← gamescom 2026 guide

Privacy

Information under Art. 13 GDPR · Last updated 17 August 2026

This guide has no accounts, login or comment fields. Your saved list, itinerary, played marks and filters stay in your browser. If you voluntarily report a live queue, that queue session is sent to the guide's small backend and kept only as described below. Visitor numbers are counted in aggregate, without cookies.

Who is responsible

Haylee Schäfer, Wiesenstraße 7, 78112 St. Georgen, Germany · mail@inventivetalent.org. Full details are in the imprint.

What stays in your browser

The guide's main interface and ordinary saved data remain on your device. Saving an exhibitor, marking a game as played, building an itinerary or changing a filter writes to localStorage under these keys:

The saved, played, itinerary and preference entries are never transmitted to me or to anyone else. Queue data is the explicit exception: only when you use a queue-report button are the relevant fields from the queue entry sent. None of these entries is a cookie or is attached to ordinary page requests. Clearing this domain's site data deletes the local copies, and uninstalling the app or using private browsing has the same effect. I cannot read, restore or delete the local-only entries for you.

When you share your list, it is encoded into the part of the link after the #. Browsers never send that part to a server, so a shared list does not reach me, my host, or their logs — it travels only inside the link, to whoever you send it to. Opening someone else's link holds that incoming list in sessionStorage under gc2026.share.pending just long enough for you to accept or dismiss it, so a reload cannot lose the offer; unlike everything above, it is discarded the moment the tab closes.

To work in a hall with no reception, the guide also keeps a copy of itself — pages, styles, fonts, icons and the exhibitor data — in the browser's cache storage. That is the app, not information about you, and it is removed with the rest when you clear the site's data. Storing all of this is what makes the offline guide you asked for work at all, so under § 25 (2) TDDDG it needs no consent banner.

Optional live queue reports

If you choose “I'm in this queue”, the backend receives the exhibitor and game (or booth), a random resettable device UUID, the elapsed-time and people-ahead buckets you tapped, optional queue mechanics, and server timestamps. It receives outcomes such as entered, left or queue closed when you report them. It receives no name, account, precise location, contacts, saved list or itinerary. Reporting is entirely optional; reading the guide and its live aggregates does not create a queue session.

The random id keeps one device to one open session and makes basic throttling and moderation possible. It is not tied to an account, but a day of reports under one id can still sketch that device's movement through the show. You can reset it by clearing this site's data. Cloudflare uses the connection IP transiently for a loose flood limit; the guide does not store the IP with a report or in its queue database.

An active timer keeps running locally without reception. If you tap “I'm in” offline, the device stores the measured elapsed seconds and submits that one completion after connectivity returns. Stale people-ahead, mechanics and closure reports are never queued for later delivery.

The purpose is to give visitors current, crowd-sourced waiting information and protect it from obvious abuse. The legal basis is Art. 6 (1) (f) GDPR — the legitimate interests in operating this optional fan service securely and helping visitors make time-sensitive choices. Fixed coarse buckets, short retention, no account and an easily reset id limit the impact.

Optional feedback form

After the show the guide may show a card, and a footer link, offering a short feedback form. That form is hosted by Tally BV (Sint-Pietersnieuwstraat 11, 9000 Gent, Belgium), which states that it stores form data on servers within the European Union. It is a separate website with its own privacy policy, and it is reached only by tapping: opening the guide sends nothing to it, no script of theirs runs on these pages, and I receive no notification that you opened or submitted anything.

The link may carry a single query parameter, source, saying which door the form was opened from — the app, or a post somewhere. It is a fixed word I write into the link myself, identical for every visitor. The guide adds nothing to it at all: no saved list, no itinerary, no day plan, no queue device id, no language, and nothing read off your device.

The form asks for opinions, not identity: no name, no email address and no account, and answering it is entirely optional. Whatever you type is processed by Tally as my processor under a data processing agreement, and reaches me as an anonymous response. The legal basis for processing what you choose to write is Art. 6 (1) (a) GDPR — your consent, given by submitting the form. Dismissing the card stores a single local flag so you are not asked again; that flag stays in your browser like everything else under “What stays in your browser”.

Hosting and delivery

The site runs on Cloudflare Workers and is delivered over Cloudflare's network (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which serves the files and protects the site from attacks. Cloudflare is the only provider involved in delivering this site.

Serving a web page technically requires processing connection data: your IP address, the time of the request, the page requested, the referring page, and your browser's user agent and language. This happens for every website you visit and is stored briefly in server logs for delivery, security and error diagnosis. The legal basis is Art. 6 (1) (f) GDPR — my legitimate interest in providing a working, reasonably secure site. Cloudflare acts as a processor on my behalf under Art. 28 GDPR.

Your browser may additionally report failed connections to Cloudflare's network error logging endpoint (a.nel.cloudflare.com). Successful requests are not reported.

Visitor statistics

This site uses Cloudflare Web Analytics to count how many people visit. A small script is loaded from static.cloudflareinsights.com and reports a page view.

It is deliberately chosen because of what it does not do: it sets no cookies, writes nothing to your device, does not fingerprint you, does not build a profile, and cannot follow you to other websites. There is no persistent identifier — repeat visits are not linked to each other. What is recorded is aggregate and non-identifying: page visited, referring site, country (derived from the IP address, which is not stored for this purpose), broad device and browser type, screen size, and page load timings.

I use this only to see roughly how many people find the guide useful. I cannot see individual visitors, and no attempt is made to identify anyone. The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest is knowing whether the project is worth maintaining, and the impact on you is minimal because nothing is stored on your device and nothing identifies you. Because no information is stored in or read out of your terminal equipment for this, no consent banner is required under § 25 TDDDG. You can block the script with any content blocker and the guide will work exactly as before. Details are in Cloudflare's description of the service.

What this site does not do

Transfers outside the EU

Cloudflare is a US company and may process connection data outside the EU. It is certified under the EU–US Data Privacy Framework and additionally relies on the European Commission's Standard Contractual Clauses, which is the legal basis for these transfers under Art. 44 ff. GDPR.

The feedback form is the other way round: its provider is established in Belgium and states that it stores form data within the EU, so answering it does not itself involve a transfer to a third country.

Links to other sites

The guide links out to gamescom's official pages, exhibitor websites and similar. Following such a link takes you to a site with its own privacy policy, over which I have no influence.

How long data is kept

Server and security logs are retained by Cloudflare for a short period, typically a few days to a few weeks, and then deleted. Analytics data is aggregated and holds nothing that could identify you. Queue sessions, updates, closure votes and moderation event data are pruned within 24 hours. Before deletion they are condensed into hourly per-queue statistics — report counts and median waits, with no device id attached — which power the “yesterday” estimates shown when a queue has no current reports. Those statistics, queue-mechanics votes, device-id denylist entries and the moderation audit log are kept only through the show, after which the complete queue database is deleted. Data in your browser stays until you clear it.

Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object at any time to processing based on legitimate interest (Art. 21). To exercise any of these, write to mail@inventivetalent.org.

In practice there is a limit worth being honest about: queue reports carry only a random device id and the other server data is not tied to an identity. Unless you provide that id while it still exists, I usually have no way to locate records belonging to you, and may not be able to answer an access request beyond what is written on this page (Art. 11 GDPR).

You may also complain to a supervisory authority. The one responsible for me is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

Changes

If the site gains features that change any of this, this page is updated along with them. The date at the top shows the current version, and the full history is visible in the public repository.