Privacy at a glance
This privacy policy describes which personal data is processed when you visit jpnerd.com, for what purpose, and on what legal basis. Personal data means any data with which you can be personally identified.
Summary:
- Hosting: When you access the website, technical server logs (IP, browser, referrer) are recorded.
- Analytics: We use a self-hosted analytics tool (Umami) that collects anonymous usage data cookie-free and without consent — no cookies are set and no data is stored on your device.
- Affiliate links: When clicking on marked recommendation links, you are forwarded to third-party providers who in turn process data.
- Contact form: When using the contact form, the data you provide is stored to answer your inquiry.
- User account (optional): You may voluntarily register with a name, username, email address and password (confirmation link by email) to store your game progress across devices.
- Games without registration: Without an account, your game progress is stored exclusively in your browser (
localStorage) and is not transmitted to us. - Leaderboard: A public leaderboard shows registered users only if they have explicitly enabled a display name for it (opt-in).
- Registration bot protection: A proof-of-work procedure (ALTCHA) verifies registrations entirely on our own server, with no third-party transmission.
- Newsletter (optional): During registration you can voluntarily subscribe to the newsletter via a checkbox (double opt-in).
Details on each processing activity can be found in the following sections.
Controller
The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Tobias Link c/o Online-Impressum #8311 Europaring 90 53757 Sankt Augustin
Email:
Hosting
This website is hosted by:
netcup GmbH Daimlerstraße 25 76185 Karlsruhe, Deutschland Data center: Nürnberg, Deutschland
A data processing agreement pursuant to Art. 28 GDPR has been concluded with the host (signed on 10.05.2026). The host processes personal data exclusively on instructions and in accordance with this agreement. netcup GmbH is certified under ISO 27001 (information security) and ISO 27701 (data protection).
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a technically error-free presentation and optimization of the website).
Server logs
Each time the website is accessed, the host automatically collects technical information and stores it in so-called server log files.
Collected data categories:
- IP address of the requesting device
- Date and time of the request
- Requested URL and HTTP status code
- Amount of data transferred
- Browser and operating system used (user agent)
- Referrer URL
Purpose: Ensuring smooth operation, detecting and defending against attacks, technical optimization.
Storage duration: Logs are deleted after a maximum of 7 days. The data is not combined with other data sources.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in IT security).
Analytics (Umami)
We use the open-source analytics software Umami, hosted on our own server infrastructure (data center in Germany). No data is transmitted to third parties.
Umami is configured to be cookie-free: no cookies are set and no entries are written to local browser storage (localStorage) — no information is stored on or read from your device. Counting is performed server-side via a daily-rotating, non-reversible hash value (derived among other things from IP address and browser signature); this value is not stored on your device. As a result, no cross-day or cross-device recognition takes place.
Collected data categories:
- Pseudonymous visitor ID (hash, no direct identifiability)
- Page views and time spent on page
- Referrer URL and country (derived from IP, IP itself is discarded immediately)
- Browser type and operating system
- Custom tracking events:
article-read-time,article-scroll-depth,article-related-click(article optimization only)
Purpose: Reach measurement, content performance analysis, optimization.
Legal basis:
- Access to the end device: Since Umami operates cookie-free and stores or reads no information on your device, no consent requirement under § 25 (1) TDDDG (formerly TTDSG) applies.
- Processing of the anonymous usage data: Art. 6 (1) (f) GDPR (legitimate interest in privacy-friendly, cookie-free analytics)
No identification – data subject rights (Art. 11 GDPR): The data collected for analytics does not enable us to identify individual persons. We store no information that would allow us to link you to a specific record, and we are not obliged to obtain additional identifying data solely in order to comply with data subject rights. The rights to access, rectification, erasure and restriction (Art. 15–20 GDPR) therefore do not apply to this anonymous statistical data, as a request cannot be matched to any stored record (Art. 11 (2) GDPR). If you wish to avoid being counted in future, you can prevent this technically at any time (e.g. by enabling "Do Not Track" in your browser or using a tracking blocker).
Storage duration: Aggregated statistics are stored indefinitely. Raw events are automatically deleted after 12 months.
Cookies & local storage
This website itself uses only two kinds of technical storage — both first-party, with no third-party involvement:
- Session cookie (only after login): Set exclusively when you log in with a user account (section "User Account and Registration"). It keeps you logged in during your visit and expires on logout or when the session ends.
- Local storage (
localStorage) for guest-mode game progress: Concerns only your own device and is never transmitted to us (section "Guest Mode and Local Storage"). - Local storage (
localStorage) for the travel tools: The details of your planned trip, plus ticked items in the checklist, packing list and itinerary. Likewise concerns only your own device and is never transmitted to us (section "Travel Tools and Local Storage").
Analytics (Umami, section "Analytics") continues to operate cookie-free. For this reason there is no cookie banner on jpnerd.com — the session cookie is strictly necessary (§ 25 (2) no. 2 TDDDG, formerly TTDSG, no separate consent required), and the local storage does not process any data transmitted to us.
Beyond that, cookies can only be set by third parties, and only in two cases:
- Affiliate partners — only when you actively click a recommendation link (section "Affiliate Tracking").
- hCaptcha — only when using the contact form and only after the captcha interaction (section "Contact Form"). Account registration, by contrast, uses ALTCHA, which runs entirely on our own server and involves no third party (section "Registration Bot Protection").
Affiliate cookies (Amazon, Klook, italki, possibly JapanesePod101) are set by the respective partner, only when you actively click on an affiliate link. Details: see section "Affiliate Tracking".
Deletion: You can delete the first-party session cookie and local storage data at any time via your browser settings (e.g. "clear site data"); the session cookie also expires automatically on logout. Cookies set by third parties (affiliate partners, hCaptcha) can likewise be deleted at any time via your browser settings.
Contact form
If you use the contact form (/en/contact), the data you enter is sent to the controller's mailbox.
Collected data categories:
- Name (mandatory)
- Email address (mandatory)
- Subject (mandatory)
- Message text (mandatory)
Purpose: Processing your inquiry and any follow-up questions.
Legal basis: Art. 6 (1) (a) GDPR (consent, given by ticking the corresponding checkbox and submitting the form).
Spam protection: The form uses several protective mechanisms:
- hidden honeypot field
- server-side time check (minimum submit time of 2 seconds)
- mandatory consent checkbox
- hCaptcha as an additional bot-detection layer (details below)
Storage duration: Your inquiry and the related correspondence are stored until your inquiry has been fully answered, but no longer than 6 months after the correspondence has been completed. Afterwards, the data is deleted unless legal retention obligations apply.
Withdrawal: You can object to the processing at any time by email to
hCaptcha (bot protection on the contact form)
When the contact form loads, the hCaptcha widget operated by Intuition Machines, Inc. is fetched. Technical data is transmitted to their servers during this process.
Provider: Intuition Machines, Inc., 350 Alabama Street, San Francisco, CA 94110, USA — website: https://www.hcaptcha.com
Purpose: Detection of automated requests (bots) and protection of the contact form against abuse.
Processed data categories:
- IP address
- Browser information (user agent, screen size, language, installed plugins)
- Mouse and keyboard behaviour during the captcha interaction
- Optional cookies from the provider (
hcaptcha,hcaptcha-token) — set only after captcha interaction
Legal basis: For processing the transmitted data, Art. 6 (1) (f) GDPR (legitimate interest in protecting our contact form against spam, automated requests and abuse). Insofar as hCaptcha stores or accesses information on your device during the captcha interaction (in particular the cookies named above), this access is based on Section 25 (2) no. 2 TDDDG (formerly TTDSG): the storage occurs only upon active use of the form and is strictly necessary to provide the service you expressly requested — the submission of the contact form secured against automated abuse; no separate consent is required for this. As an alternative communication channel without captcha processing you may at any time reach us via direct email to
Third-country transfer: Processing takes place in the United States. Intuition Machines, Inc. is certified under the EU-US Data Privacy Framework (EU-DPF) (Adequacy Decision of the EU Commission, 10 July 2023). This provides an adequate level of data protection in accordance with Art. 45 GDPR. The certification can be reviewed at https://www.dataprivacyframework.gov/.
Storage duration: According to the provider, the transmitted data is stored for the purpose of bot detection and pattern training for up to 24 months.
Further information: hCaptcha Privacy Policy | hCaptcha Terms
User Account and Registration
You may voluntarily register on jpnerd.com with an email address and password to store your game progress across devices and optionally take part in the public leaderboard (see the following sections). Registration is not required to use the website or the games — without an account, all games work in guest mode (section "Guest Mode and Local Storage").
Collected data categories:
- Name
- Username
- Email address
- Password (stored exclusively as a hash, never in plain text; minimum length 12 characters)
- Registration and activation timestamp, time of last login
- Optional: a freely chosen display name for the leaderboard, separate from the username (section "Leaderboard")
- Optional: newsletter opt-in (section "Newsletter")
Activation: After registering, you receive an email with a confirmation link (double opt-in / self-activation). The account is only enabled after you click this link, which also ensures that you actually have access to the email address provided.
Purpose: Providing and managing your user account, storing your game progress across devices (next section), participating in the leaderboard.
Legal basis: Art. 6 (1) (b) GDPR (performance of the usage relationship established by registering the account and its associated functions).
Storage duration: Until your account is deleted. Deleting the account automatically removes all associated game-progress and save data as well (section "Game Progress, Achievements and Saves").
Deleting your account yourself: You can delete your account at any time yourself in your profile. After confirming with your password, the account and all associated data are removed immediately and permanently: user account, game progress (XP, level, achievements, daily streak), saves, and any leaderboard entry (sections "Game Progress, Achievements and Saves" and "Leaderboard"). An existing newsletter subscription for the same email address is automatically cancelled as part of this (section "Newsletter"). Alternatively, you can still request deletion via the contact options in section "Data Protection Contact".
Security logs: Your entry in our anonymized security/activity logs (technical records of security-relevant account actions) is not removed on account deletion for technical reasons — the remaining identifier is a plain number with no link to your (deleted) account and therefore no personal reference. These logs serve exclusively for system security and abuse detection (Art. 6 (1) (f) GDPR, legitimate interest).
Newsletter
On the registration form you can voluntarily subscribe to the JP Nerd newsletter (Japan news, travel guides, Japanese learning tips) via a separate, non-preselected checkbox. The subscription is independent of account registration — you can register without ticking the checkbox, and a newsletter subscription does not require a user account.
Collected data categories:
- Email address (from the registration form)
- Language (German/English, derived from the language version of the registration page you used)
Procedure (double opt-in): Only if you actively tick the checkbox is your email address, after successful account registration, transmitted to an automation platform we operate (an n8n instance at n8n.pixelarray.de), which technically handles the double opt-in dispatch (confirmation email) and further newsletter delivery. You are only added to the active mailing list after confirming via the link in that email.
Purpose: Sending the newsletter to people who have explicitly consented.
Legal basis: Art. 6 (1) (a) GDPR (consent, given by actively ticking the checkbox).
Storage duration: Until consent is withdrawn (unsubscription).
Withdrawal: You can unsubscribe at any time, e.g. via the unsubscribe link in the newsletter email or via the contact options in section "Data Protection Contact". If you also delete a user account registered under the same email address (section "User Account and Registration"), an existing newsletter subscription for that address is automatically cancelled at the same time.
Game Progress, Achievements and Saves (for Registered Accounts)
While logged in, your game progress is stored on our server in addition to local storage in your browser (section "Guest Mode and Local Storage"), so that it is preserved across devices.
Collected data categories:
- Total experience points (XP) and XP per game
- Number of play sessions and best scores per game
- Daily streak (consecutive calendar days with at least one completed play session) and unlocked achievements
- Full save data for individual multi-part games (e.g. "Das Hochhaus"), where the respective game offers a save function
- Timestamp of the last update
Purpose: Cross-device continuation of your game progress, display of achievements/titles, basis for optional participation in the leaderboard.
Legal basis: Art. 6 (1) (b) GDPR (part of the functions associated with the user account).
Data integrity: To protect the leaderboard against manipulation, our server recalculates the stored XP values from your actual game events rather than accepting unverified figures reported by the browser; server-side caps additionally limit implausible gains (Art. 32 GDPR — security of processing).
Storage duration: Until your account is deleted.
Deletion: Deleting your account (section "User Account and Registration") automatically deletes all data listed in this section as well — technically enforced by a fixed link between the account and the progress data; no separate deletion request for this data is necessary.
Guest Mode and Local Storage (localStorage)
Without registering or logging in, your game progress is stored exclusively in your browser (localStorage) — e.g. total XP, per-game values, achievements and daily streak. This data is never transmitted to our server — we have no knowledge of it and cannot attribute it to any person.
If you later log in with an account, this local state is imported into your account once (afterwards, the previous section applies).
Legal basis / consent requirement: Since this local storage concerns only your own device and is not processed by us, no processing of personal data by the controller takes place in this regard. Insofar as the technical access to the end device is considered separately, it is permissible without consent under § 25 (2) no. 2 TDDDG (formerly TTDSG), because it is strictly necessary to provide the function you have expressly chosen — game progress without registration.
Deletion: Possible at any time via your own browser settings (e.g. clearing "site data"/"local data" for jpnerd.com).
Travel Tools and Local Storage (localStorage)
The travel tools on jpnerd.com (including the cost calculator, JR Pass calculator, travel window planner, pre-trip checklist, packing list and itinerary generator) store two kinds of information exclusively in your browser (localStorage):
- Your trip details: travel dates, trip duration, number of travellers and target regions. You enter these once in the "Your trip" bar; the other tools read them from there so that you do not have to enter the same details repeatedly.
- Your working state: ticked items in the pre-trip checklist and the packing list, and completed days in the itinerary generator.
This data is never transmitted to our server — we have no knowledge of it and cannot attribute it to any person. It is not transmitted even if you hold a user account; unlike game progress, trip details are not imported into your account.
Sharing by you: Some tools generate shareable links that carry your entries in the address (for example the selected dates or the number of travellers). If you pass such a link on, you are the one disclosing those details to the recipient. This only ever happens at your initiative. Conversely: if you open a shared link containing details that differ from the ones you have saved, your own details are not overwritten; you are notified of the discrepancy and decide yourself whether to adopt the details from the link.
Legal basis / consent requirement: Since this local storage concerns only your own device and is not processed by us, no processing of personal data by the controller takes place in this regard. Insofar as the technical access to the end device is considered separately, it is permissible without consent under § 25 (2) no. 2 TDDDG (formerly TTDSG), because it is strictly necessary to provide the function you have expressly chosen — using the tools without repeated entry and without registration.
Deletion: The "Your trip" bar contains a "Clear details" button that removes your trip details immediately. Beyond that, deletion is possible at any time via your browser settings (e.g. clearing "site data"/"local data" for jpnerd.com).
Leaderboard
jpnerd.com displays a public leaderboard (total XP as well as separate leaderboards per game).
Participation is voluntary (opt-in): Without an actively set display name, your account does not appear on the leaderboard. The display name is freely chosen and separate from your login username.
Collected / publicly displayed data categories: the chosen display name, total XP or the high score for the respective game.
Some of the displayed entries are not real people, but fictional placeholder entries (randomly generated names with example values) used to seed the leaderboard initially; they are gradually displaced by real users and contain no personal data.
Purpose: Public display of game progress for motivational and comparison purposes.
Legal basis: Art. 6 (1) (a) GDPR (consent, given by actively setting the display name).
Withdrawal: You can remove your display name at any time; your account will then disappear from the leaderboard. Please use the contact options in section "Data Protection Contact" for this.
Registration Bot Protection (ALTCHA – Proof of Work)
The registration form is protected by a proof-of-work procedure called ALTCHA (a Joomla core plugin, not a third-party service).
How it works: When you submit the form, your browser solves a small, automatically generated computational task (proof of work). This computation runs entirely locally in your browser (Web Crypto API); the solution is submitted together with the form to our own server and verified there.
The key difference from classic captcha services (cf. hCaptcha on the contact form, section "Contact Form"): There is no transmission to an external provider, no third-party cookie is set, and no movement, behavioural or device-fingerprinting data is transmitted to any third party. The entire check takes place within our own server infrastructure.
Data processed: A technical challenge token (a random string together with the computed solution) with a short validity period (a few minutes), after which it expires automatically. This does not constitute personal data in the proper sense.
Purpose: Protecting the registration function against automated bot sign-ups (spam accounts).
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in protection against abusive automated registration).
No third-party transfer: Since the entire process takes place on our own server, no transfer to a third country and no data processing agreement with a captcha provider is required.
Affiliate tracking (recommendation links)
jpnerd.com participates in partner programs of various providers. When clicking on an appropriately marked link, you will be redirected to the partner's website. The partner may set a cookie at the time of clicking to attribute any subsequent order to the referrer's commission.
Important: These cookies are set by the partner, not by jpnerd.com. We have no influence on their content or storage duration.
Active partners and third-country information:
| Partner | Headquarters | Cookie duration | Transfer to third country | Legal basis for transfer |
|---|---|---|---|---|
| Amazon (EU S.à r.l. / Amazon.com, Inc.) | Luxembourg / USA | ~24 hours | Yes, USA | EU-US Data Privacy Framework (Adequacy Decision of the EU Commission, 10 July 2023) |
| Klook Travel Technology Limited | Hong Kong | ~30 days | Yes, Hong Kong | Standard Contractual Clauses (Art. 46 GDPR) |
| italki HK Limited | Hong Kong / USA | ~30 days | Yes, Hong Kong / USA | Standard Contractual Clauses (Art. 46 GDPR) |
The respective privacy notices of the partners can be found at:
- Amazon: https://www.amazon.de/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ
- Klook: https://www.klook.com/policy/
- italki: https://www.italki.com/en/privacy
Legal basis for the redirection itself: Art. 6 (1) (f) GDPR (legitimate economic interest). You can prevent the redirection by simply not clicking on the affiliate link.
Fonts
We use locally embedded fonts only (Google Fonts and Font Awesome). No connection is made to Google or other third-party servers when loading fonts.
SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the fact that the browser's address line changes from "http://" to "https://" and by the lock icon in your browser line.
Your rights as a data subject
You have the following rights vis-à-vis the controller with regard to personal data concerning you:
- Right to information (Art. 15 GDPR): You can request information about whether and which data we process about you.
- Right to rectification (Art. 16 GDPR): You can have incorrect data corrected.
- Right to erasure (Art. 17 GDPR): You can request the deletion of your data, provided no retention obligation prevents this.
- Right to restriction of processing (Art. 18 GDPR): You can request the restriction of processing.
- Right to data portability (Art. 20 GDPR): You can request to receive your data in a structured, common, machine-readable format.
- Right to object (Art. 21 GDPR): You can object to the processing of your data insofar as it is based on a legitimate interest.
- Withdrawal of consent (Art. 7 (3) GDPR): Consent given (e.g. for the contact form) can be withdrawn at any time with effect for the future.
An informal message to
Right to lodge a complaint with the supervisory authority
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The authority responsible for the controller is:
Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen Arndtstraße 1, 27570 Bremerhaven Web: https://www.datenschutz.bremen.de
You can also contact the data protection authority of your usual place of residence or work.
Data protection contact
For questions about the processing of your personal data, asserting your data subject rights or withdrawing consent, please contact directly:
- Email:
This email address is being protected from spambots. You need JavaScript enabled to view it. - Contact form: /en/contact
A data protection officer has not been appointed; this is not legally required (no large company, no mass processing of special categories of data).
Changes to this Privacy Policy
We reserve the right to adapt this privacy policy if the legal situation or processing changes. The current version is available on this page.
Last updated: 16.07.2026 · Version: 2.4