Privacy Policy for “Decision Maker” in your browser

Last updated: 3 November 2026

This privacy policy applies to the free browser version of the game “Decision Maker” at decision.amapps.app (the “game”), in all its languages: French “Le Décideur”, Spanish “El Decisor”, Japanese “決断者” and German “Entscheider”. For the embedded version on itch.io, see section 9, which also states which sections do not apply to it or apply only with changes. The Mac app “Entscheider” (“Decision Maker”) is covered by the app’s own privacy policy, and the website amapps.app by the website’s privacy policy (in German).

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR), and service provider under § 5 of the German Digital Services Act (Digitale-Dienste-Gesetz – DDG), is:

Andreas Maier

Dürerstr. 14, 73547 Lorch, Germany

Email: support@amapps.app

2. No data protection officer

No data protection officer under Art. 37 GDPR has been appointed, because there is no legal obligation to do so (single individual, no large-scale processing of personal data). Please contact the controller above with any questions.

3. Key points in brief

• There is no registration, no user account and no sign-in. There are no purchases and no advertising.
• The site sets no cookies.
• The game stores your game in progress, your saved games, your high-score list and your settings only in your browser on your device (section 6). The game sends none of this to any server, not even to the controller. Only the chosen language becomes visible as part of the address (section 6).
• The site is hosted on GitHub Pages. The game engine, fonts, images and music all come from decision.amapps.app itself. When they are fetched, GitHub inevitably learns your IP address for technical reasons (section 4).
• For audience measurement, the controller uses Cloudflare Web Analytics, without cookies and without recognising individual visitors. It tells him how often the site is visited and in which languages the game is played (section 5). Apart from this measurement script, the site loads nothing from third-party servers.
• The game is also to be available embedded on itch.io; it has not been published there yet. There, itch.io is itself responsible for its site. The game stores data there only in your browser, and the controller does not count any visits there (section 9).
• The controller does not sell any data and does not create usage profiles.
• Where processing is based on legitimate interests, you can object to it at any time (section 15).

4. Visiting the site (GitHub Pages)

The game and all its files – game engine, fonts, images and music – are delivered by GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (part of Microsoft Corporation). The controller does not run a server of his own. The name decision.amapps.app is registered with Cloudflare only as a pointer to GitHub (DNS). Cloudflare is not involved when files are fetched; your browser gets them directly from GitHub.

• What GitHub learns: with every request, your IP address, the time, the requested file and the information your browser sends on its own, such as browser type, operating system, preferred languages and, where applicable, the page you came from. Saved games and settings are not part of this; only the chosen language appears in the requested address as /de/, /en/ …
• Logs: According to GitHub’s documentation on GitHub Pages, GitHub logs the IP address for security purposes when GitHub Pages sites are accessed. GitHub processes this access data under its own responsibility; the controller does not receive it. For delivery, GitHub uses service providers, including Fastly (USA). GitHub’s Privacy Statement applies.
• Purpose: delivering the game, stability and security.
• Legal basis: Art. 6(1)(f) GDPR; the legitimate interest lies in providing the free game reliably, securely and at low cost without the controller having to run his own server.
• Third country: GitHub is certified under the EU-U.S. Data Privacy Framework. The transfer is therefore based on the European Commission’s adequacy decision (Art. 45 GDPR).
• Retention: GitHub keeps its access logs according to its own rules; GitHub does not publicly state a fixed period.

5. Audience measurement (Cloudflare Web Analytics)

The controller would like to know whether the browser version is being played, and in which languages. For this, as on amapps.app, he uses Cloudflare Web Analytics, a service of Cloudflare, Inc. (USA).

• How: Each language page (/de/, /en/, /fr/, /es/, /ja/) loads a small measurement script from Cloudflare (static.cloudflareinsights.com) when it is opened. The script reports the visit to Cloudflare (cloudflareinsights.com). The start page, which only forwards you to the matching language page, does not contain it, and neither do the error page and the version on itch.io (section 9). If the address brings a move along (section 8), the language page does not load the measurement script at all. If you change the language in the game, the game changes the language part of the address without reloading (for example from /de/ to /fr/). The measurement script does not count this as a further visit. A reload, and your next visit via the start page, lead to the page of the chosen language; the script counts these visits. This shows which languages the game is played in.
• What is collected: The tool works without cookies and without recognising individual visitors. It sets no cookies, stores no identifier in your browser and creates no cross-device profiles. It collects the page visited, the approximate origin (country), the referring source (referrer), browser and operating system including their versions, the device type (computer, phone, tablet) and technical performance values that the script reads in the browser: how quickly the page loads and responds to input, whether the layout shifts and, in Chromium-based browsers, how much memory the page uses. It also names the element of the page concerned and, for input, whether it came from the keyboard or from a click or tap. The script removes the part of the address after “?” and after “#” before reporting. When the script is loaded and when it reports, Cloudflare also inevitably learns your IP address and the information your browser sends, for technical reasons.
• What the controller sees: only aggregated figures. He cannot recognise individual visitors in them. He uses the figures only to follow the number of visits and the languages played. There is no further analysis, no advertising and no sharing.
• Processor: Cloudflare processes the measurement data on behalf of the controller; the data processing agreement (Art. 28 GDPR) is part of Cloudflare’s terms. Cloudflare’s Privacy Policy applies.
• Legal basis: Art. 6(1)(f) GDPR; the legitimate interest lies in finding out, with a data-minimising tool without cookies, whether and in which languages the free browser version is used. You can object to the measurement at any time (section 15).
• Third country: Cloudflare is certified under the EU-U.S. Data Privacy Framework. The transfer is therefore based on the European Commission’s adequacy decision (Art. 45 GDPR).
• Retention: According to Cloudflare’s own information, Cloudflare keeps the individual reports in full for seven days and after that only in condensed form (around 10% of the data volume); the figures can be viewed for the previous six months. Cloudflare does not state there how long it keeps the IP address from fetching the script and from the report.
• Preventing it yourself: If your browser or a content blocker blocks the script from static.cloudflareinsights.com, no measurement takes place. The game still works.

6. Storage in your browser

So that you can carry on where you left off, the game stores a number of entries in your browser’s local storage (localStorage) for decision.amapps.app. These entries stay on your device. The game sends them to no server, and the controller has no access to them. Only the chosen language becomes visible as part of the address (see below). The entries contain no information about you as a person; the game has no input fields for names or other text.

The following is stored (the keys begin with flutter.entscheider.):

• The game in progress and the point where you are in it, so that your next visit continues there.
• Up to three saved games, if you create them.
• Your high-score list with the results of your games. Each game carries a random identifier for this, so that it appears in the list only once.
• The language you have chosen in the game.
• The radio settings: station, volume and, for each station, a starting time for its programme.
• Saved games set aside: If the game cannot read a stored game or the high-score list, for example because it comes from a newer version, it sets it aside unchanged instead of deleting it.
• One technical flag: a random identifier of the browser tab that is currently playing. That way, two open tabs do not overwrite each other’s game.

If you chose “Play anyway” on a small screen, your browser also remembers this under the key entscheider.web.trotzdem. That way the notice does not appear every time.

Persistent storage: So that the browser does not delete your saved games on its own, the game checks at every start whether the browser already keeps this site’s storage permanently. If not, it asks the browser to do so. The game asks Chrome, Edge and other Chromium-based browsers at every start; they decide this themselves without asking you. In other browsers, the game only asks when you choose “Save to file”, and at most once per visit; Firefox then shows you a prompt. Whether you agree is up to you. The game also works without it. The game does not store the browser’s answer.

If the browser does not store anything: If site data is blocked or the storage is full, the game still works. However, your game in progress is then lost as soon as you close or reload the page. The game tells you so once per visit to the page (“Unable to save”) and points you to “Save to file” (section 7). The “Saved games” panel also reports it if it cannot store a saved game. The game keeps the fact that the notice has already been shown only in its working memory, not in your browser.

Other checks in the browser: The page checks the width of the window, the size of the screen and the type of pointing device, so that it can show a notice on small screens before loading; this check stays in the browser. As long as the browser does not keep this site’s storage permanently, the game also checks whether it is running in a Chromium-based browser (only whether the navigator.userAgentData property exists, not its content), to decide when to ask for persistent storage; this, too, stays in the browser. Flutter, the framework the game is built with, also reads some details about the browser, operating system and touch support when the page loads (navigator.userAgent, navigator.platform, navigator.maxTouchPoints and navigator.vendor), in order to choose the right display and controls; this, too, stays in the browser. So that the game starts in your language, the start page reads the language you chose in the game from your browser or, if you have not chosen one, the list of your preferred languages. The language then becomes part of the address: the start page forwards you to /de/, /en/, /fr/, /es/ or /ja/. Your browser requests this address from GitHub (section 4), and the audience measurement records it (section 5).

Deletion: You remove all these entries by clearing the site data for decision.amapps.app in your browser. There is nothing to delete on the controller’s side. In a private window, the browser deletes the entries as soon as you close it. If you want to keep your saved games, save them to a file first (section 7).

Legal basis: The controller does not receive this data. Where it contains personal data at all, storing it serves to provide the game you are using (Art. 6(1)(b) GDPR).

Storing and reading information in your browser (§ 25 TDDDG): The game stores the entries listed above in your browser and reads them back; the start page reads the chosen language. The page also reads the window width, screen size, pointing device, language list and the browser and device details used for display, checks whether it is a Chromium-based browser and asks the browser whether it keeps this site’s storage permanently. This is strictly necessary for the game to provide the functions you expressly use: displaying the game in your browser, continuing your game, saved games, the high-score list, keeping unreadable saves, language, the radio, the small-screen notice, protecting your saved games from being deleted by the browser on its own, and protecting your game when several tabs are open (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

7. Backup file

Under “Saved games”, you can create a backup file with “Save to file”. For this, the game takes the game in progress directly as it currently holds it, not from your browser’s storage. This also works if the browser does not allow storing. Your browser creates the file on your device and stores it like a download, usually in the “Downloads” folder. It contains the game in progress and, as far as your browser allows them to be read, the saved games, the high-score list, any saved games set aside, the chosen language and the radio station and starting times, but neither the volume nor the technical flag. With “Load from file”, you choose such a file; the browser reads it only on your device. In both cases, nothing goes to a server. What you do with the file, for example whether you pass it on, is up to you.

8. Moving to another address

Should the game ever move to another address, it takes your saved games along. The old address reads them in your browser and passes them on in the last part of the new address, after the “#” character. Your browser does not send this part to the server when it fetches a page. If it begins with “umzug=”, the language pages of decision.amapps.app do not load the Cloudflare measurement script (section 5) at all; this visit is therefore not counted. The new address imports the saved games in your browser and removes this part from the address straight away. That way, neither a reload nor a bookmark carries it along. The technical flag and the volume are not passed on. If the data is too large, the old address only offers it as a file. If it has already been passed on once, the old address no longer forwards you on its own but offers both: the way to the new address and the file. The old address remembers in your browser that it has passed the data on. The old address keeps your saved games; you remove them there by clearing the old address’s site data.

9. Version on itch.io

The game is also to be available embedded on the itch.io platform. It has not been published there yet; until then, this section does not concern you. This section applies to that version. Sections 4 and 5 do not apply to it, and section 6 applies only with the differences stated here. The other sections apply here as well.

• Where the game runs: itch.io shows the game on its site in an embedded frame (iframe) from html-classic.itch.zone. itch.io delivers the game’s files; the controller does not run a server for this. Itch Corp., the operator of itch.io, is itself responsible for its site and for everything itch.io collects there itself. itch.io’s privacy policy applies. Itch Corp. is based in the USA; for transfers there, see section 12.
• No counting: This version contains no audience measurement and loads no Cloudflare measurement script. As long as you do not click a link or a button, the game makes no request to amapps.app or to Cloudflare.
• Storage in your browser: The game stores the same entries as in section 6 (the keys begin with flutter.entscheider.), but here in the local storage of html-classic.itch.zone. All games on itch.io share this storage. There, the game reads the content of its own entries only and writes and deletes only those. It only sees the names of the other entries in order to find its own among them; if another game changes an entry in another tab, the browser tells the game the name of that entry. The game only compares these names with its own and does not store them. Other games on itch.io can technically read, change or delete this game’s entries; they contain no information about you as a person (section 6). If you chose “Play anyway” on a small screen, this is stored here under flutter.entscheider.web.trotzdem. The game does not ask for persistent storage here, and so does not check whether it is running in a Chromium-based browser. In Safari (on iPhone and iPad in every browser) and in Brave, the browser keeps the entries in the embedded frame only temporarily; the game points this out to you (“Saved only temporarily”). You can delete the entries via the site data in your browser, depending on the browser under itch.io or html-classic.itch.zone. This may also delete the data of other games on itch.io.
• Language: The game starts in the language you chose in it, otherwise in the first matching language from the list of your preferred languages, otherwise in English. Changing the language does not change the address.
• Browser detection: To decide whether to offer the button below, the game checks in your browser whether it is running in Safari or Apple’s WebKit (via the navigator.vendor property) or in Brave (via navigator.brave). The result stays in the browser; nothing is transmitted.
• Button “Continue your game on decision.amapps.app”: Only the version on itch.io shows this button, and only if your browser does not allow storing (site data blocked or storage full, including by other games) or keeps the entries only temporarily (Safari, every browser on iPhone and iPad, Brave). In that case, a notice with the button appears once per visit, and the button appears under “Saved games” for as long as the reason persists. If you click it, a new tab opens with the address https://decision.amapps.app/<language>/#umzug=…. The part after “#” contains the game in progress and, as far as the length of the address allows and your browser allows them to be read, your saved games, your high-score list, the chosen language, the radio station and starting times, and any saved games set aside. Your browser does not send this part to the server (section 8), and the page does not load a measurement script in this case (section 5). From then on, you play on decision.amapps.app, and sections 4 to 8 apply. If you later reload the page there, the audience measurement counts that visit like any other. The button is a voluntary offer; the game remains fully playable on itch.io.
• Backup file: “Save to file” and “Load from file” are available here as well (section 7).
• Legal notice and privacy: Here, too, the links open a new tab on amapps.app (section 10).
• Legal basis: as in section 6. Storing and reading information in your browser, including the browser detection, is strictly necessary for the game to provide the functions you use, including the offer to protect your game from being lost (§ 25(2) no. 2 TDDDG).

10. Legal notice and privacy on amapps.app

The small bar at the top right of the game links to the legal notice and to this privacy policy on amapps.app, and so do the start page and the error page. From within the game, they open in a new tab. Your browser usually tells amapps.app that you are coming from decision.amapps.app (in the version on itch.io: from html-classic.itch.zone); the game itself transmits nothing. The data generated when you visit amapps.app is covered by the website’s privacy policy (in German).

11. Emailing the controller

The game itself sends no emails. If you email the controller, for example at support@amapps.app, he receives your email address, where applicable the name stored in your email app, and the content.

• Purpose: handling and answering your enquiry.
• Legal basis: Art. 6(1)(f) GDPR; the legitimate interest lies in answering your enquiry.
• Recipients: Emails to amapps.app addresses are received by Cloudflare, Inc. (USA) as a processor and forwarded, without the message itself being stored, to the controller’s mailbox at GMX (1&1 Mail & Media GmbH, Brauerstr. 48, 76135 Karlsruhe, Germany); GMX stores them there under its privacy policy. The sender, recipient, subject, time, technical message ID, delivery status and the results of the sender checks (SPF, DKIM, DMARC) are logged in the controller’s Cloudflare account. Your own email provider also processes the email, under its own terms. The controller sends replies via Apple’s iCloud+ (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; Apple Inc., USA) from an amapps.app address. Apple processes the reply, including your email address and any parts of your message quoted in it, under its Privacy Policy.
• Third country: Cloudflare is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR). For passing data on to Apple Inc. in the USA, Apple states that it uses Standard Contractual Clauses (Art. 46 GDPR).
• Retention: for as long as necessary to handle your enquiry; the email and the replies to it, including the copies at GMX and iCloud, are then deleted unless statutory retention obligations apply. According to Cloudflare, it keeps the log in the Cloudflare account for 31 days.

12. Recipients and transfers to third countries

The controller does not sell any data and does not share any data for advertising or tracking purposes. Only the following parties receive data, and only to the extent described:

• Cloudflare, Inc. (USA), processor: audience measurement (section 5) and forwarding of emails (section 11). Third country: adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
• GitHub, Inc. (USA), separate controller for the access data: delivery of the game (section 4), with service providers such as Fastly (USA). Third country: adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
• Itch Corp. (USA), operator of itch.io, separate controller: only if you play the version on itch.io (section 9). itch.io delivers it and processes data in doing so under its own privacy policy. Third country: your browser fetches the game directly from itch.io, just as when you visit a website. The controller does not pass any further data about you on to itch.io; in the controller’s view, this therefore does not constitute a transfer by the controller to a third country.
• GMX (1&1 Mail & Media GmbH, Karlsruhe, Germany) and Apple (Apple Distribution International Ltd., Ireland; Apple Inc., USA): only if you email the controller (section 11). Cloudflare forwards your emails to the controller’s mailbox at GMX, where they are stored. The controller sends replies via Apple’s iCloud+. For passing data on to Apple Inc., Apple states that it uses Standard Contractual Clauses (Art. 46 GDPR).

13. Retention

• In your browser: until you clear the site data for decision.amapps.app or your browser removes it under its own rules (section 6); in the version on itch.io, correspondingly, depending on the browser under itch.io or html-classic.itch.zone (section 9).
• With the controller: The game sends him no data about your use. He keeps support emails and the replies to them for as long as necessary to handle them and then deletes them, including the copies at GMX and iCloud, unless statutory retention obligations apply.
• With Cloudflare (on behalf of the controller): the measurement data as described in section 5; according to Cloudflare, the log of forwarded emails (section 11) for 31 days.
• With GitHub: according to GitHub’s rules as a separate controller; GitHub does not publicly state a fixed period.
• With itch.io: according to itch.io’s rules as a separate controller (section 9).

14. Your rights

Under the GDPR you have – subject to the respective legal requirements – the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20), as well as the right to object under Art. 21 (section 15). The controller does not base any processing on consent.

To exercise these rights, simply write to support@amapps.app; no particular form is required. As the game works without an account and the controller only sees aggregated figures, he generally cannot link visits to a person (Art. 11 GDPR). You can, however, provide additional information that makes this possible; your rights under Art. 15 to 20 GDPR then apply to that extent as well (Art. 11(2) GDPR). The controller will provide you with information about the emails you have sent to him. You can delete the data in your browser (sections 6 and 9) yourself at any time. You can also exercise your rights directly against GitHub and itch.io.

15. Right to object under Art. 21 GDPR

Where processing is based on Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation. The controller will then no longer process the data concerned unless he can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

The following are based on legitimate interests:

• delivery via GitHub Pages (section 4),
• audience measurement with Cloudflare Web Analytics (section 5),
• handling emails (section 11).

You can send your objection informally by email to support@amapps.app. The controller will review every objection and let you know how it will be implemented. As the game works without an account, the controller cannot link visits to an individual device. You can, however, stop the audience measurement yourself straight away by blocking the script from static.cloudflareinsights.com (section 5).

16. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for the controller is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI), Lautenschlagerstraße 20, 70173 Stuttgart, Germany

17. Obligation to provide data and automated decision-making

You are under no statutory or contractual obligation to provide any data. However, the game cannot be loaded without the technical connection data, in particular the IP address. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

18. Children

The game is not specifically directed at children. It does not ask for anyone’s age and does not process any age-related data. The controller does not knowingly collect personal data from children.

19. Changes to this policy

If the game, the services used or the legal situation change, this policy will be adjusted. The version published here, bearing the date given above, is the authoritative one.