PRIVACY POLICY

1. Introduction

This Privacy Policy informs you about the nature, scope, and purpose of the processing of personal data by The Adventure Foundry (hereinafter "we", "us", or "our") in connection with our website and the early access waitlist service for Adventure Hunt.

2. Data Controller

The data controller for data processing is:

Matthias Berger, sole proprietorship (Einzelunternehmen)
Niederheischbach 34
4652 Steinerkirchen an der Traun
Austria

Email: [email protected] or via the contact form on this website.

3. Data Collected

We collect and process the following personal data:

• Email address (required for waitlist registration)
• Name (optional, if provided)

3.1. Email Confirmation

To ensure the quality of registrations and GDPR compliance, we use a double opt-in procedure. After registration, you will receive an email with a confirmation link. Your registration will only be activated after you confirm your email address. Unconfirmed registrations are automatically deleted after 7 days.

4. Legal Basis

The processing of your personal data is based on:

• Art. 6(1)(b) GDPR (Contractual measures): The processing is necessary for the performance of pre-contractual measures taken at your request (registration for the early access waitlist).
• Art. 6(1)(f) GDPR (Legitimate interest): The processing is necessary for the purposes of our legitimate interests in managing the waitlist and communicating regarding the early access program.

You have the right to object to the processing of your data pursuant to Art. 21 GDPR. In such case, we will stop processing unless we can demonstrate compelling legitimate grounds for the processing.

5. Purpose of Data Processing

Your data is used exclusively for the following purposes:

• Management of the early access waitlist
• Notification about the availability of Adventure Hunt
• Communication regarding the early access program

6. Data Retention and Deletion

Your personal data will only be stored for as long as necessary to fulfill the stated purposes. Data from the early access waitlist will be deleted:

• upon completion of the early access program, or
• upon your request (right to erasure pursuant to Art. 17 GDPR).

You can request deletion of your data at any time, provided there are no legal retention obligations.

7. Data Sharing and Third-Party Data Processing

We do not share your personal data with third parties unless:

• Sharing is necessary to fulfill legal obligations
• Sharing is necessary to enforce our rights

7.1. Use of Firebase (Google Cloud)

For storing and managing the early access waitlist, we use Firebase Firestore, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).

Google Ireland Limited processes your data as a data processor pursuant to Art. 28 GDPR. The processing is based on a data processing agreement that meets the requirements of the GDPR.

Your data is stored in Firebase Firestore. Data transfers to countries outside the European Economic Area (EEA) may occur. In such cases, we ensure that adequate safeguards pursuant to Art. 46 GDPR are in place, in particular through the use of standard contractual clauses of the European Commission.

For more information on Google's data processing, please refer to Google's Privacy Policy.

7.2. Use of Mailgun

For sending confirmation emails, we use Mailgun, an email delivery service provided by Mailgun Technologies, Inc. (548 Market St, #43099, San Francisco, CA 94104-5401, USA).

Mailgun processes your email address solely for the purpose of sending the confirmation email. The processing is based on a data processing agreement pursuant to Art. 28 GDPR.

Your email address is processed by Mailgun to send the confirmation email. Data transfers to countries outside the European Economic Area (EEA) may occur. In such cases, we ensure that adequate safeguards pursuant to Art. 46 GDPR are in place.

For more information on Mailgun's data processing, please refer to Mailgun's Privacy Policy.

7.3. Use of Umami Analytics

For analyzing website usage, we use Umami Analytics, a privacy-focused, cookie-free analytics service.

Umami Analytics records page views (e.g., the page visited, the referring website, browser type, device type, country) and a few events on this website: clicks on the store buttons, automatic redirects to the App Store or Google Play, and visits through campaign links. For these events we store the platform, the position of the button, the language, the device type and, if present, the source, medium and name of the campaign from the link.

Umami groups related views under an anonymous session identifier. It is derived from properties of the request (including the IP address and browser identification) combined with a random value that changes every month. Your IP address is only processed briefly and is not stored. We do not store any identifier on your device, neither in cookies nor in localStorage. An identifier previously stored in localStorage for the early access signup is deleted on your next visit.

The processing is based on our legitimate interest in analyzing and improving our website pursuant to Art. 6(1)(f) GDPR.

For more information about Umami Analytics, please refer to Umami's Privacy Policy.

8. Your Rights

You have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): You can request information about your stored data
• Right to Rectification (Art. 16 GDPR): You can request correction of inaccurate data
• Right to Erasure (Art. 17 GDPR): You can request deletion of your data
• Right to Restriction of Processing (Art. 18 GDPR): You can request restriction of processing
• Data Portability (Art. 20 GDPR): You can receive your data in a structured format
• Right to Object (Art. 21 GDPR): You can object to the processing of your data

9. Contact

To exercise your rights or ask questions about data protection, please contact us via the contact form on this website.

Cookies and Analytics

Our website uses Umami Analytics, a privacy-focused web analytics service.

• Cookie-free: No cookies are set or used
• No identifier on your device: We do not store an identifier in localStorage or anywhere else in your browser
• Anonymized: No IP addresses are stored
• Evaluated: Page views, browser and device types, clicks on the store buttons and campaign links

Umami Analytics is used to understand how our website is used and to improve content. The processing is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR.

For more information, please refer to Umami's Privacy Policy.

Data Security

We implement technical and organizational measures to protect your personal data from unauthorized access, loss, or destruction. Data transmission is encrypted.

International Data Transfers

If your data is transferred to countries outside the European Economic Area, we ensure that adequate safeguards in accordance with GDPR are in place.

Changes to this Privacy Policy

We reserve the right to adapt this Privacy Policy to reflect changed legal situations or changes to our services. The current version is always available on this page.

Last updated: 19 October 2026

Supervisory Authorities

You have the right to file a complaint with the competent data protection supervisory authority:

• Austria: Austrian Data Protection Authority (DSB), Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at
• Germany: The competent state data protection authority (LfDI) in your federal state. An overview can be found at www.bfdi.bund.de

This Privacy Policy complies with the requirements of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG), and the German Federal Data Protection Act (BDSG).