Privacy

This privacy notice applies to the website siman.lol. In short: there are no user accounts, no cookies, no analytics, tracking or advertising services, and nothing is loaded from third parties unless you trigger it yourself (a click on a YouTube video or a link to YouTube). We only store what you enter on the leaderboard yourself or send us by email (sections 4 and 8); our server keeps no access logs (section 2).

This page is an English translation of our privacy notice in German, the Datenschutzerklärung.

1. Controller

Further details in the Impressum (legal notice, in German).

2. Hosting and server logs

The website runs on a server of our hosting provider dogado GmbH, Saarlandstraße 25, 44139 Dortmund, Germany (server location: Germany). Whenever a page is requested, the server and the upstream service (section 3) process technically necessary connection data: your IP address, the date and time, the requested address, the status code and the amount of data transferred, your browser’s identifier (user agent) and, where applicable, the previously visited page (referrer).

The purpose is to deliver the website, to keep it secure and to find errors; the legal basis is Art. 6(1)(f) GDPR (our legitimate interest in secure, functioning operation). Our server keeps no access logs. In individual cases, error messages of the web server may contain the IP address of the request concerned; our server’s logs are deleted after 14 days. A data processing agreement under Art. 28 GDPR is in place with the provider.

3. Cloudflare (DNS, delivery, protection against attacks)

For the domain siman.lol we use Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, for DNS, delivery (content delivery network) and a reverse proxy with protection against attacks. All requests to this website pass through Cloudflare; in doing so, Cloudflare processes the connection data listed in section 2, including your IP address. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in fast delivery that is protected against attacks). Cloudflare processes the data on our behalf (Art. 28 GDPR). Data may be transferred to the USA in the process: Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); in addition, Cloudflare’s data processing agreement includes the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

4. The leaderboard (“NOVACORE Damage Invoice”)

After clearing a level, you can choose to put your run on the public leaderboard (“Send the invoice”). Only then do we store:

• the name you enter for it (2–16 characters; please a nickname, not your real name),
• the run’s values: level, points, damage total, time, rank, tokens, accidents and whether Kernel was found,
• a random identifier that your browser creates for the run, so that a run sent twice only counts once,
• the time of the entry.

The leaderboard is a monthly ranking: each calendar month has its own leaderboard, and a new one begins on the 1st of every month at 00:00 UTC (01:00 in Germany, 02:00 during summer time). Only the current month’s entries are shown, with name and values, visible to all visitors.

Your IP address is not stored: to limit abuse, the server counts requests per sender only in memory, under a salted, irreversible hash of the address, which is discarded at the next restart at the latest. Without an entry, nothing is stored. The legal basis is Art. 6(1)(f) GDPR (running a voluntary, public leaderboard for a browser game).

Storage period: entries from earlier months are no longer shown, but kept so that questions about a placement, and abuse, can be checked. 90 days after the entry they are removed by the daily automatic deletion. Before every update of the website (and when needed) we make a backup copy of the database; it contains the entries as well and is deleted after 30 days, so an entry that has already been deleted may still be contained in a backup until then. Entering a name is voluntary; without it, the run is only stored in your browser. If you would like an entry removed sooner, write to [email protected] with the name, the level and the approximate date: as there are no accounts, this is the only way to match an entry to you.

The game works out a run’s values in your browser. The server checks them for plausibility and rejects obviously impossible values; it cannot prove that a run was played exactly that way. The leaderboard is a bit of fun, not a certificate.

5. The Club-Mate counter

The button in the SIMAN-OS terminal increases a counter shared by all visitors. Only the number is stored, nothing about you.

6. SIMAN-OS

The terminal on the home page runs entirely in your browser and answers according to fixed rules. What you type is neither sent to our server nor to third parties (such as an AI service), and it is not stored.

7. Storage in your browser

This website sets no cookies. In your browser’s local storage (localStorage) it keeps:

• siman-web:runs: your last 30 cleared runs on this device, so that you can see them even when the leaderboard cannot be reached;
• siman-web:name: the name you last entered, to fill in the field next time;
• siman-accidental-mayhem/v1: the game’s save (progress, best times, settings).

This data does not leave your device by itself; the only thing that goes to the server is a run you put on the leaderboard. It is required for the functions you use (Section 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). You can delete it here, or in your browser’s settings:

8. Contact by email

If you write to [email protected], we process your email address and the content of your message in order to deal with your request. The legal basis is Art. 6(1)(f) GDPR (answering your request); where it concerns your rights under section 11, it is Art. 6(1)(c) GDPR (our obligation to handle such requests). The mailbox is hosted by our email provider Hostinger International Ltd., 61 Lordou Vironos Street, Larnaca 6023, Cyprus, which stores the messages on our behalf (Art. 28 GDPR). We delete them once your request has been dealt with and no statutory retention obligation prevents this.

9. YouTube

The episodes are on YouTube. Links there open youtube.com in a new tab; only then does YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) process data, under its own privacy policy. The episodes’ preview images are on our server. If a video is embedded on the home page, it is loaded from youtube-nocookie.com only after you click it; until then, no connection to YouTube is made.

10. Fonts

All fonts are on our server. No connection is made to Google Fonts or any other font service.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21). To do so, contact [email protected]. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

There is no automated decision-making, including profiling (Art. 22 GDPR).

Last updated: 17 October 2026