The controller responsible for data processing on this website is:
TFB Tran Facility & Büroservice UG (haftungsbeschränkt), Bayreuther Straße 3, 10787 Berlin, Germany,
e-mail: info@godfuse.games.
Full details are in the legal notice.
We process personal data only where this is necessary to provide the website, the game and our services, or where you have consented. The legal bases are in particular Art. 6(1)(b) GDPR (contract), Art. 6(1)(f) GDPR (legitimate interest) and Art. 6(1)(a) GDPR (consent).
When you open the website, our hosting provider automatically records information in server log files (including IP address, date and time, the file requested and the browser type). This is technically necessary in order to provide the site securely and reliably (Art. 6(1)(f) GDPR).
Hosting provider: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. We have entered into a data processing agreement (DPA) with our hosting provider.
You can create an account for the full version. For this we store your e-mail address
and an optional display name of your choosing. Sign-in is passwordless: you receive a
single-use sign-in link by e-mail; it is valid for 15 minutes and can be used once.
To manage your session we set a single, technically necessary cookie:
gf_sid, lifetime 60 days, not readable by scripts (HttpOnly) and limited
to this website (SameSite = Lax). It holds no personal data, only a random session
identifier. We set no other cookies (Art. 6(1)(b) GDPR;
§ 25(2) no. 2 TDDDG). The legal basis for managing the account is performance
of the contract.
We use the payment provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland) to sell the full version. When you buy, you are taken to a payment page hosted by Stripe. The payment and billing details you enter there (including name, billing address and payment method) are processed directly by Stripe; we ourselves never receive complete payment details — only confirmation that a payment was made, along with your e-mail address so that the licence can be assigned.
__stripe_sid, __stripe_mid). These are set
only once you open the Stripe payment page — not on this website. For details see
Stripe’s cookie policy
and Stripe’s privacy policy.
The legal basis is Art. 6(1)(b) GDPR (performance of the contract). Retention of invoice data required by tax law is based on Art. 6(1)(c) GDPR. Stripe may process data in the United States; the transfer is covered by the EU Standard Contractual Clauses.
We use the service Brevo (Sendinblue GmbH / Brevo, Köpenicker Str. 126, 10179 Berlin, Germany) to send sign-in links and purchase-related e-mails. Your e-mail address is passed to Brevo so that delivery is possible. The legal basis is Art. 6(1)(b) GDPR. We have entered into a data processing agreement (DPA) with Brevo.
On the unlock and purchase page you can optionally tick a box allowing us to e-mail you when another part of the game is released. The box is not pre-ticked, and unlocking and buying the game work regardless — leaving it empty costs you nothing.
If you tick it, we store your e-mail address, the time of your consent and its origin (unlock or purchase). We use this data solely to tell you about new parts of the game. We do not pass it on to third parties, we do not advertise other companies' products, and we do not analyse how you play in order to do so.
Before you receive the first message, we send you an e-mail asking you to confirm your subscription (double opt-in). You are only added to the list after that click. If you do not confirm, we delete the entry.
The legal basis is your consent under Art. 6(1)(a) GDPR, together with § 7(2) of the German Act Against Unfair Competition (UWG). You may withdraw it at any time with effect for the future — via the unsubscribe link in every e-mail, or informally at info@godfuse.games. Withdrawal does not affect the lawfulness of processing carried out beforehand. We then remove your address from the list.
Delivery is handled by Brevo (see the previous section).
The home page embeds a trailer via YouTube in extended privacy mode
(youtube-nocookie.com). The video is loaded only after you click it. Before that,
no YouTube cookies are set and no data is sent to YouTube. By clicking you consent to the
embedding (Art. 6(1)(a) GDPR). Provider: Google Ireland Ltd., Dublin. This may involve a
transfer to Google LLC in the United States; Google is certified under the EU-US Data Privacy
Framework, and the EU Standard Contractual Clauses apply in addition. If you never click the
trailer, no transfer takes place.
In the challenge modes, the display name you chose is shown together with your score on a public leaderboard. You decide which name to use; we recommend not using your real name. The entry also records the score, the level reached, the mode, the duration of the run and whether touch controls were used.
After a run you can share your result. The buttons for WhatsApp, Telegram, X, Facebook and Reddit are plain links: no scripts, widgets or tracking pixels from these providers are loaded, and nothing is sent to them unless you click. Only when you click does the provider’s page open, and that provider then receives your IP address — as it would with any page you open. Their own privacy policies apply. The legal basis is your consent, given by clicking (Art. 6(1)(a) GDPR).
If you use your operating system’s own share dialog instead, nothing leaves your device until you pick a destination there.
The game stores your progress and settings locally in your browser (LocalStorage). Without an account these data stay entirely on your device and are not transmitted to us. Stored are your progress, settings, personal bests, the snapshot of a run in progress and — while you are signed in — your e-mail address, so the game still starts without an internet connection for up to 30 days.
So that the game works offline and starts faster, it also caches itself completely in your browser (service worker, around 3 MB). These are program files only, with no personal data in them.
Both are necessary for the game to work at all and therefore require no consent under § 25(2) no. 2 TDDDG, the German implementation of the ePrivacy rules. You can delete this data at any time in your browser settings — progress that is not linked to an account will be lost.
When you are signed in, your game progress is additionally synchronised with our server so that it is available on more than one device. Only game state is transmitted: cores, workshop levels, oaths, unlocked content, masteries, worlds seen, trials passed, personal bests, the number of runs played, and which in-game explanations you have already been shown. None of this describes you as a person — it describes the state of your game. Synchronisation happens at start-up, after each run and when you close the page. The legal basis is Art. 6(1)(b) GDPR (performance of the contract). If you delete your account, this saved progress is deleted with it.
We keep personal data only as long as it is needed for the purpose concerned, or as long as the law requires:
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw any consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Providing your e-mail address is neither required by law nor by contract — but without an account you cannot unlock the game or take part in the leaderboards.
Contact for data protection enquiries: info@godfuse.games
This policy is current as of August 2026. We will update it if the legal situation or our processing changes.