This is a translation. The German version is legally binding.
In short: Box Box only stores what it needs for playing. No ads, no tracking, no analytics, no social media buttons, no fonts or scripts from other servers. Nothing is sold or passed on. Box Box needs the shared account of all games; its name and password are kept on the selection page. Below is every single piece of data that comes up here.
Müller & Wulff GmbH
Hans-Fallada-Str. 20
D – 17489 Greifswald
E-Mail: info@mueller-wulff.de
This is the complete list. Anything not listed here is not stored.
A random string, only while you are signed in. It is set by the selection page for all games at once – that’s why you are signed in everywhere.
Only if you switch the sound off in the race broadcast: “aus” in localStorage under boxbox:ton.
“de” or “en” – only when you switch the language at the bottom of the page.
Your account name, when you first opened Box Box and when the account was created. The name and password hash themselves belong to the shared account on the selection page.
Your driver (one per account): the driver name you choose, its look (the parts of the figure you picked and the suit colours), race number, home country, when it was created, level, experience, prize money, laurels and the five driver values. Also its gear, what is in its bag, its car with all parts and the paint (each with the rolled values of the items), and the two shops’ current offers for it and when they were rolled. Also the three offers on the race board, today’s track time used and extra rounds bought, a booked race weekend (track, your choice of setup and driving style, start and end, the result worked out in advance with its radio messages and a possible find) and the result of your last race with the whole field. The opponents there are made-up computer drivers, not other players. Also your standing in the championships (round reached, best places, a lock after a missed podium and a random number for the series’ field), your nemesis (a made-up computer driver with a random look) and the other cars in your garage with parts and paint. Also counters of what you do in the game (races, podiums, wins, retirements, items bought, points trained, repairs and the like), the achievements reached with their date, the day’s tasks with their progress, and your sponsor deal or the three sponsor offers (made-up firms). For duels: a random public id of your driver, your fame, when your next duel is free, and your mail (at most 50 messages: duel reports with the opponent’s name, result, change of fame and money and the course of the race, season results). At the end of every season the top ten are kept as an archive with driver name, country and fame. For racing teams: which team you are in, your role and since when, what you gave to the fund and your messages on the team radio (the latest 100 of a team). Name, tag, colours, number of members and fame of a team are seen by all signed-in players; members, their roles, levels and looks, the team radio and gifts only by the team’s members. Results of team races with the course of the race go to the members of both teams.
No email address, no real name (unless you choose it as your account name), no IP addresses – neither by the app nor by the web server –, no device fingerprint, no clicks, no referrer, no statistics about your behaviour. There is no profiling and no automated decision-making about you (Art. 22 GDPR).
A cookie banner is only required when a site stores things on your device that it doesn’t need for the service itself – for ads, tracking or statistics, say. This site doesn’t. The cookies and the sound setting are strictly necessary for the game you opened, or keep the language you explicitly chose (§ 25 (2) no. 2 TDDDG). No consent is needed for that – only this notice.
The site is hosted by: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland (eigener Root-Server im Rechenzentrum Nürnberg).
To deliver a web page at all, the server briefly has to process your IP address. Neither the app nor the web server writes access logs. On technical errors they log an error message with the address requested, but without IP address and without details of your browser; these messages are kept in limited amounts only and then overwritten automatically. The legal basis is our legitimate interest in secure and working operation (Art. 6 (1) (f) GDPR).
Data goes to no one. The hoster only runs the data centre and hardware the server runs on; it may technically come into contact with connection data, e.g. to fend off attacks. All data stays in Germany; nothing is transferred to countries outside the EU.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can do most of it yourself:
Right to object (Art. 21 GDPR): Where we rely on legitimate interests (delivering pages, server error messages), you can object at any time on grounds relating to your particular situation – an email is enough.
You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example: Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern, Werderstraße 74a, 19055 Schwerin.
Last updated: Oktober 2026