Privacy policy
1. Controller
The controller responsible for data processing on this website is Hendrik Reuter. Full details are given in the legal notice. Questions about data protection to: info@hendrikreuter.de
2. What is stored while you play
For a game to work, the server stores for each room the chosen playlist, the settings, the players’ names, their answers and points. You choose the name yourself; it does not have to be your real one.
A room is deleted together with all player data once it has not been used for 24 hours – or immediately when the host closes it.
The legal basis is providing the game you take part in (Art. 6(1)(b) GDPR) and the legitimate interest in running the game properly (Art. 6(1)(f) GDPR).
3. In your browser
While you play, your browser’s local storage (LocalStorage) holds an entry with the room ID, your player name and a random secret, so the game recognises you after a reload. The host’s browser correspondingly holds the room ID, a secret and the playlist name. These entries are removed when you leave the game or the room no longer exists; otherwise they remain until you clear the website data in your browser.
If the host has allowed Spotify, their browser remembers this in the entry musiquest:spotify-consent (only “yes”, see section 5). For the duration of the browser session it also stores, in the entry musiquest:playback-check, whether Spotify delivers full songs or only 30-second previews in this browser – so that a test song does not play on every visit; the entry disappears when the tab is closed. If you choose a language, the browser remembers it in the cookie mq_lang for one year; it only contains the language code. The game sets no other cookies; only the admin area uses a session cookie for the operator’s login.
These entries are strictly necessary for the game or the function you chose (Section 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act); no consent is required for them.
4. Protection against abuse
To ward off overload and abuse, the server counts requests per sender. For this, the IP address is not stored in plain text but only as a checksum (hash), and it is deleted after about an hour. The legal basis is the legitimate interest in secure operation (Art. 6(1)(f) GDPR).
5. Spotify
The music plays on the host’s device in an embedded Spotify player. It is only loaded once the host explicitly agrees (“Allow Spotify”). The browser then loads the player and its control script from open.spotify.com and other Spotify addresses. In the process, Spotify (Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden) receives the IP address and technical details of this device, and Spotify stores data in this browser. If the host is signed in to Spotify in this browser, Spotify can link the playback to their account. Spotify’s privacy policy applies.
The legal basis is consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). It is only remembered in this browser and can be withdrawn at any time with “Withdraw Spotify consent” at the bottom of the host screen. Spotify may also transfer data to service providers outside the EU; details are given in Spotify’s privacy policy.
The players’ phones do not load a Spotify player; covers and images are delivered by this server. Nobody needs an account with Spotify or any other service.
6. Song details
The operator retrieves titles, artists, release years and covers server-side in the admin area via the Spotify Web API. Your browser is not involved.
The operator also checks release years against the open music database MusicBrainz. Here too only the server asks; it sends song titles and artists, no data about you.
7. Audience measurement
The server counts which pages are visited and how many different visitors there are. No cookie is set, no third-party script is loaded and no IP address is stored.
For each page view the server stores: the page (without any room or game identifier) and its title, the time, the domain of the referring page, the device type, the browser with its major version, the operating system, campaign details from the address (utm_…) and the country, if the hosting provider supplies it. The full browser identifier is not stored.
A small script on this site reports how long a page was visible and a few marked interactions: clicks, submitting a form (without its content) or starting a player. It only runs while audience measurement is switched on, loads nothing from third parties and stores nothing on your device. The server also counts game events – room opened, player joined, game finished – without any reference to a person.
To tell a day’s visitors apart, the server forms a checksum (hash) from the IP address, the browser identifier and a random value generated fresh each day. The random value is deleted once the day is over; after that the checksum can no longer be linked to anyone. The individual records are deleted after 90 days; daily totals without any personal reference are kept. Visits to the admin area, prefetching and known bots are not counted.
The legal basis is the legitimate interest in understanding how the service is used and improving it (Art. 6(1)(f) GDPR).
8. Your rights
You have the right to access, rectification, erasure and restriction of the processing of your data, to data portability and to object, as well as the right to lodge a complaint with a data protection supervisory authority. Because player data is deleted anyway after 24 hours without activity, there is usually nothing left afterwards about which information could be given.