Privacy
Who processes your data
The controller is shopbox GmbH, Friedrich-List-Platz 1, 04103 Leipzig, Germany, represented by its managing director Paul Komoszki. Contact: info@cridoku.com; further details in the imprint.
Without an account
You can use the whole site without an account: play the daily case, take hints, check a culprit. We store nothing about you while you do.
When you open a page, our host processes the connection data needed to deliver it (IP address, time, address requested, browser identification) and to fend off attacks. The legal basis is our legitimate interest in a working service (Art. 6(1)(f) GDPR).
We embed no third-party services: no analytics, no advertising, no fonts from other servers, no social media widgets.
With an account
If you create an account we process your email address, a display name you choose, and your progress: which cases of Volume I you confirmed as solved, on which days you solved the daily case, and which awards you claimed.
The sole purpose is to show you that progress on every device. The legal basis is performance of the user relationship (Art. 6(1)(b) GDPR).
Signing in works without a password: you receive a one-time code by email. For the signed-in session we set one strictly necessary cookie. We set no others, which is why there is no cookie banner here.
Shared awards
If you claim an award and share its link, anyone with that link can see the name you put on it, what it was for, and the date. Your email address and the rest of your progress are not reachable through the link. You may put any word there instead of your real name.
Who processes the data for us
Hosting: Vercel Inc. Database and sign-in: Supabase, data centre Frankfurt am Main (AWS eu-central-1). Both process data on our behalf under data processing agreements. Vercel may involve transfers to the USA, covered by the EU standard contractual clauses.
How long
Account data stays until you delete the account. You can do that yourself at any time under “Account”, and progress and awards go with it. The host's server logs are deleted automatically after a short period.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Write to the address in the imprint. You may also complain to a data protection authority, for example the Saxon Data Protection Commissioner.