabs uses further model and technical transport services for the voice answers. According to the most recently documented setup, OpenAI is the primary model provider and, depending on the configuration, Google or Anthropic are possible fallback models. Live audio is transmitted technically through WebRTC/LiveKit. Which subprocessors and third-country transfers are used under the actual production contract depends on the actual configuration and the applicable provider documentation. A data processing agreement under Art. 28 GDPR is in place with ElevenLabs and also includes EU standard contractual clauses for transfers to third countries. In our ElevenLabs account we have opted out of the use of our data for training ElevenLabs models. TaleAlley itself does not train any AI models with your data.

TaleAlley does not itself create permanently stored raw audio recordings of these AI conversations in Supabase. Necessary transcripts, answers, session identifiers and timestamps are processed for the ongoing game session and cleared with its gameplay data. For the most recently documented ElevenLabs contacts, recording of new audio was disabled and conversation retention was set to zero days. This means scheduled deletion after the conversation, not a technically guaranteed immediate deletion of all transcripts, metadata or backups. According to the most recently checked configuration, the separate “Zero Retention Mode” is not enabled. Processing by the provider is subject to its actual contractual, retention and transfer terms. When we receive a privacy request, we check existing TaleAlley data and, where necessary, the deletion and access options available with the provider.

If you think an AI answer is wrong or inappropriate, you can report it to us in the walkie-talkie with “Report answer”. We then store the reported answer text, story, mission, radio contact, language and time, the team and event association, the pseudonymous player identifier and session and conversation identifiers. We do not store your own spoken words for this. We review every report to detect errors in the AI role and improve it. We are notified of new reports by email to . This notice contains no information about players. After our review, and no later than 90 days after the report, we remove the link to the player, team, event, session, conversation and radio contact. The reported answer text, story, mission, language, review status and dates then remain stored as anonymous data without a time limit so that we can improve the walkie-talkie. The legal basis is our legitimate interest in accurate and appropriate AI answers under Art. 6(1)(f) GDPR.

17. Parental approval

Individual TaleAlley players aged 13 to 17 need approval for the specific adventure, event and participant place before taking part. This is given through a secure, shareable link. With a single checkbox there, the person with parental responsibility also confirms that they will accompany the minor themselves or have entrusted a suitable adult with supervision during the adventure. For the approval we generally collect neither the name nor the email address of the person with parental responsibility, nor any information about the accompanying adult. The necessary participant and event associations, age group, approval status and time, text versions and hashed secret link values are processed. The minor's full date of birth is not stored.

Approval can be withdrawn through the management link provided for this until the actual start of play. The introduction does not count as the start. Participation approval is not general GDPR consent for optional features. To document participation approval, a record limited to the necessary information may be kept separately from gameplay data. The current retention model provides three years from the end of the calendar year of the adventure concerned.

18. Optional Hall of Fame and group photos

Teams can take part in the Hall of Fame voluntarily after the game. The adult team lead makes this decision. Choices about the app entry, an optional group photo and additional website publication are requested separately. The team name, score, city, adventure name and, with separate approval, a group photo can be published. Public photos of people require the necessary rights and consent of everyone recognisable. Minors must not appear in such photos. Group photo publication is not available for teams with minor players or for school events.

Publication ends no later than after twelve months or earlier after an effective withdrawal. Withdrawal can be declared through the settings provided or by email to . A necessary, data-minimised record of consent may be kept separately. The current model provides three years from the end of the calendar year in which publication or consent ends.

19. Rating and feedback after the game

After the game you can voluntarily rate the adventure from one to five stars and add a comment. We store the rating, the optional comment, platform, app version, language, story and date as well as the event association and pseudonymous team and player identifiers. Seven days after the rating, we remove the link to the team, player and event. The star rating, comment, platform, app version, language, story and date then remain stored as anonymous data without a time limit. We use them to improve TaleAlley. Please do not write names or other personal information in the comment. The legal basis is our legitimate interest in improving TaleAlley under Art. 6(1)(f) GDPR. If you also rate TaleAlley in the App Store or on Google Play, this happens directly with the respective provider under its terms.

20. Supabase, logs and security data

Supabase is used for the database, realtime synchronisation, storage and server functions. According to the current setup, the production project is located in eu-central-1 (Frankfurt am Main). The project region alone does not mean that all subprocessors or administrative provider processes take place exclusively in the EU. Support, error analysis and IT security produce technically necessary logs, which are processed for specific purposes and according to defined periods. External app crash and analytics SDKs such as Firebase Analytics, Crashlytics and Sentry are not integrated in the most recently checked version of the app.

After the end of play, a narrowly limited status entry remains for each access or purchase code. It only records whether the code was redeemed, expired or cancelled, with time and story, but no names or other information about people. This makes it possible to trace a later redemption, misuse or a refund, and lets the app explain why a code that was already used no longer works. The entry is deleted 400 days after its last change. Such records are different from a permanently stored movement or game history.

21. Recipients and possible transfers to third countries

Depending on the function, recipients include in particular Cloudflare, Pixel X, Mailjet, Paddle, Supabase, Mapbox, Cloudflare Turnstile for the public test sign-up and, when AI is actively used, ElevenLabs and its technical subprocessors. Paddle is generally itself responsible for its own checkout processing. Other providers may act as processors or independent controllers, depending on the processing. Processing outside the EU or EEA takes place only under the legal requirements that apply, in particular on the basis of an adequacy decision or appropriate safeguards such as EU standard contractual clauses, where applicable.

22. Retention at a glance

Personal data is deleted as soon as it is no longer needed for its purpose, unless legal obligations or legitimate interests in keeping records require longer storage. According to the documented concept, the following periods apply in particular to the main functions:
Gameplay and location data: cleared after confirmed saving, no later than seven days after the final end of play.
Help photos of blocked locations: after assessment, no later than 14 days.
Public Hall of Fame entries and photos: no longer than twelve months, earlier on withdrawal.

Minimal records of parental approval and Hall of Fame consent: currently planned period of three years from the end of the relevant calendar year.
Purchase and transaction data: as long as needed for the service, claims or statutory records.

Public test sign-ups: without confirmation after 48 hours, confirmed without a code 90 days after confirmation, with a code no later than three months after the code expires.
Newsletter and record of consent: as long as you receive the newsletter, then as long as we need to prove the consent.
Code status without personal data: 400 days after the last change.
Ratings after the game: link to team, player and event after seven days, then anonymous without a time limit.

Reports of AI answers: link to player, team, event, session, conversation and radio contact after review, no later than 90 days after the report, then anonymous without a time limit.
Providers' internal logs: according to each provider's documented provider and product periods.

23. Your rights and requests

Subject to the statutory conditions, you have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests. You can withdraw consent with effect for the future. Contact for this. An event code, player name and approximate time of play can help identify existing data. Please do not send unnecessary personal information.

You can lodge a complaint with the competent data protection supervisory authority, in particular the Hessian Commissioner for Data Protection and Freedom of Information, or another competent authority. We cannot restore data from our servers that has already been properly deleted or that is stored only locally.

24. Automated decisions and updates

TaleAlley does not make solely automated decisions that have legal or similarly significant effects on users. Role assignment, points and AI dialogues are part of the game. If we significantly change features, providers, data flows or legal bases, we will update this privacy policy accordingly.