Privacy Policy
Last updated: 16 October 2026
This policy explains which personal data is processed when you visit lost-monsters.com and play Lost Monsters in your browser. In short: the game needs no account, and your progress stays in your browser. The game is free. To finance it, it may show one ad between two games after several minutes of play (this is being prepared and not active yet). We count visits anonymously with Plausible Analytics, which uses no cookies and stores nothing on your device. Ads and detailed analytics with Google (counting how the game is played) only run if you agree in the consent banner. If you don't, the game works exactly the same, without ads and without Google Analytics.
Who is responsible
Philipp Kölmel
Triftheide 11a
22547 Hamburg
Germany
Email: info@lost-monsters.com
Hosting and server logs
The website is hosted on Firebase Hosting, a service of Google. When you open the website, your browser sends technical data that is needed to deliver it: your IP address, the date and time of the request, the requested file, the referring page and your browser and operating system (user agent). Google processes this data on our behalf to deliver the website and to protect it against attacks, and may keep it in server logs for a limited time. We do not use this data to identify you and do not combine it with other data.
The legal basis is our legitimate interest in providing a secure and working website (Art. 6(1)(f) GDPR). Google may process data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. Details are in the Firebase privacy information and Google's privacy policy.
Data stored in your browser
The game saves your settings (music and sound on or off), your progress (statistics per difficulty, your best
result per puzzle, and a skill rating the game uses to pick puzzles that suit you) and how far you have got in the
tutorial in your browser's local storage, under keys starting with lost-monsters.. This data never
leaves your device and is not sent to us or anyone else, except as part of the analytics described below, if you
allow it.
Storing it is necessary to provide the game you asked for (§ 25(2) no. 2 TDDDG). You can delete all of it at any time with "Reset progress" in the game's settings, or by clearing this website's data in your browser.
The game itself loads all of its files, including fonts, from lost-monsters.com. The visitor statistics described below are loaded from plausible.io; the analytics and ads described below are loaded from Google's servers, and only with your consent.
Visitor statistics (Plausible Analytics)
To know how many people visit the game, where they come from (for example which ad campaign) and how many of them
start and win a game, we use Plausible Analytics. It works without cookies and stores nothing on
your device, and it doesn't recognise you across days or websites. When you open the game, it records the page
address (including campaign parameters such as utm_source), the referring website, your browser,
operating system and device type, and your country, region and city, derived from your IP address. While you play,
it also records whether you started a game, touched the game, moved a monster and won a game during the visit, how long you stayed on the first tutorial map if you left it unsolved (tutorial or puzzle, difficulty, stars),
which tutorial maps you won, whether you finished or skipped the tutorial, whether the consent banner was shown and what you
answered (allow or decline, without connecting it to you), when an ad was shown and what you did after it, how long the
game took to load, whether you reached 1, 3, 10 or 25 won puzzles and 1, 3, 7 or 14 minutes of play during the
visit (in steps, nothing more precise), and when you tap Share, where in the game and whether you picked an app to
share with, closed the share menu or copied the link (not the app, not the recipient, not your message).
To count visitors without cookies, Plausible combines your IP address and browser's user agent with a secret value that changes every day into a one-way code. Your IP address and user agent are not stored, and the daily value is deleted after 24 hours, so you can't be recognised the next day. We only see summarised counts, and the data is not used for advertising.
The legal basis is our legitimate interest in knowing how many people play the game and whether our ads reach them, without asking for consent for something that doesn't identify you (Art. 6(1)(f) GDPR). Because nothing is stored on or read from your device, no consent is needed under § 25 TDDDG. You can object at any time (Art. 21 GDPR); since we can't tell visitors apart, the simplest way is a content blocker, which stops the script from loading. The provider is Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia, which processes the data on our behalf on servers in the EU. Details: Plausible data policy.
Consent banner
When you first reach the main menu (after the tutorial), the game asks whether it may count how the game is played
("Can the monsters count along?"). Until you answer "Allow", no analytics is loaded and nothing is sent. Your
answer is saved in your browser's local storage under lost-monsters.consent (yes or no, and the
date), so the game doesn't ask again on every visit. The banner is part of the game and loads nothing from third
parties.
Storing your answer is necessary to respect it (§ 25(2) no. 2 TDDDG, Art. 6(1)(c) GDPR). You can change or withdraw your consent at any time with Settings → Privacy choices in the game; withdrawing deletes the analytics cookies and reloads the game without analytics. Withdrawing doesn't affect what happened before.
Analytics (Google Analytics for Firebase)
Only with your consent, we use Google Analytics for Firebase to understand how the game is played, whether the ads drive players away, and how difficult the puzzles really are. It records events without your name or any other personal details: games started, won and abandoned (with the puzzle, difficulty, number of moves and undos, the time until your first move, the duration, your skill rating, how many rated games you have played and the puzzle's rating), how long you played, whether an ad was shown, watched, skipped or failed, and what you did after an ad. Google adds information about your device and browser, your approximate location (country and region, derived from your IP address, which Google Analytics does not store) and whether you have visited before.
To recognise returning players, Google Analytics stores a random ID in cookies on lost-monsters.com
(_ga and _ga_<ID>, kept for up to 2 years). The analytics data is kept for 14
months and then deleted. We only look at summaries, and the data is not used for advertising.
The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be processed by Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. Details: Firebase privacy information.
Tuning the difficulty (Google BigQuery)
Only if you allowed analytics: the analytics events described above are also copied once a day into Google BigQuery, a database service of Google Cloud, in the same Google project, stored in the EU. We do this because Google Analytics' own reports can't show results per puzzle, and that is what we need to make the game fair: each puzzle has a difficulty rating, and the game uses it to pick puzzles that suit you. If players solve a puzzle much more or less often than its rating predicts, the rating is wrong, and an "easy" puzzle that is really hard is frustrating.
Once a week, an automated process reads from BigQuery only the results of the puzzles (solved with how many stars, or given up) together with the skill rating at the time, and turns them into counts per day, puzzle, rating range and result. These counts contain no ID, cookie, device, location or anything else that relates to a person; we keep them with the game's development files to correct the puzzle ratings and the difficulty levels. The copied events in BigQuery are deleted automatically after 60 days. Only that process (with read-only access) and we can access them; they are not combined with other data and not used for advertising.
The legal basis is your consent to analytics (Art. 6(1)(a) GDPR). Google processes the data on our behalf as described above; data may be processed by Google LLC in the USA under the EU-U.S. Data Privacy Framework. If you don't allow analytics, nothing is copied. If you withdraw your consent, nothing new is copied, and what was copied before is deleted within 60 days; the counts can't be traced back to you.
Ads (Google AdSense)
Only with your consent, the game shows ads from Google AdSense (H5 Games Ads): after several minutes of play, one full-screen ad between two games, never during a game. Google loads the ads from its own servers and receives your IP address, information about your device and browser, and the page you are on. Google uses cookies and similar technologies to deliver ads, limit how often you see them, measure them and prevent fraud, and, if you agree to it in the banner, to show ads based on your interests. Google is responsible for some of this processing itself; see how Google uses information from sites that use its services.
The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The provider is Google Ireland Limited (address above); data may be processed by Google LLC in the USA under the EU-U.S. Data Privacy Framework. If you don't agree, no ads are shown at all.
Contacting us by email
If you write to us, we process your email address and your message to answer you (Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR if your message concerns a contract). Our email is hosted by Google. We delete your messages when they are no longer needed, unless we are legally required to keep them.
The former mobile apps
Lost Monsters used to be available as an app for Android and iOS. The apps are no longer offered in the app stores. If you still have one installed, it sends the following data to our server to store your game results and to calculate rankings: a random player ID and password created by the app, a randomly chosen monster name, your game results including the moves you made, and your statistics. This data is stored in Google Cloud Firestore (Firebase) in the USA. The apps also reported which screens were opened and certain game events, linked to the random player ID, to Google Analytics (Universal Analytics). Google has discontinued Universal Analytics, so this data is no longer evaluated. The apps contained services from Unity and Google Play Services.
The legal basis is our legitimate interest in providing the game's features (Art. 6(1)(f) GDPR). If you want your app data deleted, write to us and we will help you find and delete it.
Your rights
You have the right to access your personal data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR), in the game under Settings → Privacy choices. To use these rights, email info@lost-monsters.com.
You also have the right to complain to a data protection supervisory authority. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (datenschutz-hamburg.de).
Changes
We update this policy when the website or the game changes. The current version is always available on this page.