Privacy policy

1. Data controller

2. Providing and securing the website

When you access the website, the server infrastructure processes technically necessary connection data, including your IP address, the time and requested address, and information sent by your browser. This enables page delivery, troubleshooting and protection against misuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.

Our hosting provider is STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Recipients are the controller and STRATO and its infrastructure subprocessors as needed to deliver the service. Further information is available in STRATO’s privacy information. General access logging is not enabled on the current web proxy. Technical error and security logs may contain connection data relating to specific incidents. Data is retained only for as long as the relevant operational or security purpose requires, unless a statutory retention obligation applies.

The browser interface, 3D library and audio files are loaded from our domain. The one exception is the optional “Your own music” feature described in section 5, which contacts YouTube only after you choose it. We do not embed external Google Fonts. Weather data and AI-generated village stories are retrieved on the server; merely visiting the website does not cause your visit to be forwarded as a request to an AI service.

3. Local preferences and consent

Your consent choice is stored under jev.privacy.v1 in your browser’s local storage. It is valid for 180 days and is removed when the site next detects expiry. If you do not return, the stored value remains until your browser deletes it. The stored information includes your choice, the time and the notice version. This allows us to respect and document your choice (Article 6(1)(c) in conjunction with Article 7(1) GDPR; Section 25(2), no. 2 of Germany’s Telecommunications Digital Services Data Protection Act, TDDDG).

The keys jev.music, jev.ambience jev.pomodoro.sound and jev.chat.sound remember your selected sound settings, and jev.volume.music, jev.volume.ambience, jev.volume.messages and jev.volume.youtube remember the volume levels you set (whole numbers from 0 to 100). jev.chat.v1 remembers whether the village chat is collapsed. These preferences are not used for advertising and remain in your browser until changed or deleted. They support the features you request (Section 25(2), no. 2 TDDDG; Article 6(1)(f) GDPR). You can delete local data through your browser’s website settings.

4. Google Analytics — only with consent

If you choose “Allow analytics”, we use Google Analytics 4 (measurement ID G-0M7NKWJ8PQ) to analyse website usage statistically. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data processed includes pages viewed, usage events, technical browser and device information, and pseudonymous cookie identifiers. Your IP address is technically transmitted when connecting to Google. According to Google, GA4 does not log or store individual IP addresses.

The legal bases are your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Before you consent, neither the Google script is loaded nor an analytics ping is sent. Rejecting analytics does not affect your ability to use the village.

We disable Google Signals and personalised advertising features in the website tag. For the page view, we send the page address without query parameters or a fragment, and no referrer. We do not assign our own User-ID. The analytics cookies _ga and _ga_0M7NKWJ8PQ have a configured lifetime of up to 180 days, without renewal on every visit. Google Analytics user-level and event-level retention is configured to two months, without resetting user retention on new activity. Google applies retention-setting changes after 24 hours and deletes expired records through its scheduled process. Detailed location/device collection and enhanced measurement are disabled. Aggregated reports may remain available for longer.

Google LLC in the United States and Google’s subprocessors may also receive data. Transfers to third countries are subject to the safeguards set out in Google’s data processing terms, particularly standard contractual clauses and, where applicable, an adequacy decision for certified recipients. Further information is available in Google’s privacy policy and the Analytics privacy controls.

You can withdraw consent at any time through “About” → “Privacy settings”. We then disable analytics, remove accessible analytics cookies and reload the page without Analytics. Withdrawal applies to future processing and does not affect the lawfulness of processing before withdrawal.

5. Your own music (YouTube) — only when you choose it

In “Village sounds” you can paste a link to one YouTube video and play it instead of the village music. Until you do, the page makes no request to YouTube or Google for this feature. After you paste a link, we show a notice, and only if you confirm it does your browser load YouTube’s player script (https://www.youtube.com/iframe_api) and YouTube’s privacy-enhanced player (https://www.youtube-nocookie.com). Declining the notice loads nothing.

When you confirm, YouTube, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, receives your IP address and browser information, the video you chose and our site address (https://jevsvillage.com, without any page path) as the referrer. YouTube may store or read its own cookies or similar data in your browser and may show advertisements; what it does with that data is described in Google’s privacy policy. Google LLC in the United States and Google’s subprocessors may also receive data, subject to Google’s safeguards for transfers to third countries.

The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG, given by confirming the notice. You can withdraw it at any time by pressing “Stop”, which removes the player from the page so your browser no longer contacts YouTube; withdrawal applies to future processing. Your choice of consent here is separate from the analytics choice in section 4, and rejecting analytics does not stop you from playing your own music.

We do not store your link or the video, do not send them to our servers, and do not pass them to Jev, the villagers, the village story or any recording. The link and the video identifier exist only in the open page and are gone when you close or reload it, and you are asked again on your next visit. The only thing remembered is the volume level for your video (jev.volume.youtube, see section 3). We do not host or copy any YouTube content. The video is played from YouTube in YouTube’s own player, with its controls, branding and any advertising; rights in the video remain with the rights holders and YouTube.

6. Contacting us

If you contact us by email or phone, we process your contact details and message to handle your enquiry. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries, or otherwise Article 6(1)(f) GDPR (responding to your enquiry). Once the matter is resolved, the data is deleted when no statutory retention obligations or legitimate reasons for further storage remain.

7. Read-only village and historical submissions

The website requires no registration. Public village-event submissions are closed: requests to the former public endpoint are rejected before their text is processed by the simulation or sent to an AI provider. The AI services Jev / TypeSafe and Atlas Cloud generate fictional village decisions and stories on the server. They do not receive your browsing activity from the website.

Before 27 September 2026, the event API could send submitted text to these services and publish accepted events. As part of its retirement, legacy IP rate-limit records and raw submission text are removed from the active application records and local checkpoint backups. Generated paraphrases and provider-held copies require a separate review if they concern a real person. Contact the controller with an approximate date and description if you previously submitted personal data.

Submission audit records in the active application are deleted after seven days by a daily maintenance task. Copies in local checkpoint backups expire after 30 days and are restricted to authorized administrators. These periods support short-term troubleshooting and recovery. Records subject to a specific legal preservation duty may require separate restricted retention. Access, erasure and objection requests can be sent to the controller above.

8. Your rights

Subject to the applicable legal conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). Where processing is based on legitimate interests, you may object on grounds relating to your particular situation (Article 21). You may withdraw consent at any time with effect for the future (Article 7(3)).

You may lodge a complaint with a data protection supervisory authority (Article 77 GDPR), particularly the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

You are not required to consent to analytics. Without technically necessary connection data, the website cannot be delivered. We do not make automated decisions about you with legal or similarly significant effects within the meaning of Article 22 GDPR; decisions by fictional villagers do not concern real people.