← Back to home

Legal — Privacy policy

Last updated: 25 October 2026

Privacy policy

How we process personal data when you visit anymate.dev and sign up for Early Access, and your rights under the EU General Data Protection Regulation (GDPR) (Datenschutzerklärung).

01Controller (Verantwortlicher)

The controller responsible for processing personal data on this website under Art. 4 (7) GDPR is:

Robert Leonhard and Lucas Schwender Jain
Roscherstraße 4
10629 Berlin, Germany
Email: [email protected]

Full details are in our imprint. We have not appointed a data protection officer, because we are not required to (Art. 37 GDPR, § 38 BDSG).

02Overview

  • When you visit the website, our hosting provider Cloudflare processes technical connection data (such as your IP address) to deliver the pages and keep them secure.
  • If you sign up for Early Access, we store your name, your email address, the time of sign-up and your consent to tell you when the anymate beta is released.
  • If you write to us with the contact form or by email, we use your message and contact details only to answer you.
  • The website stores a few settings in your browser, and the game on the home page a measure of how fast your device draws (see cookie policy). It sets no cookies of its own.
  • Only if you choose “Accept all” in the cookie notice do we use Cloudflare Web Analytics, which sets no cookies, to count visits and measure page speed. We use no other analytics or tracking, no advertising and no social media plugins.
  • Apart from that analytics script, which your browser loads from Cloudflare only with your consent, all fonts and scripts come from our own domain (anymate.dev, and media.anymate.dev for larger files such as the game).
  • We do not sell your data or use it for profiling, and we make no automated decisions about you within the meaning of Art. 22 GDPR.

03Hosting and server logs (Hosting und Server-Logfiles)

The website is hosted on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). Cloudflare delivers the pages through its worldwide network and protects them against attacks and abuse.

Whenever you open a page, your browser sends data that Cloudflare processes and may keep in server logs:

  • your IP address and the country derived from it
  • date and time of the request
  • the page or file requested, the HTTP method and status code, and the amount of data transferred
  • the referring page (referrer), if your browser sends it
  • your browser type and version and operating system (user agent)

Purpose: to deliver the website, keep it stable and secure, and detect and fend off attacks. Legal basis: our legitimate interest in a secure, working website, Art. 6 (1) (f) GDPR. We do not combine this data with other data or use it to identify you.

Retention: we do not receive Cloudflare’s raw access logs, as we have not set up any log export (such as Cloudflare Logpush). The Cloudflare dashboard shows us aggregated traffic statistics and, for troubleshooting and security, samples of individual requests and of requests that Cloudflare blocked or challenged, which can include the IP address. Cloudflare keeps this data only for a limited period under its own retention rules, which are described in its privacy policy; we do not copy or store it ourselves.

Cloudflare processes this data on our behalf under a data processing agreement (Art. 28 GDPR). More information: Cloudflare’s privacy policy.

04Media from media.anymate.dev

Larger media, such as the videos in the 2D workflow demo and the game on the home page (its code, models and textures), are stored in Cloudflare R2, Cloudflare’s object storage, and served from our own subdomain media.anymate.dev. When your browser loads them, Cloudflare processes the same connection data as described under Hosting, for the same purpose, on the same legal basis (Art. 6 (1) (f) GDPR) and under the same data processing agreement.

The game (The Mountain Pass) runs entirely in your browser. To choose a quality level your device can hold, it reads the name of your graphics card and measures how fast it draws a short test scene; once you press Play, the result is kept in your browser’s local storage (see Browser storage). The game sends nothing about your device, or about how you play, to us or to anyone else.

05Early Access sign-up

You can leave your name and email address in the Early Access form so that we can tell you when the anymate beta is released. The form has a mandatory checkbox: “Yes, anymate may email me when the beta is released.”

Data: the name and email address you enter, the date and time of your sign-up, and which version of the checkbox text you agreed to, so that we can show that you consented (Art. 7 (1) GDPR). If you sign up again with the same address, the new entry replaces the old one.

Purpose: to email you when the anymate beta is released. We only use your email for this.

Legal basis: your consent, Art. 6 (1) (a) GDPR, which you give by ticking the checkbox and submitting the form.

Withdrawal: you can withdraw your consent at any time, without giving reasons, by emailing [email protected]. We then delete your entry. Withdrawal does not affect the lawfulness of processing before it (Art. 7 (3) GDPR).

Storage: the entries are stored in Cloudflare Workers KV, Cloudflare’s key-value database, which Cloudflare operates for us as a processor (see Recipients). Only we can read the list.

Retention: we keep your sign-up for up to 6 months after you sign up; it is then deleted automatically. If you withdraw your consent earlier, we delete it straight away.

Is it required? No. Signing up is voluntary; without your name and email address we cannot notify you.

Protection against abuse

To stop automated mass sign-ups, the server limits how many sign-ups can come from one connection per hour. It does not store your IP address for this: it keeps a counter under a keyed hash (HMAC) of the IP address and the current hour, which is deleted automatically after at most one hour. Names, email addresses and IP addresses are not written to logs. Legal basis: our legitimate interest in protecting the form from abuse, Art. 6 (1) (f) GDPR.

06Contact form and email (Kontaktformular und E-Mail)

You can write to us with the contact form at anymate.dev/contact or by email to [email protected].

Data: the name, email address and message you enter in the form, and the time you send it; if you email us, your email address, your name if you give it, and the content of your message. A message sent with the form reaches us as an email in our mailbox [email protected]. The website does not store it.

Purpose: to answer your message. We use your details only for this.

Legal basis: Art. 6 (1) (b) GDPR if your message concerns a contract with us or steps before one; otherwise our legitimate interest in answering enquiries, Art. 6 (1) (f) GDPR.

Recipients: Cloudflare passes messages from the form on to our mailbox (Cloudflare Pages Functions, Workers and Email Routing) and processes them on our behalf as a processor under our data processing agreement (see Recipients). Our mailbox is hosted by Google (Google Workspace, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which also processes your message on our behalf as a processor.

Retention: we delete your message and our reply once your request is dealt with, at the latest after 6 months, unless the law requires us to keep them longer.

Is it required? No. Without your email address and message we cannot answer you.

Protection against abuse

To stop automated mass messages, the server limits how many messages can come from one connection per hour. It does not store your IP address for this: it keeps a counter under a keyed hash (HMAC) of the IP address and the current hour, which is deleted automatically after at most one hour. The form also has a hidden field that only bots fill in. Names, email addresses, messages and IP addresses are not written to logs. Legal basis: our legitimate interest in protecting the form from abuse, Art. 6 (1) (f) GDPR.

07Browser storage (no cookies)

The website sets no cookies of its own. It keeps a few small entries in your browser’s local storage and session storage: your choice in the cookie notice, the video quality you picked in the demo player, whether the opening animation and a demo hint have already played during your visit, and, for the game on the home page, how fast your device draws (with your graphics card’s name and screen size) and a marker while the game runs. The cookie policy lists each entry and how long it lasts.

These entries stay in your browser and are not sent to us. We use them only to provide functions you use on the website. Legal basis: § 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), as storing them is strictly necessary for these functions, and Art. 6 (1) (f) GDPR. You can delete them at any time in your browser settings.

08Cloudflare Web Analytics (only with your consent)

If you choose “Accept all” in the cookie notice, we use Cloudflare Web Analytics, a service of Cloudflare, Inc. (see Hosting). Your browser then loads a small script from static.cloudflareinsights.com, which sends measurements of the page you are viewing to cloudflareinsights.com. If you choose “Essential only”, or make no choice, the script is not loaded.

Data: the address of the page you view and of the page you came from (referrer), the time of the page view, technical performance data your browser records for that page (such as load times, the Core Web Vitals and memory use), and the browser, operating system and device type derived from your browser’s user agent. Your IP address is transmitted with the request, as with any connection; according to Cloudflare, it is used to determine your country and then discarded at the nearest Cloudflare data centre, and is not stored in Cloudflare’s databases or logs for this service. We only see aggregated statistics, such as visits and page views per page, country, browser or referring website, not individual visitors.

No cookies, no tracking: the script sets no cookies and stores nothing in your browser (no local storage or similar). It does not recognise you across visits or websites and does not fingerprint you by your IP address, user agent or other data.

Purpose: to see how many people visit the website and which pages they view (reach), and to measure and improve how fast the pages load.

Legal basis: your consent, Art. 6 (1) (a) GDPR, and, for reading this information from your browser, § 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Withdrawal: you can withdraw your consent at any time with effect for the future: open “Cookie settings” at the bottom of the home page and choose “Essential only”. From the next page you open, the script is no longer loaded. Withdrawal does not affect the lawfulness of processing before it (Art. 7 (3) GDPR).

Processor and transfer: Cloudflare processes this data on our behalf under our data processing agreement (Art. 28 GDPR). It may be processed outside the EU, including in the USA, on the basis of the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses (see Recipients and transfers).

Retention: according to Cloudflare, the complete measurement data is kept for 7 days and then reduced to a sample of about 10% for long-term statistics. The dashboard shows us the statistics of the past six months.

09Fonts and scripts

The fonts (Aeonik Pro), the React runtime the pages are built with, the video player and all other scripts and libraries are served from our own domain (the game’s code from our subdomain media.anymate.dev, see Media). Your browser does not connect to third-party font services or content delivery networks (such as Google Fonts) when you visit this website, so no data is passed to them. The only exception is the Cloudflare Web Analytics script, which your browser loads from Cloudflare only if you consent to it.

10Links to social media

The website links to our profiles on LinkedIn, Instagram and X. These are plain links: there are no embedded plugins, buttons or feeds, so no data is sent to these networks while you are on our website. Only when you click a link does your browser open the network’s website, and from then on the network’s own privacy policy applies: LinkedIn, Instagram, X.

11Recipients and transfers outside the EU

Our processors are Cloudflare, Inc. (hosting, content delivery, R2 media storage, Workers KV for the Early Access list, Workers and Email Routing for the contact form and, with your consent, Web Analytics) and, for our mailbox [email protected], Google Ireland Limited (Google Workspace). We have data processing agreements with both under Art. 28 GDPR. We do not pass your data to anyone else unless the law requires us to.

Cloudflare is based in the USA and operates data centres worldwide, so your data may be processed outside the European Union. Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR); in addition, our agreement with Cloudflare includes the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). Google may also process data in the USA; Google LLC is certified under the same framework, and Google’s data processing terms include the Standard Contractual Clauses.

12Your rights

You have the right to:

  • access the personal data we hold about you (Art. 15 GDPR)
  • have incorrect data corrected (Art. 16 GDPR)
  • have your data erased (Art. 17 GDPR)
  • restrict its processing (Art. 18 GDPR)
  • receive the data you gave us in a common machine-readable format (data portability, Art. 20 GDPR)
  • withdraw your consent at any time with effect for the future (Art. 7 (3) GDPR)

Right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. We then stop processing it unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

To exercise any of these rights, email [email protected].

13Right to lodge a complaint

You have the right to complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work or where the alleged infringement took place. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
(Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59–61, 10555 Berlin, Germany
www.datenschutz-berlin.de

14Changes to this policy

We update this policy when the website or the law changes, for example if we add new features. The current version is always on this page. Last updated: 25 October 2026.