Privacy policy

2. General

We process personal data only where necessary to provide a functional service and our content and features. Fuse Infinity can be played without registration.

We use no tracking cookies and no cross-device tracking. Personal data is never sold.

3. Hosting (Vercel)

Our website is hosted by Vercel Inc., USA. When you visit, Vercel processes technically necessary connection data (including IP address, date and time, requested URL, referrer, browser and device identifiers) to deliver the site and secure operation.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, efficient operation). A data processing agreement is in place with Vercel; transfers to the USA are safeguarded by Standard Contractual Clauses or — where the provider is certified — the EU-US Data Privacy Framework.

4. Database (Neon)

To persistently store game content and the data mentioned in this policy, we use a PostgreSQL database provided by Neon Inc. Processing is carried out on our behalf under a data processing agreement (Art. 28 GDPR).

5. AI-assisted element combining (Anthropic)

The core feature of the game is fusing terms into new elements. The terms you combine and — if you use this feature — your own chosen starting words are transmitted to our AI provider Anthropic PBC, USA, to generate a new element.

Please do not enter personal or sensitive data into free-text words. The legal basis is Art. 6(1)(b) and (f) GDPR (providing the game feature and legitimate interest). Transfer to the USA is based on Standard Contractual Clauses; a data processing agreement is in place.

Previously computed combinations are cached so identical combinations by other players can be served without re-transmission.

6. Analytics (first-party, cookieless)

We run our own privacy-minimising analytics without cookies to understand and improve usage. We record events such as page views, referral source, language and anonymous game actions.

To roughly distinguish visitors, we derive a non-reversible daily hash from the IP address, browser identifier and a secret value that rotates every day. The IP address itself is not stored, and the hash resets daily, so persistent recognition or profiling is not possible.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in demand-oriented design). As no information is stored on or read from your device, no consent is required.

In addition, we use Vercel Web Analytics, a cookieless analytics service of our host Vercel Inc. (USA). It processes aggregated usage data (e.g. page views, referrer, approximate location, device and browser type) without cookies and without cross-device recognition. The legal basis is Art. 6(1)(f) GDPR; a data processing agreement is in place with Vercel and transfers to the USA are safeguarded by Standard Contractual Clauses.

7. Push notifications

If you explicitly consent, we send you web push reminders (e.g. for the daily puzzle). For this we store the push address (endpoint) provided by your browser together with its keys and your language choice.

The legal basis is Art. 6(1)(a) GDPR (consent). You can withdraw consent at any time — via the toggle in the game or your browser's notification settings. Endpoints that become invalid are deleted automatically.

8. User accounts (optional)

An account is optional and serves to sync your game profiles across devices and to show your name on the leaderboard. It is not required to play.

If you create an account, we store your chosen username, a cryptographic hash of your password (the password itself is not stored) and your game profiles. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

9. Feedback form

If you contact us via the feedback form, we process your message and — if provided — your contact details to handle your request. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in handling enquiries).

10. Local storage on your device

To store your game progress (profiles, discovered elements, streak) we use your browser's local storage (LocalStorage and IndexedDB). This data generally stays on your device and is only transmitted to us when account sync is active. You can delete it at any time via your browser settings.

11. Recipients and third-country transfers

Recipients of your data are the processors named above (Vercel, Neon, Anthropic), which act solely on our instructions. No further disclosure takes place.

Where data is transferred to the USA, this is based on Standard Contractual Clauses under Art. 46 GDPR or an adequacy decision (EU-US Data Privacy Framework), where the respective provider is certified.

12. Retention

We store personal data only as long as necessary for the stated purposes or as required by law. Analytics events are deleted automatically after 13 months at the latest. Account data is stored until the account is deleted.

13. Your rights

Under the GDPR you have the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21).

You can withdraw consent given (e.g. for push notifications) at any time with effect for the future (Art. 7(3) GDPR). An informal message to us is sufficient to exercise your rights.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI Baden-Württemberg).

15. Changes

This privacy policy is currently valid. As our service evolves or legal requirements change, it may become necessary to update it.