Privacy Policy · Datenschutzerklärung

No account, no newsletter. Your quiz balance stays in your browser. The public semester leaderboard is opt-in: only if you choose to join does it receive a random player ID, the BroDollars you earn and the display name you pick (or a placeholder). Multiplayer works with the same self-chosen display name - no registration. Analytics only runs if you explicitly say yes to the consent dialog - decline it and nothing is tracked. Ads come from Google AdSense, and only if you say yes to them in that same dialog: until then no Google code is loaded at all, and if you decline you see no ads.

Responsible for data processing on this site (Art. 4 (7) GDPR):

Nicolas Dumpe
Kiem-Pauli-Weg 41
85579 Neubiberg, Germany
E-mail: maus@muc-matcha.de

The site is hosted by Cloudflare, Inc. (USA) as static files on its global network. When you visit, Cloudflare technically necessarily processes connection data - IP address, date and time, requested URL, browser and operating system - to deliver the page and to defend against abuse; short-lived logs are kept only as long as needed to deliver, secure and debug the site. Legal basis: our legitimate interest in delivering and securing the site (Art. 6 (1) (f) GDPR). A data processing agreement per Art. 28 GDPR is in place with Cloudflare. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, so transfers to the USA rest on the EU Commission's adequacy decision (Art. 45 GDPR), with EU standard contractual clauses (Art. 46 GDPR) as a fallback.

The site stores these entries in your browser's localStorage so it works (progress survives a reload): your balance (bwr_score_v1), the current quiz run (fb_session_v1, fb_variants_v1), the topics you ticked (fb_topics_*), your cookie-banner choice (fb-cookie-consent) and your leaderboard choice (fb_board_v1). These never leave your browser.

Only if you join the leaderboard or a multiplayer room are two more entries created - a random player ID (fb_mp_id) and your display name (fb_mp_name) - and sent to the service described in section 4. Storing and reading all of these is strictly necessary for the functions you use and requires no consent (§ 25 (2) no. 2 TDDDG). Clearing your browser data removes them.

The optional multiplayer mode and the semester leaderboard run on infrastructure provided by Cloudflare, Inc. (USA). When you create or join a room, the following is processed on Cloudflare's servers: the display name you enter (free choice - it does not have to be your real name), a randomly generated player ID stored in your browser, your answers and scores during the game, and the connection data (including IP address) technically required to maintain the realtime connection. Room state is held only for the duration of a game and discarded when the room closes.

The semester leaderboard ranks players by the BroDollars they earn. It is opt-in: before your first quiz posting or duel you are asked whether to join it, and nothing is sent unless you say yes. If you join, then each time you solve a quiz question correctly and at the end of every multiplayer game the following is sent to Cloudflare's servers: your player ID, your display name (or an automatically generated placeholder such as "Excel Intern #4127"), the question, the random seed and your answer (so the result can be re-checked and not counted twice) and the BroDollars earned, per subject. Your display name and BroDollars are shown publicly on the board. A new board starts every TUM semester (1 April and 1 October); entries from past semesters are no longer shown.

Retention: leaderboard entries are stored for as long as the leaderboard is operated; there is no automatic deletion. "Leave the board" on the leaderboard page hides your entry immediately. To have it erased, e-mail the address in section 1. Cloudflare's request logs for this service (including IP address and the requested URL) are kept for a few days for operation and debugging.

Legal basis: providing the leaderboard and multiplayer you chose to use (Art. 6 (1) (b) GDPR); re-checking results and blocking duplicates and abuse, and the request logs, rest on our legitimate interest in a fair and working service (Art. 6 (1) (f) GDPR). Both features are optional - the trainer itself never needs them. Display names are subject to the name rules in our terms, which also explain how to report a name. A data processing agreement per Art. 28 GDPR is in place with Cloudflare; Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, so transfers to the USA rest on the EU Commission's adequacy decision (Art. 45 GDPR). If the leaderboard service is unreachable, the site keeps working - the result simply goes unrecorded.

We use PostHog to understand which pages and questions get used - but only if you accept the consent dialog. Until you do, no analytics script loads, no cookie is set and no data is collected. If you decline, the site works exactly the same.

With your consent, PostHog stores identifiers (cookies / localStorage) and collects usage events: pages viewed, interactions, approximate device and browser information. We use PostHog's EU cloud, so analytics data is stored on servers in Frankfurt, Germany (provider: PostHog Inc., USA, under a data processing agreement with EU standard contractual clauses).

Legal basis: your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You give or refuse it in the consent dialog on your first visit, which asks about analytics and advertising (section 6) separately. You can withdraw it at any time with effect for the future via Cookie settings - withdrawal stops all capturing and resets the stored identifiers.

Retention: analytics data is deleted or irreversibly anonymized at the latest 24 months after collection.

Ads on this site are served by Google AdSense, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), and only if you say yes to ads. Google then uses cookies and similar identifiers to select ads, measure their performance, prevent fraud and show ads personalised to your interests, which may involve advertising partners listed in the consent dialog (IAB Transparency & Consent Framework).

Cookies involved: __gads, __gpi and __eoi (set for finance-bro.de and google.com, up to 13 months), IDE and test_cookie (doubleclick.net), plus FCCDCF, the first-party cookie that stores your consent choice (13 months), and google_auto_fc_cmp_setting in localStorage, which stores the consent dialog's state - both strictly necessary (§ 25 (2) TDDDG). Your IP address and browser details are transmitted to Google when an ad loads.

After your yes, Google may show its own, more detailed consent dialog for ad partners (IAB Transparency & Consent Framework); what you choose there applies to the ads. If an ad blocker stops the ad script after your yes, the site shows a short note asking you to allow ads. That note runs entirely in your browser; nothing is sent or stored.

Legal basis: your consent to ads, including loading Google's ad script and storing identifiers (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), given or refused in the consent dialog. Until you say yes, no Google script is loaded and no connection to Google is made. If you decline, you see no ads; declining does not limit the site. You can change your choice any time via Cookie settings.

Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, so the transfer rests on the EU Commission's adequacy decision (Art. 45 GDPR), with EU standard contractual clauses (Art. 46 GDPR) as a fallback. More at policies.google.com/technologies/ads; manage Google's ad personalisation at adssettings.google.com.

The Library and Bro Shop pages contain affiliate links to Amazon.de (Amazon EU S.à r.l., Luxembourg - Amazon PartnerNet), each labelled as advertising next to the link. The links are plain outbound links: no Amazon script, pixel or cookie is loaded on this site, and nothing about you is transmitted by us before you click. Once you click, Amazon processes your data (including a cookie that attributes a purchase to this site) under its own privacy policy: amazon.de/privacy. We only receive aggregated statistics (number of clicks and qualifying purchases), never your identity.

This site is made for university students. It is not directed at children under 16 and we do not knowingly collect their data; if you believe a child has left data here (for example a leaderboard name), e-mail the address in section 1 and it will be deleted.

If you write to us, the e-mail and its contents are processed to answer your inquiry (Art. 6 (1) (b) and (f) GDPR) and deleted once the matter is closed, unless retention duties apply.

Our mailbox is hosted by Google Ireland Ltd. (Google Workspace) under a data processing agreement. Google LLC (USA) is certified under the EU-US Data Privacy Framework, so transfers to the USA rest on the EU Commission's adequacy decision (Art. 45 GDPR), with EU standard contractual clauses (Art. 46 GDPR) as a fallback.

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Consent can be withdrawn at any time (Art. 7 (3)). To exercise any of these, e-mail the address in section 1.

Right to object (Art. 21 GDPR): where we process your data based on our legitimate interest (Art. 6 (1) (f) GDPR - sections 2, 4 and 7), you can object at any time on grounds relating to your particular situation. We then stop, unless we can show compelling legitimate grounds or need the data to establish, exercise or defend legal claims. E-mail the address in section 1.

You are not obliged to provide any personal data. Without the connection data in section 2 the site cannot be delivered; everything else is optional and the trainer works without it. No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR) - for this site that is the Bavarian Data Protection Authority (BayLDA, Ansbach), though any EU supervisory authority will forward your complaint.

This policy is updated whenever the site's data processing changes. The date at the top tells you the last revision.