Privacy

This policy covers the website bytj-studios.com (part A) and the game Are You Sure? (part B). Translations are for your convenience; the German version is the binding one.

Who is responsible?

Taha Ibrahim Al-Jaber, BYTJ Studios
Waldemarstraße 97a, 10997 Berlin, Germany
E-mail: kontakt@bytj-studios.com

Part A: this website

1. Hosting at Strato

The website is hosted by STRATO AG, Pascalstraße 10, 10587 Berlin, Germany. When you open it, your browser sends technically necessary data to the server, and Strato writes it into server logs: your IP address, date and time, the page you opened, browser and operating system, and the page you came from (referrer). Strato also logs server error messages. This data is needed to run the site securely and to find errors. We do not use the logs for statistics and do not combine them with other data. How long Strato keeps them is up to Strato. Strato processes the data on our behalf (data processing agreement under Art. 28 GDPR). Legal basis: Art. 6(1)(f) GDPR (delivering the site securely and without errors).

2. No cookies, no tracking

The website sets no cookies and uses no analytics or advertising services. Fonts, images and videos come from our own server, not from third parties.

3. Links to Steam

Links to Steam are normal links. Only when you click one do you go to Steam (Valve), where Valve’s privacy policy applies.

4. E-mail

If you write to us, we use your address and your message only to reply. Legal basis: Art. 6(1)(b) or (f) GDPR.

5. Contact form

If you send us a message through the form, we process: the topic, the chosen game, your e-mail address, your message and, if you enter them, your name, version and system, company or channel, and link. The details are sent encrypted (SMTP with SSL through Strato’s mail server) as an e-mail to kontakt@bytj-studios.com. The form itself does not store the message. We only use the details to answer your request and do not pass them on. We delete the e-mails once the request is settled and no legal retention obligation applies. Legal basis: Art. 6(1)(b) GDPR, or (f) for general requests.

To prevent abuse, the form limits the number of messages. It does not store IP addresses, only a check value formed from the IP address (for IPv6 only the network of your connection) or the e-mail address and a secret random value that changes daily, together with the time. These entries are deleted after one hour at the latest. Legal basis: Art. 6(1)(f) GDPR (protection against abuse).

Part B: Are You Sure?

1. What stays on your computer

The Steam version is played online only (section 2); there is no practice mode alone against bots.

Your settings (e.g. language, keys, name for online rounds, volume per player) are stored only on your computer.

2. Online rounds (room code)

For online rounds we use services from Unity Technologies (Unity Gaming Services) as a processor:

• Sign-in (Authentication): The first time you play online, you get a random, anonymous player ID. We do not ask for your name, e-mail or password.
• Rooms and connection (Lobby/Multiplayer, Relay): So your computer can find the others, data runs through Unity’s servers. This technically requires your IP address, the anonymous player ID and the room data: room code, number of players and the name you enter yourself. For a room shown in the list, the game first measures which Unity server answers fastest, and the list shows only that server’s continent (e.g. “Europe”). There is no location lookup from your IP address and nothing about you.
• What is shared in the room: chat messages, clues, votes (only shown as a count), emotes and your chosen name go to the others in the room. We do not store chat messages on our own servers.

Legal basis: Art. 6(1)(b) GDPR (you want to play online).

Unity processes the data on our behalf under its data processing addendum: unity.com/legal/unity-data-processing-addendum-dpa. Unity is based in the USA; data may be transferred to the USA.

3. Your Steam ID in the room (Steam version only)

When you play the Steam version online, the game sends your Steam ID (the fixed number of your Steam account) to the other players in your room. It is part of the room’s player list.

• Why: so each player can remember how loud they want to hear you, or whether they muted you, even if you change your name. Each player stores this setting only on their own computer (together with your Steam ID).
• We do not store Steam IDs on our own servers. They travel over Unity’s connection (section 2).
• Without Steam no Steam ID is sent; the volume is then remembered by name.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest: other players should be able to turn you down or mute you permanently).

4. “Open rooms” list

If you create a room and choose “in the list”, it is visible to all players of the same game version in the “Open rooms” list. Visible are: room name (a random number such as “Fire 2317”, not a name you type), the room’s language(s), number of players and free seats, game mode, whether scares are on, and whether a round is running. The list runs through Unity (Lobby/Sessions, section 2). If you choose “code only”, the room does not appear in the list. Legal basis: Art. 6(1)(b) GDPR.

5. Voice chat (optional, off by default)

Only if you switch on voice chat in the options do we use Vivox (Unity) as a processor.

• Your voice is sent live to the others in the room and is not stored.
• According to Unity, Vivox stores for up to 30 days: a truncated IP address, a user ID and a device ID (docs.unity.com/en-us/vivox-core/privacy-overview, retrieved 24.09.2026).
• Legal basis: your consent by switching it on (Art. 6(1)(a) GDPR). You can withdraw it at any time by switching voice chat off.

6. Reporting players and reporting bugs

Both go to our own report service, shared by all BYTJ Studios games.

• Where: on our web space at Strato in Germany, sent only encrypted (HTTPS). Strato processes the data on our behalf. Until the report service is set up, reports stay only on your computer in the game’s folder and are sent later only with your consent, never silently.
• Always included: a report number (shown to you as confirmation), game, version, language, type of report, time (UTC). No name, no e-mail, no Steam ID.
• Reporting a player (under “Player voices”): the room (derived from the room code), the seat number of the reported person and one of four fixed reasons (insults or harassment, disrupts on purpose, inappropriate language, something else). No free text, no name.
• Reporting a bug (F8 key): type (bug, stuck, suggestion) and your short text. Only if you tick it: the game’s log (your Windows user name is removed first) and system information (operating system, processor, memory, graphics card and graphics memory, screen resolution, graphics level). Nothing is ticked by default.
• No IP addresses: the report service does not store IP addresses. Against flooding it only uses a value that changes daily, kept for at most 1 hour. At most 5 reports per hour.
• Deletion: reports after 90 days, attachments (log, system information) 30 days after the report is closed.
• Legal basis: Art. 6(1)(f) GDPR (protecting players, fixing bugs); for attachments your consent by ticking (Art. 6(1)(a) GDPR).
• Because reports contain no name, we can only match them to you later by the report number.

7. Steam

If you buy and launch the game through Steam, Valve’s privacy policy also applies (store.steampowered.com/privacy_agreement). We have no influence on it. The Steam version uses Steam for achievements, the “now playing …” status (your status such as “in the lobby” is visible to your Steam friends), the Steam overlay and the Workshop (section 8).

Inviting and joining friends: while you are online in a room with a free seat, its room code is part of your Steam status. This lets your Steam friends join your room through an invite or “Join game” in their friends list.

8. Steam Workshop (word packs, Steam version only)

• Subscribing: you subscribe to and download word packs through Steam (Valve). The game reads subscribed packs from your computer.
• Uploading: if you upload your own pack, this happens through Steam, which asks you to accept the Workshop agreement. The pack’s content (title, description, words, clues, preview image) is public, together with your Steam display name as its creator. You can delete your pack through Steam.
• Reporting packs: the “Report” button hides the pack for you, remembers this on your computer and opens the pack’s Workshop page on Steam, where you can report it.
• Packs by other players are off by default until you allow them in the options.
• Legal basis: Art. 6(1)(b) GDPR; Valve’s privacy policy applies to Steam.

9. Technical diagnostics from Unity

The Unity engine sends technical diagnostic data to Unity Technologies at startup (project setting “Engine Diagnostics”, switched on in the current version of the game). This is technical information about the engine and the device, not about how you play. Unity decides which details exactly are sent (unity.com/legal/privacy-policy). Unity analytics, crash reporting and ads are off. Legal basis: Art. 6(1)(f) GDPR (stable operation of the engine).

10. Block list for word packs (planned, not active yet)

Planned: at startup the game downloads a small list of blocked word packs from our site https://bytj-studios.com/ays/sperrliste.json. This technically transmits your IP address to our server (Strato). The request contains no player ID. Strato logs this request like any page view (part A, section 1); we do not analyse it. Legal basis: Art. 6(1)(f) GDPR (removing inadmissible content quickly). The download is not built into the game yet and does not happen until then.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can also complain to a data protection supervisory authority.

• Write to us at kontakt@bytj-studios.com.
• Because the game only knows an anonymous ID, please tell us the name you used online and roughly when you played. We forward deletion requests to Unity.
• For a player report or bug report, please give us the report number.

Last updated: 3 October 2026