Datenschutzerklärung
Last updated 8 October 2026
Diese Seite ist auf Englisch verfasst. Verbindlich ist die englische Fassung.
1Who we are, and what this covers
LinkedIn or Interpol - The Game (the “Game”) is operated by Thebrainfox (“we”, “us”, “our”). Thebrainfox is the data controller for everything described here: it decides what is collected and why, and it answers for it.
This policy covers the website at linkedin-or-interpol.com and its subdomains, including the test domain, and the mobile applications for iOS and Android. It covers playing with or without an account, statistics and leaderboards, our own audience measurement, advertising and the consent banner, purchases and printed orders, the contact forms, and push notifications.
It does not cover what other companies do with your data on their own terms — the app stores when you buy through them, Stripe when it processes a card, Google, Apple or Cloudflare when they serve a request. Where those apply, we name them and link to their own policies.
Questions, requests and complaints about privacy go to [email protected], or through the contact page. We answer within 48 hours, and always within the 30 days the law allows.
2The short version
If you read nothing else, read this. Each line is expanded later in the chapter named after it.
- You can play the entire game without an account, and most people do (chapter 5).
- Playing without one stores a random identifier in your browser, plus counters: rounds, right and wrong answers, streaks. No name, no email, no IP address (chapter 5).
- An account is optional and exists to carry your progress between devices. It stores an email address and, if you choose a password, a password hash (chapter 6).
- The audience measurement is ours. It is on only after you accept statistics, it stores no IP address, and it is not Google Analytics (chapter 9).
- Advertising is served through a partner and only with your consent; refusing is as easy as accepting (chapter 10).
- If you personalise a printed item, the photo you upload is used to print it and nothing else, and it is deleted after the order is settled (chapter 15).
- You can see, export, correct or delete everything we hold about you. Deleting your account is a page in the app, not an email to write (chapter 19).
3The three rules we hold ourselves to
Collect what the game needs, and nothing that it does not. Judging an answer needs the answer; it does not need to know who gave it. Every field in our database should be explainable by pointing at a feature.
Keep it on our side of the fence. Your answers, your scores and your account stay between you, us and the small set of suppliers named in chapter 12. We do not sell personal data, and we do not share it for anyone else’s advertising.
Make leaving as easy as joining. Export and deletion are self-service, take effect at once, and are not hidden behind a support conversation.
4What we collect, and where it comes from
Everything below is collected either because you gave it to us, because you used a feature that cannot work without it, or because our servers record it to stay up. Nothing is bought from a data broker, and nothing is inferred about you behind your back.
- Your answers and scores. Which profile you were shown, whether you judged it LinkedIn or Interpol, whether you were right, and how long you took. Judged on the server, so the counters cannot be edited from the browser.
- A player identifier. A random value made by our server, kept in your browser’s local storage, sent with each answer. It is not derived from your device, your network or your name.
- Account details, if you make one. Your email address, a password hash if you set a password (scrypt, never the password itself), the date you signed up, and your sign-in method.
- Sign-in records. When you ask for a one-time link or a six-digit code, we store the code (hashed), its expiry and whether it was used; we keep a short record of the device family and browser that asked, so a suspicious sign-in can be spotted.
- Your profile entry, if you apply for one. The name, occupation and photograph you submit for the game’s own catalogue, and the email we answer you at.
- Order details, if you buy something. The offer bought, the amount, the currency, the market, the order identifier, the status, and — for printed items — the name, address and any personalisation you typed or uploaded.
- Contact messages. What you write to us, the address you give so we can answer, and the page you were on.
- Technical logs. Our servers keep request logs for security and capacity: the path requested, the response code, the time, and a salted hash of the IP address rather than the address itself. The salt is rotated, so the hash cannot be used to recognise a visitor across periods.
- Consent choices. What you accepted or refused on the banner, and when, so the banner does not ask twice and so we can prove the choice.
We do not collect special-category data (health, politics, religion, sexual orientation, trade-union membership), we do not ask for your date of birth, and we do not build advertising profiles of you.
5Playing without an account
The game is complete without signing in, and this is the path most players take. Every answer is judged and counted on our server, so the number in the game bar cannot be edited from the browser and stays the same in every tab. To attach those rounds to you without knowing who you are, the website keeps a random identifier in your browser’s local storage and sends it with each answer.
The database keeps one counter per player: rounds played, right answers, wrong answers, current streak, best streak, and the last time you played. The same record feeds the game bar, the statistics page, the leaderboards and, if you sign in later, your account.
That identifier is not your name, your email address or your IP address, and it is never shared with anyone. It is not a cookie that follows you to other sites: it is a value in local storage that only this site reads. Clearing your browser’s site data, or using another browser, starts a fresh player with a fresh count.
When you sign in or create an account, the rounds you played as a guest are added to that account and the anonymous counter is deleted. Nothing else is transferred.
6Accounts, and how you sign in
An account is what makes your progress follow you from one device to another. There are three ways in, and they collect slightly different things.
- Email and password. We store your email address and a scrypt hash of your password. The password never leaves your device in readable form, and we cannot recover it — only reset it.
- A one-time link or code. We email you a link and a six-digit code. Both are stored hashed with a short expiry, they work once, and the code is rate-limited so it cannot be guessed by trying.
- Google or Apple. You are sent to their sign-in page and come back with an identifier and, if you allow it, an email address. We receive no password and no access to your account with them. With Apple you may choose to hide your address, in which case we only ever see their relay address.
We do not run advertising profiles, we do not connect your account to social networks, and we do not read your contacts, photos or files. On mobile, the only permission we ask for is notifications, and only if you turn them on.
Your account is yours alone. If you believe someone else has access to it, change the password or ask us to sign you out everywhere; we will do it and tell you when it is done.
7The faces in the game
The profiles you judge come from photographs and names published in public sources, presented as a parody of a professional network and of a wanted notice. The point of the game is to show how little a face and an occupation tell you about a person, and it treats the people it shows with that in mind.
- We use publicly published photographs and the names attached to them in those sources. We add an occupation, which is illustrative and is part of the parody, not a claim about the real person.
- We do not publish addresses, contact details, employers’ internal information, or anything private. We do not use images of children, and we do not use images we have reason to believe were published without consent.
- We do not intend to embarrass, accuse or identify anyone. The Interpol edition is a joke about a fictional notice; it is not an accusation, and it is not a police record.
- If you are in the game and want out, write to us — or use the contact page — and say which profile. We remove it, and any scores already printed with it are regenerated without it. We do not ask you to prove who you are beyond the profile itself.
Removal requests from the person shown are always honoured, without an argument, usually the same day.
8Your photo, when you personalise a printed item
The customiser lets you put a photograph and some words on a card, and have that card printed on an item. This is the one place where you give us an image of a person, so it is worth being precise about it.
- Uploading. The photo is read in your browser to show you the preview. If you then order, it is uploaded and stored with the order so the item can be made.
- Using a game photograph. If you pick one of the game’s own photographs instead of uploading one, we store which profile it was, not a copy of the image.
- What it is used for. Making and delivering that order, and settling any problem with it (a reprint, a refund, a dispute). Nothing else: it is not used to train anything, not shown to anyone else, and never used in advertising.
- Who sees it. The print service that produces the item, and the carrier that delivers it, both of whom receive only what is needed to do their part.
- How long it stays. The uploaded file is deleted once the order is settled and the return window has passed. The order record keeps the fact of the order, the amounts and the shipping details that accounting requires.
- Other people in the photo. Only upload a photo you have the right to use. If somebody else is recognisable in it, that is your responsibility to have cleared — we cannot check a photograph for consent. A request from a person shown in an uploaded photo to have it removed is honoured: we delete the file and cancel or reprint the order.
9Purchases, and what payment providers see
Two kinds of thing can be bought: digital extras, which unlock in the game, and printed items, which are made and posted. The payment path differs, and so does what we receive.
- On the website. Payment is taken by Stripe. You enter your card on Stripe’s own form; it is never sent to our servers. We receive the outcome (paid, declined), the amount, the currency, the last four digits and the card brand, the country of the card, and an identifier we can use to match a payment if you ask us to look into one. We do not receive your full card number or its security code.
- In the mobile apps. Purchases go through Apple or Google. We receive a receipt or an entitlement token, and we ask their servers to confirm it when the app starts. We do not receive your name, address or payment details from them.
- Printed orders. We need a delivery name and address, an email address for the confirmation, and the personalisation you chose. Address and personalisation go to the printer and the carrier, and nowhere else.
- Invoices and accounting. The order record (amount, currency, tax, date, country) is kept because tax law requires it, for the period that law sets, and cannot be deleted early on request.
We never sell, rent or share your payment details, and we do not use them for anything but the purchase you made and the accounting that follows it.
10Our own audience measurement
We measure how the site is used with tools we wrote ourselves, running on our own servers. It is deliberately modest, and it is on only after you accept statistics.
- The IP address is never stored. Requests are counted using a salted hash that is rotated, so visitors cannot be followed across days.
- Nothing is measured before you accept: with statistics refused, no measurement request is sent at all.
- What we do count: pages seen, buttons used in aggregate, games started and finished, languages chosen, errors, and roughly which country a request came from (at country level, from the request, never finer).
- No advertising identifiers are set, no third-party analytics JavaScript runs, and no data leaves for an advertising network.
It exists to answer questions like “does the new rules page explain the game?” and “which languages need work?” — not to follow individuals. You can change your mind at any time from the consent banner, and refusing takes effect immediately and retroactively for future measurement.
11Advertising, and the consent banner
Advertising keeps the game free. It is served by a partner network, it runs only with your consent, and we keep it away from the parts of the product you pay for.
- With consent. The advertising partner may set identifiers and read them across sites to choose and measure ads. What they do is governed by their own policy, which the consent banner links to by name.
- Without consent. No advertising identifiers are set. Where we can, we show a contextual ad, chosen from the page’s subject rather than from a profile, or no ad at all.
- Paid extras. If you have bought “Remove ads”, the bundle that contains it, or the mobile equivalent, the advertising code does not load for your account at all.
- The banner. Accepting and refusing are equally easy and equally visible. Your choice is stored with its date so it can be honoured on your next visit, and so we can show that it was collected properly. Changing your mind is one click on any page.
Under European rules we rely on your consent for anything that stores or reads information on your device other than what is strictly necessary — which is the player identifier and your language choice, both of which exist to make the game work.
12Why we process it, and on what legal basis
Each purpose below is matched to a lawful basis. Where the basis is consent, you can withdraw it at any time; where it is a contract, the processing stops being possible only when the contract ends.
- To run the game and count your score — contract (the game you are playing in front of you).
- To create and secure an account, and to keep you signed in — contract, plus our legitimate interest in preventing fraud and takeover.
- To sell and deliver digital extras and printed items, including tax and accounting — contract, and legal obligation for the accounting.
- To print your item, which means passing your address and personalisation to the printer and carrier — contract.
- To send a one-time sign-in link or code — contract. These are transactional messages, not marketing.
- To answer your messages and removal requests — legitimate interest in supporting the people who write to us.
- To measure our own audience — consent.
- To show advertising, and to measure it — consent, when identifiers are involved.
- To keep the service up and safe: request logs, rate limits, abuse and fraud prevention, salted IP hashing — legitimate interest in a working, secure service, and in some cases legal obligation.
- To defend ourselves in a dispute — legitimate interest in establishing and exercising legal claims.
We do not rely on legitimate interest for advertising, for profiling, or for anything that would surprise you. Those rest on consent, and consent can be taken back.
13Who else is involved
We keep the number of suppliers small, and each of them is bound by a written agreement that limits them to doing what we ask. They are processors; we remain the controller.
- Hosting and network. The servers that run the game, and Cloudflare for the network in front of them (TLS, caching, bot filtering).
- Payments. Stripe for the website; Apple and Google for in-app purchases.
- Email. A transactional email provider that sends sign-in links, codes, order confirmations and shipping notices. It sees the address and the content of those messages, and nothing else.
- Print and delivery. The print service and the carrier, for printed orders only, each receiving only the delivery data it needs.
- Advertising. The advertising partner named in the consent banner, only when you accept advertising.
- Measurement. None. Our audience measurement is our own code on our own servers, which is exactly why it exists.
We do not sell personal data, we do not share it for anyone else’s advertising, and we do not disclose it except where the law obliges us to, or where it is necessary to protect someone’s safety. If we are ever required to hand data over, we will tell you unless we are forbidden to.
14Where your data lives, and transfers outside Europe
Our servers are in the European Union, and the database with your account and scores stays there.
Some suppliers are established outside the European Union — Apple, Google, Stripe and Cloudflare operate globally — so a transfer can happen when you use their part of the product. Where that happens, the transfer relies on a lawful mechanism: an adequacy decision by the European Commission, or the Commission’s Standard Contractual Clauses with a transfer impact assessment, together with additional safeguards where the law requires them.
The practical effect for you: your scores and account stay on European servers; a card payment or an in-app purchase necessarily touches a global payment network, under those networks’ own safeguards.
15How long we keep it
Nothing is kept “just in case”. Each category has a period, and it is enforced by the software rather than by good intentions.
- Anonymous player counters — as long as you keep playing from that browser; a stale counter that has not played for two years is deleted.
- Account details — while the account exists, and 30 days after deletion (see below), after which the record is gone.
- Deleted accounts — the account and its personal data are removed at once; a small tombstone with no personal data is kept for 30 days so an accidental deletion can be recognised and a repeat sign-up is not confused with a takeover.
- Sign-in codes and links — minutes: they expire unused, and the used ones are deleted when they expire.
- Scores and leaderboard entries — kept for the lifetime of the game, because that is what a leaderboard is. Once an account is deleted, its entries are anonymised so the boards stay coherent without the account.
- Orders and accounting — the period tax law requires (usually ten years for invoices), which is why an order cannot be erased on request while that period runs.
- Uploaded photos for printed items — deleted once the order is settled and the return window has closed.
- Contact messages — up to two years, so a second message can be read in the light of the first.
- Request and security logs — 90 days, then deleted; the salted IP hash cannot be reversed in any case.
- Consent records — as long as the choice is relied on, plus the period during which it may need to be demonstrated.
16Cookies, local storage, and the whole list
We use as little of this as we can get away with. There are three things stored in your browser and no more, and each one has a job.
- The player identifier (local storage) — a random value that keeps your score together without an account. Strictly necessary. It does not identify you and is not shared.
- Your language choice (local storage) — so the site does not ask again and you do not get served the wrong language.
- Your consent choice (local storage) — what you accepted or refused, and when, so the banner is not shown again and the choice can be honoured.
If you sign in, we also set one session cookie: an httpOnly, secure cookie holding a signed session that keeps you signed in. It carries no profile information, it is not readable by JavaScript on the page, and it disappears when it expires or when you sign out.
When you accept advertising, the advertising partner may set its own cookies and identifiers; those are its, governed by its policy, and they are not set at all if you refuse.
There is no cookie for statistics: our measurement does not need one. Refusing everything except what is strictly necessary leaves the game fully playable.
17How it is protected
Security is treated as a feature of the product rather than a policy paragraph. What is in place:
- Everything travels over TLS; the site is served with strict transport security, and only the certificate we installed is accepted.
- Passwords are stored as scrypt hashes with a per-account salt, never reversibly. Sign-in codes and links are stored hashed, expire quickly and work once.
- Sessions are httpOnly cookies, signed, and revoked on sign-out or password change. Signing out everywhere is available on request.
- The database is not reachable from the internet; the application server is the only thing that talks to it, over a private connection.
- Rate limits sit in front of the sign-in, contact, checkout and search endpoints, so guessing, mail-bombing and scraping are bounded.
- Administrative access is a separate credential with its own password, and the panel is not linked from the public site.
- IP addresses are stored only as salted hashes, so a database copy is not a list of visitors.
- Uploads for printed items are validated as images, size-limited, and stored outside the web root rather than in a public folder.
No system is perfect. If a breach ever affects you, we will tell you and the competent authority within the deadlines the law sets (72 hours for the authority), describe what happened in plain words, and say what to do about it.
18Children
The game is not directed at children under 13, and we do not knowingly collect their personal data. There is no account requirement, no chat, no user-to-user contact, and no place to publish anything: a child can play the entire game without giving us a single piece of personal data.
If you believe a child has created an account, write to us and we will delete it and the data with it. Where local law sets a higher age for consent to online services — 16 in some European countries — we treat the higher age as the one that applies.
19Your rights, and how to use them
You have rights over your data, and the useful part is how quickly you can use them: all of them are self-service or one email, and none of them require an argument.
- Access — see what we hold. The account page shows your profile details, sign-in methods and order history; a request to the address below produces a machine-readable export of everything else.
- Rectification — correct what is wrong. Details are editable on the account page; for anything else, write to us.
- Erasure — delete your account and your personal data from the account page, in one action, effective immediately. The narrow exceptions are named in chapter 16.
- Portability — receive your data in a structured, commonly used format, and ask us to send it to another controller where that is technically possible.
- Objection — object to processing based on legitimate interest; we stop unless we can show compelling grounds that override yours, and you can always object to direct marketing outright.
- Restriction — ask us to freeze processing while a disagreement about accuracy or lawfulness is resolved.
- Withdraw consent — for measurement and advertising, from the banner, at any time, with no penalty and no loss of any feature you paid for.
- Complain — to us first, so we can fix it, but you always have the right to go to your national supervisory authority (in France, the CNIL) without going through us first.
We answer within 30 days at the latest and usually within 48 hours. Requests are free. We may ask you to confirm control of the email address in question — nothing more, and never a copy of your identity papers.
20Deleting your account, exactly what happens
Deletion is a page, not a request. It is reached from the account page and takes one confirmation.
- Your account and its personal data are deleted at once: email address, password hash, sign-in methods, profile details, and any pending sign-in links or codes.
- Your scores and streaks are anonymised, so the leaderboards do not develop holes; they are no longer linked to you in any way.
- Active sessions end immediately, on every device, and you are signed out.
- What survives, and why: the order records accounting law requires, with the personal data reduced to what that law needs, and a tombstone record with no personal data that marks the deletion so it cannot be silently repeated or confused with a takeover.
- What cannot be undone: deleted is deleted. If you come back later with the same address, you start as a new player with an empty history.
If an order is in production or in transit, deletion still happens at once — we and the printer keep only what the delivery needs until it is delivered, then remove the rest with the order close-out.
21Changes to this policy
The date at the top is the date of the current version. When something material changes — a new purpose, a new category of recipient, a different retention period — we say so on this page and, for changes that affect accounts, in the game itself, either as a notice or by email.
We keep the previous versions, and we do not rewrite history: a change is a new version with a new date, not an edit of the old text. If a change needs consent, we ask for it rather than assume it.
22Contact
Thebrainfox — privacy: [email protected], or the contact page. If your request concerns a face in the game, say which profile and what you want done; that is enough.
If you are not satisfied with our answer, you can complain to your national supervisory authority. In France that is the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or cnil.fr.
23Definitions
- Personal data — anything that can be linked to a person, directly or indirectly. A random player identifier on its own is not, which is what makes anonymous play possible.
- Controller — the one who decides what happens and answers for it. That is us.
- Processor — a supplier acting on our instructions: the printer, the carrier, the mail provider, the payment processor.
- Legitimate interest — a lawful basis that requires us to have a real, present reason and to balance it against your rights. It never covers advertising here.
- Local storage — storage in your browser that only this site can read, as opposed to a cookie, which is sent with every request.
- Anonymisation — removing the link to a person so it cannot reasonably be restored — what happens to your scores when the account goes.