Privacy

Last reviewed: 3 November 2026

Introduction

Protecting your personal data is important to me. I process personal data solely in accordance with the applicable legal requirements, in particular the GDPR, the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).

Controller

Thomas Zwicklhuber
Hauptstraße 43/3, 4542 Nußbach, Austria
Email: tom@medienmacher.biz

Contact requests by form, Cuby or email

If you contact me through the contact form, the direct-message option you deliberately select in the Cuby dialog or by email, I process your email address and message and any information you provide voluntarily, such as your name, company, area of interest and preferred project start, to handle and follow up your request. The rest of your Cuby conversation is not transmitted.
Requests sent through the form or Cuby are also stored internally as enquiries in the WordPress administration area and delivered by email. To handle them I add internal details there: processing status, reply date, priority, follow-up date, where applicable company, phone number and order value, and notes on the history. Enquiries reaching me by phone or email may be recorded there as well.
Depending on the channel, misuse prevention processes technical verification data such as a nonce, timestamp, signature, a short-lived single-use token and, for the contact form, a small calculation solved in your browser (proof of work, without cookies or third parties). A truncated, non-reversible hash derived from the IP address and user agent is used only to limit how often messages can be sent, is kept for at most 15 minutes and is not stored with the message. Only the page from which the message was sent is stored with it; for the contact page, the previous page on this website (in both cases without parameters). To check plausibility, a DNS lookup also verifies that the domain of your email address exists.
Legal bases: Article 6(1)(f) GDPR for replying to general messages and preventing misuse, and Article 6(1)(b) GDPR if you request pre-contractual steps. Separate consent is not required to reply to a message that you initiate.
Retention: contact requests, including these internal details, are normally deleted automatically after 12 months. If an enquiry leads to an order, it is kept for three years from receipt to document the pre-contractual steps and for warranty questions (Art. 6(1)(b) and (f) GDPR). Longer statutory retention obligations remain unaffected.

Cuby FAQ dialog and site search

Ordinary questions in the rule-based Cuby dialog are matched locally in your browser against the knowledge catalog loaded from this website. They are neither stored nor sent to an external AI service. If you deliberately use a search command such as “Search accessibility”, only that search term is sent to this website’s own WordPress search to find published pages, posts and games. The search term is not stored permanently; for misuse prevention, only a truncated, non-reversible technical hash is retained for no more than five minutes as a rate limit.
An optional “helpful” or “not helpful” rating permanently stores only the topic ID and increments an aggregate counter. The question, answer, chat history, IP address and user agent are not stored in the feedback statistics. A non-reversible technical hash is held briefly only as an abuse-prevention rate limit.
Legal basis: Article 6(1)(f) GDPR for providing voluntary navigation and preventing misuse. Cuby does not open automatically and loads its dialog module only after you activate it.

Website quick check by email

If you request the website quick check, I process your email address solely to deliver the requested PDF. The request is not stored as an enquiry in the WordPress administration area and does not trigger automatic follow-up advertising.
To prevent misuse, truncated, non-reversible hashes derived from the IP address and email address are processed for rate limiting for no longer than one hour. The theme does not separately store the delivery email or another copy of the PDF.
Legal bases: Article 6(1)(b) GDPR for fulfilling your request and Article 6(1)(f) GDPR for security and misuse prevention.

Online appointment booking

If you book an appointment through the scheduling tool, I process your name, email address, selected appointment, appointment status and duration, browser time zone and language setting, and the telephone number and message you may provide voluntarily. Random, non-guessable management tokens are stored for secure cancellation and rescheduling links. The information is stored in the WordPress administration area and used to administer the appointment, send confirmation or amendment emails and provide the attached calendar file (.ics). Name, email address, phone number, message and appointment are also added to my list of enquiries; the retention periods for contact requests apply there.
The legal basis is Article 6(1)(b) GDPR for handling your appointment request and taking pre-contractual steps. To prevent misuse, non-reversible hashes derived from the IP address and email address are used for rate limiting. These verification values are processed temporarily in WordPress transients only: failed attempts for up to 15 minutes, management lookups for up to ten minutes and successful booking or email limits for up to two hours. The raw IP address is not stored with the booking.
Recipients are the processors identified under “Hosting and server logs” and “Email delivery”. Past bookings that were not cancelled are deleted automatically 365 days after the appointment ends; cancelled bookings are deleted no later than 90 days after cancellation unless a statutory retention or evidentiary obligation requires longer storage.

Technically necessary browser storage

This website stores the following settings locally in your browser for reliable operation and to retain your choices:
localStorage: theme for light or dark mode; when optional analytics is configured, mm_cookie_consent for the decision, policy version and expiry; and the namespaces mmf-arena-*, mmf-rpg-*, mmf-cuby-*, mmf-jump-*, mmf-crossfire-* and mmf-tower-*. The browser games use these namespaces to store game state, progress, unlocked content, high scores, player name, language and graphics, audio, control and accessibility settings locally. Cuby World reads selected shared Cuby and Tower progress data to display the world map. The local key mmf-cuby-score-queue retains unsuccessful voluntary leaderboard submissions for a later retry, and mmf-reward retains a locally earned reward until it is redeemed. cdbg stores only a local game debug mode that you deliberately enable. Apart from a leaderboard submission that you initiate, this information remains on your device and no game account is created.
sessionStorage: mm_contact_scroll_y restores the scroll position after the contact form is submitted; mm_contact_prefill and mm_contact_prefill_scope hold contact-form details that you selected for pre-filling; and mm_paket_choice and mm_paket_scope pass your package choice to the contact form.
Cookies: mm_lang and mm_lang_manual store the language you explicitly selected for no longer than one year. mm_lang_prompt remembers for no longer than 180 days that the language notice was dismissed. mm_cuby_player contains a random, signed owner ID for voluntary Cuby leaderboard entries. This technically necessary, JavaScript-protected HttpOnly cookie remains valid for no longer than 400 days. It is set only in connection with the online leaderboard, is not used for audience measurement and is not disclosed to third parties. On app and game pages, mm_app_rating_id holds a random, signed browser ID so that a voluntary star rating counts only once per app (HttpOnly, up to two years). The app, stars, time and a non-reversible hash of this ID are stored. To prevent abuse, a non-reversible hash of the IP address and app is also kept as a counter for no longer than 24 hours.
The Zilaro demo at /zilaro-demo/ also sets mmade_demo_visitor (random visitor ID, up to two hours), mmade_cart_session (demo cart, up to 180 days), mmade_checkout_session (protection of the demo checkout, up to 30 minutes) and mmade_order_access (access to your own test order, up to seven days). All four are strictly necessary, HttpOnly and not used for advertising or audience measurement.
These entries do not contain advertising profiles and are not used for personalised advertising.
Legal basis: Article 6(1)(f) GDPR in conjunction with Section 165(3) TKG 2021.
Retention: the choice stored in mm_cookie_consent expires after no more than 180 days and is discarded earlier if the policy version or analytics configuration changes. Other localStorage entries remain until you delete them, reset the relevant game or a technical change replaces the storage format. sessionStorage expires at the end of the browser session. The exact cookie lifetimes are stated above.

Web analytics with Google Analytics (Site Kit)

With your consent, I use Google Analytics 4 to measure how this website is used so that I can improve its content and usability. The service is integrated through the WordPress plugin “Site Kit by Google”. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google processes the data as a processor under the Google Ads Data Processing Terms (Article 28 GDPR).
The legal basis is your consent under Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Without consent, this website does not load the Google script, sets no analytics cookies and makes no connection to Google. Advertising storage, advertising data, ad personalisation and Google Signals remain switched off through Google Consent Mode even after you consent.
The data processed includes in particular the pages viewed, time and duration of the visit, interactions such as scroll depth, reading time, link clicks or the successful submission of a contact or checklist form (without its content), referrer, approximate location (country, region, city), browser, operating system, device type, screen resolution and language, and a random client ID. Your IP address is transmitted to Google to provide the service and derive the approximate location; according to Google, Google Analytics 4 does not log or store IP addresses. I do not combine the analytics data with other data about you.
Cookies: after you consent, Google Analytics sets _ga (recognises your browser) and _ga_2GB28EV4X4 (session state), each with a lifetime of two years according to Google. Event data is deleted in Google Analytics after the configured retention period, no later than after 14 months.
Third-country transfers: Google may also transfer data to Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework; transfers are based on the European Commission’s adequacy decision (Article 45 GDPR) and additionally on standard contractual clauses (Article 46(2)(c) GDPR).
Withdrawal: your choice is stored for no more than 180 days. You may withdraw consent at any time with effect for the future through the “Cookies” link in the footer; the Google Analytics cookies of this website are then deleted and no further data is sent to Google. More on Google’s data processing: policies.google.com/privacy.

Newsletter

If you optionally subscribe to the newsletter through the checklist form, your email address and language preference are stored for newsletter delivery on the basis of your consent under Article 6(1)(a) GDPR.
Registration uses double opt-in. After submitting the form, you receive a confirmation email and the subscription becomes active only after you follow its confirmation link.
Newsletter registrations are initially stored locally in WordPress. Unconfirmed registrations are deleted after seven days. After confirmation, the email address, language, source and confirmation time may be synchronised with Brevo. The provider is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. Brevo may be used as a processor only after an agreement under Article 28 GDPR has been concluded and the service has been configured accordingly.
You may unsubscribe at any time through the link included in each issue or by sending me an informal message. After unsubscribing, the record is removed locally and from Brevo, and the local status is deleted completely no later than after 30 days.

Email delivery

Contact, delivery and confirmation emails are sent through the WordPress wp_mail() function and the SMTP connection configured on the production system. The SMTP processor is IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The data processed includes the recipient address, sender, subject, content and, where applicable, the PDF attachment.
Email content, attachments, opening data and click data must not be logged in WP Mail SMTP. A technically necessary delivery status without content or interaction tracking is sufficient for error analysis.

Browser-game leaderboards

After a game on the Apps page, you may voluntarily submit a player name of your choice to a public leaderboard. The submitted name, relevant game values, submission time and a randomly generated pseudonymous owner ID are stored. A short public tag is derived from the owner ID so identical player names can be distinguished. The internal owner ID and its signature are not published, and no IP address, email address or account data is stored with an entry.
The owner ID prevents third parties from overwriting an existing entry merely by reusing the visible player name. It is held in a signed HttpOnly cookie on your device and is not evaluated outside the browser-game leaderboards. If you delete this cookie or change browsers, the server can no longer identify an earlier entry as yours; recovery is not possible without an account.
A temporary technical verification token and strict origin checking are also used to prevent misuse. The number of entries per hour is limited using a truncated IP-address hash. This hash is held transiently for no more than one hour and is not linked to the leaderboard entry.
Legal bases: Article 6(1)(a) GDPR for the voluntary entry and Article 6(1)(f) GDPR for misuse prevention.
Retention: each leaderboard holds no more than the 150 best entries and automatically deletes lower-ranked entries. The owner cookie expires no later than 400 days after it was last renewed. I will remove your entry at any time upon an informal request that identifies the player name and public short tag; see the contact details above.

Voluntary support through PayPal

The Apps page links to an external PayPal payment page for voluntary support of my free browser games. Unless you follow this link, this website does not transmit payment data to PayPal and does not load PayPal cookies or scripts.
When you open the PayPal link, you leave this website. PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg is independently responsible for payment processing. PayPal may process account, contact, transaction, device, security and payment data in particular to provide the payment, prevent fraud and comply with legal obligations.
I receive only the payment information required to allocate and document the voluntary support for accounting purposes, such as the name or PayPal display, amount, currency, time, transaction reference and, where applicable, email address. I do not use this data for advertising or newsletters.
Legal bases: Article 6(1)(b) GDPR for processing the payment you initiated, Article 6(1)(c) GDPR for tax and business-law retention duties, and Article 6(1)(f) GDPR for documentation, accounting and misuse prevention.
Retention: I retain payment and accounting records to the extent required by law. Details of PayPal’s processing are provided in the PayPal Privacy Statement.

Zilaro demo

At /zilaro-demo/ you can try the Zilaro shop system. You do not enter your own contact details in the demo: checkout and withdrawal form use fixed, made-up buyer details and an undeliverable sample address. The demo stores the generated test orders, test invoices, withdrawal receipts and the related demo emails, linked to the random visitor ID in the mmade_demo_visitor cookie so that only your browser sees your test orders and emails. No emails are sent, no payments are triggered and no data is passed to payment providers. There is no customer account and no back-office access in the demo.
The legal basis is Article 6(1)(f) GDPR; the legitimate interest is demonstrating the product. All demo data is deleted completely after one hour at the latest.

Local fonts and assets

Fonts and icons used to display this website are served locally from its own server. Visiting the website does not request resources from Google Fonts CDNs or comparable external font services.

Hosting and server logs

This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany as a processor under Article 28 GDPR on the basis of a data processing agreement. When the website is accessed, technically necessary server logs containing the IP address, time, requested URL, transferred data volume, referrer and user agent are processed to maintain stability and security and analyse errors under Article 6(1)(f) GDPR.
Retention: server logs are normally deleted after 14 days unless longer retention is required to investigate a specific security incident.

Recipients

Personal data is disclosed to third parties only to the extent necessary to operate the website — in particular to IONOS SE as hosting and email processor, Brevo after a confirmed newsletter subscription and Google if you consent to web analytics — or where disclosure is required by law.
If you provide voluntary support through PayPal, PayPal is independently responsible for payment processing and may disclose data in accordance with its privacy statement, in particular to affiliated companies, service providers, financial institutions, authorities or other recipients.
Other recipients may include banks, tax advisers and authorities where necessary for accounting or a legal obligation.
PayPal and, if you consent to web analytics, Google may process data outside the EEA. The applicable safeguards depend on the actual agreement and provider information and may include adequacy decisions, an applicable EU-US Data Privacy Framework certification and standard contractual clauses. You may request information about the safeguards or a copy of the relevant provisions using the contact details above. No blanket assurance is given that third-country transfers never occur.

Your rights

Subject to the statutory requirements, you have the following rights:

• Access under Article 15 GDPR
• Rectification under Article 16 GDPR
• Erasure under Article 17 GDPR, unless a retention obligation applies
• Restriction of processing under Article 18 GDPR
• Data portability under Article 20 GDPR
• Withdrawal of consent under Article 7(3) GDPR
• Objection under Article 21 GDPR

You may lodge a complaint with the Austrian Data Protection Authority:
Barichgasse 40-42, 1030 Wien, Austria
dsb.gv.at