Privacy Policy

This privacy policy provides information about the nature, scope and purpose of the processing of personal data when visiting this website. There are no user accounts, no login, no contact form, no newsletter and no online shop. The website is financed through advertising. Cookies and comparable technologies are used for advertising purposes only with your consent; details are set out in Section 4.

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):

Simon Benjamin Kamp
Manfred-von-Richthofen-Straße 8
77654 Offenburg
Germany

E-mail: support@r6prep.com
Website: https://www.r6prep.com/

2. Hosting and Server Log Files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, on the Vercel Pro plan. In this respect, Vercel acts as a processor.

When the website is accessed, the host processes technically necessary access data (server log files) that the device's browser transmits automatically:

  • IP address,
  • date and time of access,
  • requested resource or URL,
  • transmitted referrer URL,
  • user agent (browser type and version, operating system).

This processing is carried out by the host (Vercel) and serves exclusively to deliver the website, ensure its technical operation and ensure the security of the infrastructure (e.g. defending against attacks). Static content and responses are cached only temporarily in Vercel's content delivery network. Server log files are not permanently stored or evaluated by the operator.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure, stable and functional operation of the website.

Protection against misuse. In order to protect the website's programming interfaces against automated misuse, the number of requests received from an IP address is limited. For this purpose the number of requests from an IP address within a period of one minute is counted; requests exceeding that limit are refused. This is carried out by the host (Vercel) as part of the delivery of the website. Only this counter is held, and only for the period stated; no request contents are stored, no profile is created and no evaluation across visits takes place. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the security and availability of the infrastructure and in protecting the counter described in Section 5 against manipulation.

A data processing agreement (DPA) exists with Vercel. Regarding the transfer to the USA, see Section 8.

3. Web Analytics (Vercel Web Analytics)

Vercel Web Analytics, a privacy-friendly, cookieless analytics procedure provided by Vercel Inc., is used to measure reach and usage.

Cookieless and without device access: Vercel Web Analytics does not set any cookies and does not write any information to localStorage, sessionStorage or any other storage on the device. Since no information is stored on or read from the device for this purpose, no consent under § 25(1) TDDDG is required for reach measurement. Consent is obtained separately for advertising cookies; see Section 4. Storage used by the website's own features is described separately in Section 5.

No permanent recognition: To distinguish visitors, Vercel uses a hash derived from the incoming request (according to Vercel, formed for example from characteristics such as IP address and user agent). This hash is valid for a single day only and is reset daily. Recognition across multiple days or across other websites is therefore not possible. No permanent (persistent) identifier is set, no cross-website tracking takes place, and no fingerprinting profile is created.

Data collected per page view: the page or URL accessed, referrer, coarse geographic assignment (country/region, derived from the IP address), device type, operating system, browser, timestamp, and aggregated counters.

IP address: The IP address is processed solely transiently – to form the hash described above, which is valid only on a daily basis, and for coarse geographic assignment – and is subsequently not stored as a raw IP. Under the GDPR, an IP address is personal data even when processed only briefly; this processing step is therefore documented transparently here.

Purpose: aggregated, privacy-friendly measurement of the reach and usage of the website.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in evaluating website usage; it prevails precisely because the procedure works cookielessly and is not aimed at identifying individual persons.

Storage period: The data is stored by Vercel in aggregated form. The retention period depends on Vercel's current terms for the plan in use.

4. Advertising (Google AdSense)

This website is financed through advertising and uses Google AdSense, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). In respect of the processing described in this section, Google acts as an independent controller for its own purposes and not as a processor of the operator.

Cookies and similar technologies. Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or to other websites. Google's use of advertising cookies enables Google and its partners to serve ads to users based on their visits to this site and/or other sites on the internet.

Ad technology partners. In addition to Google, further ad technology partners may be involved in delivering and measuring the ads shown here and may set cookies for this purpose. Which partners these are can be seen in the consent notice on this website before consent is given, and each can be accepted or rejected individually there. For each partner, the consent notice also contains a link to that partner's own data protection information, where you can find details of the processing carried out by that partner and, where offered, object to it. An overview of the ad technology partners available in Google's products is additionally available at https://support.google.com/adsense/answer/9012903. Independently of this, you can object to the use of cookies for personalised advertising by a large number of providers at https://www.aboutads.info or, within the EU, at https://www.youronlinechoices.eu.

Data processed. In this context, information such as the IP address, browser and device information, the pages accessed, the time of access and cookie identifiers may be processed in order to select, deliver, limit the frequency of and measure ads, and to detect invalid traffic and fraud.

Profiling. Where you consent to personalised advertising, your usage behaviour is analysed in order to display advertising matched to presumed interests. This constitutes profiling within the meaning of Art. 4(4) GDPR. It does not produce legal effects concerning you or similarly significantly affect you; no automated decision-making within the meaning of Art. 22 GDPR takes place.

Consent management. Consent is obtained by means of a consent management platform operated by Google and certified in accordance with the IAB Europe Transparency and Consent Framework. This stores your consent decision in your browser's local storage so that it can be given effect on subsequent visits. This storage is strictly necessary to implement your choice and does not itself require consent.

Legal basis. The storage of and access to information on your device takes place only with your consent pursuant to § 25(1) TDDDG. The subsequent processing of personal data for advertising purposes is based on your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future via the "Privacy settings" link in the footer of this website, and object to personalised advertising by the further means set out below. The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent up to that point.

Objecting to personalised advertising. Independently of the consent notice on this website, you may object to personalised advertising by Google at any time at https://www.google.com/settings/ads. You may also opt out of the use of cookies for personalised advertising by a range of third-party providers at https://www.aboutads.info or, within the EU, at https://www.youronlinechoices.eu.

Retention. The retention periods for the data processed by Google are determined by Google. Further information is available in Google's privacy policy at https://policies.google.com/privacy and at https://policies.google.com/technologies/partner-sites.

5. Site Features (Local Storage and Daily Play Counter)

Two features of this website store small amounts of information in your browser's local storage, and one of them additionally sends an anonymous signal to our server. The stored information itself remains on your device: it is not used to recognise you and is not combined with the reach measurement described in Section 3 or the advertising described in Section 4. No cookies are set for these purposes. With the sole exception of the anonymous daily count described below, nothing is transmitted to us or to any third party.

Daily game (Rainbowdle). When you play the daily operator puzzle, the operators you have guessed for the current day and your streak counter are stored under keys beginning with "operdle:v1:". Without this storage the game would restart from scratch on every page load and could not offer a streak at all. Progress from previous days is deleted automatically; only the current day is retained.

Daily play counter. The game page shows how many people have played and solved the current day's puzzle. For this purpose your browser sends at most two short messages to our server per day: one when you enter your first guess of the day, and one if you solve the puzzle. If you solve on your first guess, both are combined into a single message. The messages contain nothing but the words "played" and "solved".

A message contains no identifier, no name for your device, no cookie, no details of your guesses and no result beyond the fact that the puzzle was solved. It cannot be linked to you, to your other visits, or to the messages of any other visitor. On the server it increases one of two counters for the current day; only these two totals are stored, never individual messages. The totals are deleted automatically no later than 40 days after the day in question.

Whether a message is sent is determined solely from the game progress already stored on your device for the current day, as described above. No separate information is stored on your device for the counter, and your game progress itself is never transmitted.

As with every other access to this website, your IP address is transmitted to our host when this message is sent (see Section 2). It is not stored in connection with the counter, is not used to form an identifier, and is not passed on to the provider of the counter database (see Section 8).

Recently opened maps. When you open a map's site setups, the identifier of that map (for example "border") is stored under the key "r6prep:recent-maps:v1", at most the ten most recent. This is used solely to place the maps you last worked on at the front of the list on the start page. No timestamps, no page views and no other usage data are stored.

Legal basis. The storage of and access to this information is technically necessary in order to provide the functions you have expressly requested, and is therefore covered by Section 25(2) no. 2 TDDDG; no consent is required. No information is stored on or read from your device for the daily play counter itself. Insofar as the stored identifiers constitute personal data, the processing is based on Art. 6(1)(f) GDPR, the legitimate interest being the provision of the requested functions. For the daily play counter, the legitimate interest lies in showing players how many others took part in the same puzzle; the interest prevails precisely because the count is anonymous, is not aimed at identifying anyone, and stores nothing beyond two totals per day.

Deletion. You can delete this information at any time and without affecting the rest of the website by clearing the site data for this website in your browser settings. Doing so resets your streak and the list of recently opened maps; because the decision whether to send a message is taken on the basis of your stored game progress, clearing it during the day may cause your browser to be counted a second time. Totals that have already been counted cannot be attributed to an individual browser and therefore cannot be reversed individually.

6. Contact by E-mail

If you contact us by e-mail, for example to report an error in a setup, the data you provide (your e-mail address and the content of your message) is processed solely for the purpose of handling your enquiry. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in responding to enquiries addressed to us. Messages are deleted once the matter has been dealt with and no statutory retention obligations apply. Our e-mail is hosted by Heinlein Hosting GmbH (mailbox.org), Schwedter Straße 8/9A, 10119 Berlin, Germany, which acts as a processor on our behalf.

7. Minors

This website is not directed at children. Consent to the processing described in Section 4 may only be given by persons aged 16 or over. Where a user is under 16, such consent is only effective if given or authorised by the holder of parental responsibility.

8. Recipients and Transfer to Third Countries

The recipient or processor of the data described above is Vercel Inc., USA (hosting as well as web analytics). A data processing agreement (DPA) exists with Vercel.

The two daily totals of the play counter described in Section 5 are stored with Upstash, Inc., San Jose, California, USA, in a database located in the European Union (Frankfurt am Main). Upstash receives only the commands issued by our server to increase and to read these two counters. It receives no IP addresses, no user agents, no cookies and no other visitor data, and therefore does not process any personal data of visitors to this website. A data processing agreement (DPA) exists with Upstash; insofar as a transfer to a third country takes place, it is based on the European Commission's Standard Contractual Clauses.

Hosting in the USA involves a transfer of personal data to a third country. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework (DPF). The basis for the transfer is therefore the adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR). In addition, the transfer is based on the European Commission's Standard Contractual Clauses (SCCs).

A further recipient is Google Ireland Limited, Ireland, which acts as an independent controller. Data may in this context be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the transfer is therefore based on the adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR) and, in addition, on the European Commission's Standard Contractual Clauses.

9. Rights of the Data Subject

Within the scope of the statutory requirements, the following rights exist:

  • access to the processed data (Art. 15 GDPR),
  • rectification of inaccurate data (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • objection to the processing (Art. 21 GDPR), in particular to the processing based on Art. 6(1)(f) GDPR.

Where processing is based on consent (Section 4), you have the right to withdraw that consent at any time pursuant to Art. 7(3) GDPR.

To exercise these rights, a notification to the contact details listed in Section 1 is sufficient.

Insofar as the data processed in connection with hosting and reach measurement (Sections 2 and 3) does not permit us to identify you, we are not able to comply with requests for information, rectification, erasure, restriction or data portability in respect of that data (Art. 11(2) GDPR). We are not obliged to collect additional data solely in order to enable identification. Insofar as advertising data is processed by Google as an independent controller (Section 4), please address requests directly to Google.

In addition, there is a right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for the controller is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW)
Lautenschlagerstraße 20, 70173 Stuttgart

10. Data Security

The connection to this website is encrypted using TLS/HTTPS in order to protect the transmitted data against unauthorized access by third parties.

11. Currency and Amendment of this Privacy Policy

Version of 4 August 2026. This privacy policy is currently valid. Due to the further development of the website or changed legal or official requirements, it may become necessary to amend it. The current version published here applies in each case.