Privacy
Last changed: 11 October 2026
Midnight Cafe is a browser game in which you furnish a cafe room, meet other people and chat. This page says which data the game keeps about you, why, and who else handles it.
Who is responsible
Philipp Schickling (private person, Germany). Contact: kontakt@philipp-schickling.de. The postal address is on the imprint page.
What is kept
| When | What |
|---|---|
| You play as a guest | A random account number and a guest name. No email, no real name. |
| You register with email | Your email address, your password in scrambled form (it cannot be read by us), and the name you choose for the cafe. |
| You sign in with Google | Google passes on your email address, your Google name and profile picture address, and an account number. We use the email to recognise you. The name other players see is the one you pick yourself. |
| You play | Your character's look, your rooms and furniture, beans and badges, pets, friends and friend requests, what you write in room chat, private messages, questions and answers on Q&A boards, guestbook entries, trades, room visits and likes, and where your character currently stands. |
| You talk to a bot | The message you address to a bot and a few recent chat lines of that room are sent to an AI service, which writes the bot's answer. |
| You ask for a new password | An email with a reset link is sent to your address. |
| Always | The servers that deliver the game see your IP address and browser type and keep short technical logs, as every website does. |
Room chat is visible to everyone in the room. Private messages are visible to you and the person you write to. Your cafe name, your character, your rooms and your project card are public inside the game.
What is stored in your browser
The game keeps your sign-in, your settings and the name of the account last used on this device in your browser's own storage, so you stay signed in. There are no advertising or tracking cookies.
Visitor statistics. To see how the game is used and where it fails, we count events: the page was opened, the game finished loading, a room was entered, an item was bought or placed, and how long a visit lasted. These counts go to PostHog (PostHog Inc., servers in the USA). They contain no chat texts, no names and no email addresses. No cookie is set and nothing extra is stored in your browser for this. Before you start the game, an event carries a random number that exists only while the page is open; in the game it carries your account number, so that we can tell a returning player from a new one. Your internet address is used to deliver the request and is not kept with the events. The legal basis is our legitimate interest in running and improving the game (Art. 6 (1) f GDPR). You can object at any time by writing to the address in the imprint.
Why, and on what legal basis
- To run the game and your account for you: performance of the service you asked for (Art. 6(1)(b) GDPR).
- To keep the service safe and working, for example technical logs, limits against abuse and moderation of public rooms: legitimate interest (Art. 6(1)(f) GDPR).
Who else handles the data
| Service | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | Frankfurt, Germany (EU) |
| Cloudflare | Delivers the game and carries the live connection between players | Worldwide network, company in the USA |
| Amazon Web Services (SES) | Sends account emails | Frankfurt, Germany (EU) |
| Only if you choose "Continue with Google" | USA / EU | |
| OpenRouter and the AI model provider behind it (currently DeepSeek) | Writes the answers of the cafe bots | USA and other countries outside the EU |
| Internet radio stations | Only if a radio is switched on in a room you are in: your browser fetches the audio stream directly from the station, which then sees your IP address | Depends on the station |
Where data leaves the EU, this happens on the basis of the providers' standard contractual clauses or their certification under the EU-US Data Privacy Framework. Please do not put personal or confidential information into messages to bots.
How long
- Account and game data: until you ask for deletion.
- Guest accounts that are no longer used may be removed after 12 months without a visit.
- Technical logs: a few days to a few weeks, depending on the provider.
Your rights
You can ask what is stored about you, have it corrected or deleted, restrict or object to its use, and receive your data in a portable form. Write to kontakt@philipp-schickling.de from the email address of your account, or tell us your cafe name. You also have the right to complain to a data protection authority, for example the one where you live.
Age
Midnight Cafe is not meant for children under 16.
Changes
If the game starts handling data differently, this page is updated and the date at the top changes.