Privacy policy

Last updated: 18 October 2026
This is a translation. The German version is the binding one.

Tabiji is a free browser game with no account, no ads and no analytics or tracking services. This page says which data still comes up, what for and for how long.

Controller

Email: info@tabiji.world

Hosting

Tabiji runs on servers I rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are in the Falkenstein data centre. Hetzner processes the data on my behalf (Art. 28 GDPR), and all data stays in Germany.

Server logs and protection against abuse

With every request your browser sends data to the server, as the web works that way. This data is processed:

The web server writes one line with this data per request to its log. The connection filter in front of it only logs unusual or rejected connections, for example when a connection limit is exceeded. The logs stay on the servers, are not combined with other data and are not passed on. The services' logs rotate automatically: older entries are overwritten once a service's logs reach 50 MB, and deleted when the service is redeployed. The web server's lines are also kept in a log store on the same servers, to evaluate the operation (requests per site, errors, abuse). There each line is deleted after 30 days.

To guard against overload, the connection filter and the game server also count requests and connections per IP address, in memory only. These counters expire at the latest 24 hours after the last connection. During an attack an IP address can be blocked for one hour. For troubleshooting, the servers' network components briefly keep the latest connections (IP addresses and ports) in memory.

The purpose is secure and stable operation, troubleshooting and fending off attacks. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in these purposes.

Cookie

Tabiji sets exactly one cookie, tabiji-session. It holds a random identifier and nothing else, and ties the backup copy of your game and your leaderboard entries to your browser. Scripts cannot read it, it is only sent over HTTPS and only to tabiji.world, and it lasts twelve months from your last visit. The legal basis is § 25(2) no. 2 TDDDG, as the game needs it for these features, and Art. 6(1)(f) GDPR.

Storage in your browser

The game keeps in your browser's local storage (localStorage):

When you switch the language, the tab briefly remembers the page (sessionStorage) so that it reloads only once. This data stays on your device. Only the game and the player name go to the server, as the next two sections describe. You can delete all of it in your browser settings, under the site data of tabiji.world. The legal basis is § 25(2) no. 2 TDDDG.

Saved games on the server

Some browsers clear site data by themselves after a while. So that your journey is not lost then, the server keeps a copy of the game under the identifier from the cookie, including the moves of the journey. Name and IP address are not part of it. The copy is deleted once it has not changed for 180 days, or earlier when storage runs low, oldest first. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is that no game gets lost.

Leaderboard

Once you set a player name, every finished journey goes to the server. It replays the journey from its moves, works out the score and lists it on the leaderboard. Stored are your player name with its tag, the start, destination and season of the journey, the score, the journey's identifier (seed), the date, and a hash of your session identifier so that only you can keep using your name. Apart from the hash, all of this is public. So please do not use your real name.

An entry stays as long as it is among the best 500. When the rules change so that the same moves score differently, the leaderboard starts over: the entries go, and only the player name, tag and hash stay, so that nobody else can take your name. Ask by email and I delete an entry earlier, that remainder included; give your player name and tag. Without a player name no entries are made. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is offering a leaderboard.

Photos and map from other providers

Your browser loads photos and map tiles straight from the servers of the providers below. They receive your IP address and browser identification, and as referrer only the address https://tabiji.world/. I have no influence on what they do with it.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is showing freely licensed photos of the places and a map.

Email

When you write to me, I process your email address and the content of the message to answer you. The mailboxes are hosted by mailbox.org, Heinlein Hosting GmbH, Schwedter Straße 8/9A, 10119 Berlin, Germany, which runs them on my behalf (Art. 28 GDPR). I delete the messages once the matter is settled. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is answering enquiries.

Ko-fi

At the foot of the start page, a button leads to my page on Ko-fi, where you can support Tabiji with a tip. Ko-fi is run by Ko-fi Labs Limited, England and Wales, United Kingdom. Only when you click the button does your browser load the Ko-fi panel from ko-fi.com. Ko-fi then receives your IP address and browser identifier and may set cookies. Without a click, nothing goes to Ko-fi. The EU Commission has issued an adequacy decision for the United Kingdom. Privacy policy

If you give something through Ko-fi, Ko-fi and the payment service (PayPal or Stripe) pass on to me your name, your email address, the amount, your message and payment details. I use them only to match the support and to answer you where needed, and I do not pass them on. I keep them as long as tax retention duties require. The legal basis for loading the panel is Art. 6(1)(f) GDPR, the legitimate interest being to make support through Ko-fi possible; for the details of the support, Art. 6(1)(b) and (c) GDPR.

Links

Places in the game link to further pages such as Wikipedia or japan-guide.com. Data only goes there when you click a link, and then that site's privacy policy applies.

What there is not

No analytics or statistics services, no ads, no social media plugins, no profiling and no automated decisions within the meaning of Art. 22 GDPR. Beyond the cases above I pass on no data.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21). Write to info@tabiji.world. Tabiji has no accounts, so I can only find your data by your player name and tag.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the EU country where you live.