Privacy Policy

Effective: 24 August 2026

This Privacy Policy explains how personal data and information stored in your browser are handled when you visit morrowcade.com or play a Morrowcade game, including Turn Order.

1. Controller

The controller responsible for Morrowcade is the operator identified in the Impressum (Legal Notice). The Impressum also contains the operator's contact details.

2. Hosting and access logs

Morrowcade is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. STRATO acts as a processor for the operator. According to STRATO, hosting data is processed in its data centres in Germany.

When you request a page, STRATO's hosting infrastructure receives technical information needed to deliver it. This can include your IP address, the requested page or file, the date and time of the request, the amount of data transferred, the referring page, browser information, operating-system information, and the response status.

This information may be recorded in server access or error logs. It is processed to deliver the website, maintain its security and stability, diagnose errors, and prevent misuse. The legal basis is Article 6(1)(f) GDPR. The legitimate interests are the secure and reliable operation of Morrowcade.

STRATO states that the hostname or IP address shown in its customer-accessible web logs is anonymised. STRATO makes logs from the previous six weeks available to the operator; older logs are not available to the operator. Log information may be retained separately for longer where a particular security incident must be investigated or retention is required by law.

3. Necessary session cookie

Turn Order sets a cookie named turn_order_session. It contains a random session identifier, not your name or email address. The associated server-side session is used to protect requests against forgery and to prevent the same browser session from adding the same puzzle result to the daily statistics more than once.

The cookie is restricted to /turnorder/, is not available to JavaScript, and is sent only in same-site requests. It expires when your browser session ends. Associated server-side session information is retained temporarily and removed through the server's expired-session cleanup process.

The contact form similarly sets morrowcade_contact_session, restricted to /contact/. Its server-side session holds random security tokens used for request-forgery protection, human verification, and replay prevention. This cookie also expires when your browser session ends.

This processing is based on Article 6(1)(f) GDPR. The legitimate interests are protecting the service, its contact form, and its daily statistics. These cookies are necessary to provide those functions and therefore do not require consent under section 25(2)(2) TDDDG.

4. Local game storage

Turn Order stores the state of each puzzle in your browser's local storage. This can include piece positions, move and undo history, restart actions, completion status, your first completed move count, and whether the result was submitted. This lets the one-attempt daily game continue after a reload and prevents undoing or restarting from erasing counted moves.

This information remains on your device until you clear the site's stored data in your browser. It is associated with a puzzle identifier and date. Morrowcade cannot read this information from other websites, and the operator cannot retrieve it directly from your device.

This storage is necessary to provide the daily game requested by the player and therefore does not require consent under section 25(2)(2) TDDDG.

5. Puzzle results and daily statistics

When you complete a puzzle, the game sends the puzzle date and your sequence of moves, undos, and restarts to the Morrowcade server. The server checks that the result is valid and calculates the counted moves.

The database does not retain your individual move sequence, IP address, session identifier, or an individual player profile as part of the statistics. It stores only aggregate values for each puzzle: the total number of accepted completions and the combined number of moves. These values are used to display the daily average and completion count.

The legal basis for processing a submitted result is Article 6(1)(f) GDPR. The legitimate interests are validating game results, preventing manipulation, and providing anonymous daily comparisons. Individual request information may also appear temporarily in the server logs described above.

6. Optimal-solution requests

If you choose to watch the optimal solution, the game sends your completed move sequence to the server so that the server can confirm the puzzle was solved before returning the solution. The sequence is not added to the database. The request may appear in the temporary server logs described above.

7. Sharing and clipboard access

The sharing feature creates result text in your browser and attempts to copy it to your clipboard only after you select the sharing option. Morrowcade does not send the share text to a social network or video platform. You decide where, whether, and with whom to share it.

8. Contact form

If you use the contact form, Morrowcade processes the email address, message, and any optional name and subject you provide. The information is sent to contact@morrowcade.com and retained in the STRATO-hosted mailbox only as long as needed to handle the enquiry and any reasonable follow-up, unless legal obligations require longer retention.

The form uses a locally hosted ALTCHA proof-of-work challenge, a hidden spam-trap field, timing checks, and server-side rate limits. ALTCHA makes no request to an external CAPTCHA provider. For rate limiting, the server creates a pseudonymous value from the requesting IP address using a secret HMAC key and records recent request times. The raw IP address is not written to the rate-limit record. Obsolete entries are removed automatically during subsequent form traffic.

Processing enquiries is based on Article 6(1)(f) GDPR and the legitimate interests in receiving and responding to correspondence and protecting the form from abuse. Where your message concerns steps requested before entering a contract, Article 6(1)(b) GDPR also applies. Information required by law may be retained under Article 6(1)(c) GDPR.

9. No advertising or tracking

Morrowcade currently uses no advertising networks, analytics services, tracking pixels, social-media plugins, external content embeds, or third-party content-delivery networks. It does not create advertising profiles or use automated decision-making.

10. Recipients

Technical data is available only where necessary to the operator and STRATO GmbH as the hosting provider acting on the operator's behalf. Data may also be disclosed where required by law or necessary to establish, exercise, or defend legal claims.

11. Your rights

Subject to the requirements of the GDPR, you may have the right to:

• request access to your personal data;
• request correction or deletion;
• request restriction of processing;
• receive data you provided in a portable format where applicable; and
• object to processing based on legitimate interests.

You can exercise these rights using the contact details in the Impressum (Legal Notice). Because Morrowcade does not create accounts or retain individual result records, the operator may have no way to associate aggregate game statistics with you. Information held only in your browser can be removed through your browser's site-data settings.

12. Right to complain

You have the right to lodge a complaint with a data-protection supervisory authority, particularly in the EU or EEA country of your residence, workplace, or the place of the alleged infringement. You may also contact the supervisory authority responsible for the operator.

13. Changes to this policy

This policy may be updated when Morrowcade's features, service providers, or legal obligations change. The current version and its effective date will remain available on this page.