Privacy policy

This site works without third-party advertising and without third-party analytics scripts. A voluntary portal statistic counts views and selected actions without a visitor ID. Whatever data is processed anyway is listed here — completely, and in the order in which it happens.

Controller

Severin Lüdcke, Jinjja World, Goethestraße 42, 73630 Remshalden, Germany
Email: hello@jinjja.world — see the imprint. No data protection officer has been appointed; the requirements of § 38 of the German Federal Data Protection Act (BDSG) are not met.

When you simply visit the site

The server processes the technically necessary connection data (IP address, time, requested address, browser identifier). The legal basis is Art. 6(1)(f) GDPR — the interest in being able to deliver the site at all and to detect attacks. For the visitor count without cookies, this data is only processed briefly; see below.

No cookies without a reason. If you only read, you don’t get one. The fonts are hosted on our own server; nothing is fetched from Google Fonts or any other CDN.

Visitor count without cookies

So that we know how many people use the portal (jinjja.de and jinjja.club), the game website jinjja.world and the game, our own server counts visits — without a cookie, without storing anything on your device and without third-party services. When a page is requested, the server combines your IP address and your browser identifier with a random value that is newly generated every day and derives a one-way identifier from them (SHA-256, truncated). Its only purpose is to make sure the same browser counts as one visitor per day. Each of these addresses counts separately: the identifier is only valid for the address on which it was created. The IP address itself is not stored for this. The random value and the identifiers are deleted at the end of the day (on the first request after midnight); after that, no identifier can be linked to an address any more, and visits on different days cannot be connected with each other.

Only daily counters are kept: the number of visitors and page views, the rough source (search engine, social network, other website, direct), for referrals from other websites only their domain (never the path or search term), the site section, the page requested and the device class (phone, tablet, computer). Requests from search engine crawlers and similar programs are counted separately. In the game we also count how many accounts entered the game world on a given day, how many of them are new and the maximum number online at the same time; here too, a one-way identifier is formed from the account ID only with the daily value and deleted with the day. On the portal we also count, per day, how often our own pointer to the game Jinjja World was in view, how often it was clicked, how often its question was answered and how often its audio sample was played — as a plain number per site section and version of the pointer, without any identifier. Which version you see is decided at random when the page loads; this is not stored anywhere.

We keep the daily counters for 400 days and the list of requested pages for 90 days. The numbers are only visible to the editorial team in the protected admin area; they are not passed on and not combined with any other data. The legal basis is Art. 6(1)(f) GDPR — our interest in knowing the reach of the portal and the game without building profiles. If your browser sends the “Global Privacy Control” or “Do Not Track” signal, we don’t count your page views. Regardless of that, you can object to this counting at any time (Art. 21 GDPR).

Images from third parties

Posters, stills and portraits in the editorial catalog are partly loaded directly from the source’s servers — mostly image.tmdb.org (TMDB, USA). The respective provider learns the IP address and browser identifier of the request.

This can’t be switched off without making the site unusable: a catalog without posters isn’t a catalog. That’s why it’s stated here and not in the consent banner — pretending there’s a choice where there isn’t one would be the worse solution. The legal basis is Art. 6(1)(f) GDPR.

Consent and storage on your device

Necessary

Payload’s session cookie — only after you log in, valid for 30 days, httpOnly and not readable by JavaScript. Plus the storage of this choice itself and, when a page checks your login with jinjja.world, two short-lived markers: jinjja-sso (30 minutes) and jinjja-sso-n (10 minutes). They record only that the check just ran and protect against forged links. They exist only in the browser; the Jinjja World apps (Steam, Android, iOS) set no cookies. Likewise only in the browser: when you sign in with Google, the cookie jw_google (at most 10 minutes, see “Signing in with Google”). Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG); no consent required.

Convenience

kcp.territory in local storage: the country last chosen in the “Where to stream?” box. Only with consent; without it, the box starts over with the default country on every visit.

Statistics on the portal

Only with your consent do we count public page views, clicks to Jinjja World and to the game entry, trailer starts and solved listening exercises on the portal. We also count successful email confirmations of new accounts if the current statistics consent exists in this browser at the time of confirmation. Only a daily counter is increased; email address, account ID and confirmation link do not enter the statistics. These confirmations are not attributed to any source or ad. Older consents do not activate this added purpose. Only defined page groups, the type of action and a rough source category (search engine, social network, internal, direct or other) are transmitted. The original referring address, search terms, account data and form entries are not transmitted. For the portal statistics, our server stores only daily counters — no individual visits, IP addresses or visitor IDs. Counters older than 370 days are removed at the next count. The legal basis is your consent (Art. 6(1)(a) GDPR).

You can withdraw a given consent at any time using the “Privacy settings” button in the page footer (Art. 7(3) GDPR).

Voluntary game statistics in Jinjja World

This additional measurement has been active since 26 September 2026. It has its own consent in the game; consenting to the portal statistics does not switch it on.

We want to find out whether new game accounts reach the world and then successfully complete a first learning activity. You decide on this separately in the game settings. The measurement is switched off there by default; you can play regardless of your decision. A consent is valid for one year at most. The legal basis for the voluntary measurement is your consent (Art. 6(1)(a) GDPR).

With consent, we count the confirmed display of the game world and the first learning success afterwards that the game accepts and saves, each once per account. Merely logging in, creating a profile, opening a task, story progress and failed attempts do not count. Game profiles created before activation on 26 September 2026 are not recorded retroactively.

For this, the game server stores on the account your choice with version and time, the time of the first recorded world entry and a yes/no marker for the recorded learning success. This link to the account prevents double counting; storage in the game is therefore not completely anonymous. No lists of individual answers, words, tasks or places visited are created for these statistics. Email address, display name, advertising and visitor IDs are not stored for them.

Only the UTC date and the two daily counts reach the internal statistics for the portal’s editorial team and operations. The account markers are not transmitted. There is no link to your original portal visit or to any ad. Daily numbers are kept for 370 days and removed during the daily clean-up.

Since version 2 of the choice, additionally: performance measurement. With the same consent, the game reports at most once a day how smoothly it runs on your device — only in rough levels: device type (phone, tablet, computer), graphics path (ASTC, WebP, Canvas), frame rate (under 20, 20 to 27, 28 or more frames per second), stutters per minute and whether the graphics were lost during the session. For this, only the day of the last report is stored on the account so that nothing is counted twice. From the reports, the game server stores only daily totals per feature — without account, without device ID and without linking the features to each other; they stay within the operation of the game, are not passed to the portal and are removed after 370 days like the other daily counts. A consent to the first version of the choice does not cover this; the game asks again.

You can withdraw your consent at any time in the same game settings. After that, no further game events are counted for these statistics. Your stored choice and any account markers already set remain until the account is deleted; they are not supplemented with further game events and prevent double counting if you consent again later. When the account is deleted, these entries are removed as well. Daily numbers that have already been aggregated contain no account ID and remain until the end of their retention period. Withdrawing the portal statistics in the page footer is a separate choice.

Account, ratings and watchlist

You can read the public portal without an account. An account is required for Jinjja World and personal account features. We store your email address, a password hash and a display name you choose. If you sign in with Google, the identifier of your Google account is added (see “Signing in with Google”). Through Steam, the SteamID is added (see “Signing in with Steam”). The legal basis is Art. 6(1)(b) GDPR. Ratings and watchlists are linked to the account and to nothing else.

Deletion. In your account under “Delete account” — or on request to the address above. For security, you confirm the deletion via a link we send to the account’s address. In the game (Settings → “Account and data”) and on jinjja.world you confirm it with your password instead; then it happens immediately. After that, the account and all data belonging only to it are removed in one go: ratings, watchlist, your own lists, friendships and your entire progress in Jinjja World. Remains stay in our backups until they expire: game progress after 14 days, account data after 7 days.

Signing in with Google

In the game (game.jinjja.world) and in the sign-in dialog on jinjja.world – which is also how you sign in here on the portal – you can also log in with your Google account, in addition to email address and password. You can create a new account this way only in the game; in the sign-in dialog on jinjja.world it only works with an existing account. This is voluntary; if you don’t use the “Sign in with Google” button, none of this affects you.

What happens. When you click it, your browser leaves our site and opens Google’s sign-in (accounts.google.com). You log in to Google there; Google learns that you are signing in to Jinjja and processes your IP address and browser data under its privacy policy. For users in the European Economic Area, the controller is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google may also transfer data to third countries, in particular the USA. We have no influence on that. Your browser then returns to us.

What data we receive and keep. We ask Google for the permissions “openid”, “email” and “profile”. In response Google sends, among other things, the identifier of your Google account, your email address with a note on whether Google has verified it, and your name — we neither use nor store anything else, such as a profile picture. Three things are kept: the identifier (a number that only Google assigns) on the Jinjja account, the email address as the account’s address and, for a new account only, the name as display name (shortened to 40 characters). We do not store Google’s access tokens; they are checked during sign-in and then discarded. We never see your Google password.

Which account you end up with. If Jinjja already knows the identifier of your Google account, you log in to the linked account. Otherwise we look for an account with your email address: if Google has verified the address and the Jinjja account is already confirmed too, your Google access is linked to that account. In doing so, gmail.com and googlemail.com and dots in the name part count as the same address; an addition such as +spiel, on the other hand, makes a separate address. If there is no account yet, we create a new, confirmed one in the game; the confirmation email is skipped because Google has verified the address. Via the sign-in dialog on jinjja.world no account is created: it then tells you to create a new account in the game, and nothing Google has sent us is stored. Editorial accounts do not log in via Google. An account created through Google has a random password that nobody knows; you can set your own with “Forgot password”. The legal basis is Art. 6(1)(b) GDPR (creating and running your account); whether you take this route is your decision when you click.

Cookie. For the duration of the sign-in, at most 10 minutes, the game server sets the cookie jw_google (httpOnly, only over encrypted connections, only for the sign-in path). It contains random check values that ensure Google’s response arrives in the browser that started the sign-in, plus your game language and the place in the game you return to; it is deleted after you return. The legal basis is Section 25(2) no. 2 TDDDG (strictly necessary for the sign-in you use).

Deletion and unlinking. When your Jinjja account is deleted (see above), the stored Google identifier goes with it. If you want to unlink Google without deleting the account, write to the address above. At Google itself you can remove Jinjja’s access at any time at myaccount.google.com/connections.

Signing in with Steam

The Steam edition of Jinjja World (the program via Steam) can log you in with your Steam account. This is not available in the browser or in the Android and iOS apps. If you don’t start the game through Steam, none of this affects you.

What happens. When you start the game through Steam, it fetches a sign-in ticket from Steam and sends it over an encrypted connection to our game server. The server passes the ticket, together with the app ID of Jinjja World and our access key as publisher, on to Valve (Valve Corporation, Bellevue, Washington, USA; partner.steam-api.com); Valve answers with the identifier of your Steam account (SteamID). Valve thus receives the ticket and our key; beyond that, Steam processes your data under Steam’s privacy policy. Data may be transferred to the USA in the process. We do not store the ticket; neither the ticket nor the key appears in any log.

What data we receive and keep. From the ticket we keep only the SteamID (a number): it is stored on the account and is unique, so a SteamID belongs to at most one Jinjja account. For a new account we also adopt the public profile name of your Steam account as the display name: the program reads it from the Steam client and sends it along; if it is missing, our server asks Steam for it (cleaned, at most 40 characters). Anything else Steam might offer, such as a profile picture or a friends list, we neither use nor store.

Which account you end up with. If Jinjja already knows your SteamID, you start in the linked account. Otherwise you choose in the sign-in screen: “Start with Steam” creates a new account, or you log in with your Jinjja account and link it to Steam — for that you enter the password of that account, and afterwards we send a notice email to the account’s address. An account that was created through Steam alone has no email address and no password that anyone knows: it carries a technical placeholder address (steam-…@steam.jinjja.invalid) to which no email is ever sent. Editorial accounts can neither use nor link Steam. The legal basis is Art. 6(1)(b) GDPR (creating and running your account).

Storage on your device. Steam sets no cookie of its own. As after every sign-in, the game server then issues the sign-in key (see “Jinjja World (the game)”); in the Steam edition it is kept in the app’s storage.

Unlinking and deletion. You can unlink Steam in the game settings — with the password of your account, from any device, including in the browser; afterwards we send a notice email and all remembered sign-ins of the account end. An account created through Steam alone cannot unlink Steam (it would be left without any access). If the account has made purchases through Steam (see “Purchases via Steam”), the link also stays in place: every purchase, refund and chargeback has to remain clearly assigned to one account. When your Jinjja account is deleted (see “Account, ratings and watchlist”), the stored SteamID goes with it; for an account without an address you confirm the deletion through Steam instead of a password.

Purchases via Steam

In the Steam edition you can buy Jinjja tokens with real money (see “Purchases with real money” in the terms of use). You pay through your Steam account. Payment details such as your card, bank account or PayPal are seen only by Steam; we never receive them.

What happens. So that the checkout can show prices in your currency, our game server uses your SteamID (from the sign-in ticket, see “Signing in with Steam”) to ask Valve for the country and currency of your Steam account. When you buy, the server sends Valve an order: an order number, your SteamID, the kind, quantity and description of the tokens, the amount, the currency and the language of the purchase dialog. Steam then shows you its purchase dialog. If you approve it there, the server completes the order with Valve and receives the payment status and a transaction number from Steam. At least once a day the server fetches from Valve the list of orders since the last request in order to detect refunds and chargebacks. The recipient is Valve Corporation (Bellevue, Washington, USA); otherwise the Steam privacy policy applies. Data may be transferred to the USA in the process.

What we store. For each order we store in the game’s database the order and transaction numbers, your Jinjja account and your SteamID, the kind, quantity, amount and currency, the status at Steam and the times. In your account, every purchased token carries the number of its purchase, so that a refund or chargeback can find it again, and the 72 hours during which it cannot be passed on after the purchase.

Legal bases. Art. 6(1)(b) GDPR (processing the purchase and crediting the tokens), Art. 6(1)(c) GDPR (retention obligations under commercial and tax law) and Art. 6(1)(f) GDPR (our legitimate interest in preventing fraud with someone else’s or stolen means of payment: the lock after the purchase and the daily reconciliation).

How long. We keep the orders as accounting records for as long as retention obligations under commercial and tax law require, even if you delete your account earlier; after that we delete them. The tokens themselves go with your account.

Information about people

This site has profile pages for actors, directors and hosts of Korean productions. The following is information under Art. 14 GDPR — the data was not collected from the people concerned themselves.

What data

• Name, where applicable in Korean script and romanization
• A reference to a portrait photo at the source provider
• Participation in productions, including role and number of episodes
• Identifiers in public film databases

Not recorded are address, contact details, place of birth, information on health, religion, political views, relationships or criminal proceedings.

Where from

From publicly accessible film databases, mostly TMDB.

Why

Art. 6(1)(f) GDPR. The interest is making Korean productions findable through the people who worked on them. The presentation is limited to professional activity — the sphere in which being mentioned must usually be accepted.

How long

For as long as the related productions are listed in the catalog.

Correction and deletion

Anyone who wants information about themselves corrected or their profile page removed can write to hello@jinjja.world with a link to the page concerned. Proof of identity is only requested where there are reasonable doubts (Art. 12(6) GDPR). We reply within one month.

The right to object under Art. 21 GDPR also applies. Since the processing is based on a legitimate interest, an objection on grounds relating to your particular situation is enough — it doesn’t need to be justified in order to be examined.

Jinjja World (the game)

The “Play” button in the page header takes you to the game at game.jinjja.world, operated by the same controller. A Jinjja account is required; there is no guest access. Portal and game use the same account but manage their sessions separately. The link to the game passes neither login data nor a character in the address. Logging in to the game is verified by its server with the portal. The resulting game session with account ID, display name and signed session token is stored in the game’s local browser storage. You create and manage your character in the game.

Staying logged in. After you log in to the game or on jinjja.world, the game server sets the cookie jw_anmeldung for jinjja.world and its subdomains (httpOnly, not readable by JavaScript, only over encrypted connections). It contains a random login key; the server stores only a check value (hash) of it, plus the device type (browser or app), creation, last use and expiry — at most eight devices per account. The key is valid for 30 days and is extended each time you use it, so you are logged in again after closing the window or after a break without re-entering your password. In the apps it is kept in the app’s own storage instead. Next to it there is the cookie jw_angemeldet with the content “1” and no identifier: it only tells jinjja.world that someone is logged in in this browser, so the site does not have to ask the game server on every visit. With “Log out” (in the game, on jinjja.world or here in the portal) it ends immediately; when the account is deleted, all keys go with it. The legal basis is § 25(2) no. 2 TDDDG (strictly necessary for the login you use) and Art. 6(1)(b) GDPR.

After registration. If you create an account in the game, the device keeps a random pickup ticket in local storage (jw_abholschein) for at most 24 hours; the game server keeps only a check value of it in memory. As soon as you have confirmed your address via the link in the email, the ticket logs you in on this device — without entering anything again. After that, on expiry or when you log out, it is deleted. The confirmation page in the portal also logs you in right away. The legal basis is as above.

The game creates save data (progress, inventory, quests, friendships) and, while you play, transient data such as position, chat lines and presence. This is stored in a database on the same server. The legal basis is Art. 6(1)(b) GDPR.

Voice chat. If you switch it on, a direct connection to the other participants is established. If that fails, a relay on the same server forwards the packets. In the process, the IP addresses of those involved become visible — this is technically unavoidable for voice connections. Conversations are not recorded.

The game website jinjja.world

At jinjja.world we present the game. The controller is the same as for this portal (see above); the imprint also applies there. The site is hosted on the same server in Frankfurt am Main (see “Hosting and logs”).

When you simply visit it, jinjja.world is a static site without cookies (only people who log in get the login cookie described under “Jinjja World (the game)”). Fonts, images, sound and videos come from our own server; no third-party services are embedded. When delivering the site, the server processes the technically necessary connection data just like the portal: the IP address only for delivery and for an abuse limit (number of requests per address, in memory only). The access log contains no IP addresses and no identifiers, only time, request type, address without query string, response code, duration and size. We count visits as on the portal, without a cookie (see “Visitor count without cookies”). Which language version the start address opens depends on your browser’s language setting; it is not stored in the process. The legal basis is Art. 6(1)(f) GDPR.

In your browser, the site remembers your progress in the small exercises (words heard and collected, points) and the chosen language — in local storage (localStorage); session storage (sessionStorage) only records whether the intro animation has already played. None of this is transmitted; it stays in your browser until you delete it there or reset your progress on the site. The legal basis for this storage in the browser is Section 25(2) no. 2 TDDDG: it is strictly necessary for the features you use on the site.

No account on the site. You create a Jinjja account only in the game: the Open Beta buttons on jinjja.world take you there (game.jinjja.world). What is then stored and for how long is described under “Account, ratings and watchlist” and “Jinjja World (the game)”. In the sign-in dialog on jinjja.world you can only sign in with an existing account.

Links from this portal to jinjja.world carry the addition ?von=portal-… with the place they come from (for example portal-serie). It says nothing about you; the site doesn’t read it, and the access log omits it like any query string.

Live lounges and chat on the portal

In the live lounges, those present see the display names of the others and the lines written. Both are kept only in the server’s memory and are gone after the session ends or after a restart; they are not written to the database and not analyzed.

Names and chat: check for offensive words

Names that others see — your account’s display name, your character’s name, the name of a fan club and the title of a club evening — and chat messages are checked automatically by our game server against word lists of swear words, hate terms and official-sounding words (such as “Admin”). This applies to chat in the game (room, flat, clubhouse, direct messages) and to the live lounges of this portal; the portal sends their lines to our game server for this, which does not store them. A name containing such a word is rejected. In a chat message, asterisks replace the word before the message is stored or sent to anyone. The check runs only on our own servers; we do not record which word was found. The legal basis is our legitimate interest in respectful interaction (Art. 6(1)(f) GDPR).

The word lists are based on the “List of Dirty, Naughty, Obscene, and Otherwise Bad Words” (© 2012–2020 Shutterstock, Inc.), published under Creative Commons Attribution 4.0 International (CC BY 4.0). We made a selection from it, removed everyday words and added words of our own.

Friendships and your own lists

A friend request stores who sent it and who received it, along with its status and time. Either side can end it at any time; the entry then disappears.

Anyone who publishes a list makes its title, description, entries and their own display name publicly visible. Unpublished lists are only visible to your own account.

Our own videos and audio samples

The Jinjja World trailers, film scenes and Korean audio samples on the new game and learning pages are loaded from our own server. No third-party player is embedded for this. Optional counting of trailer starts and solved portal listening exercises depends on your statistics choice.

Videos from YouTube

Third-party trailers and music videos in the editorial catalog may be YouTube embeds. They load only on click: until then, a preview image is shown and no request is sent to YouTube. After the click, the browser loads the player from youtube-nocookie.com; Google learns the IP address and browser identifier. The legal basis is consent given by the click (Art. 6(1)(a) GDPR).

Hosting and logs

The site runs on a server of OVH SAS (2 rue Kellermann, 59100 Roubaix, France) in the Frankfurt am Main data center. The data is therefore located in Germany; a data processing agreement under Art. 28 GDPR is in place.

The web server writes an access log without IP addresses and without identifiers: time, request type, requested address without search terms, response code, duration and size of the response. Browser identifier, referring page and cookies are not logged. The log serves only to detect faults and overload; it cannot be used to tell who requested a page. Like the technical operating messages of the services, which also contain no IP addresses, it rotates automatically (at most 5 × 20 MB per service). System messages of the server are deleted after 30 days. Database backups stay on the same server for 7 to 14 days.

Your rights

• Access to the data stored about you (Art. 15)
• Rectification of inaccurate information (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing based on legitimate interests (Art. 21)
• Withdrawal of consent with effect for the future (Art. 7(3))
• Complaint to a supervisory authority (Art. 77)

Recipients

No data is passed on for advertising or analytics purposes. Data is only exchanged insofar as the browser contacts the servers of the respective source directly when loading images (see above) and the hosting provider technically delivers the site. Anyone who signs in with Google connects to Google in doing so (see “Signing in with Google”). Anyone who signs in through Steam triggers a check at Valve in doing so (see “Signing in with Steam”).

As of 11 October 2026. This policy describes the actual state of the software. It is not legal advice and should be reviewed by a lawyer before the public launch.