This translation is provided for convenience. The German version is legally binding. Deutsche Fassung

Privacy policy

Last updated: 22 October 2026

Controller

Armin Müller, Cards and Supplies, Polarstr. 24, 95448 Bayreuth, Germany, armin.mueller.bayreuth@gmail.com. Technical operator on our behalf: Tim Ebner, Welserstraße 3, 87463 Dietmannsried, Germany.

What data is processed

When you visit this site, the web server processes technically necessary data: IP address, time, page visited, browser identifier. This data is stored in server logs and deleted after 14 days at the latest (legal basis: Art. 6 (1) (f) GDPR, secure operation). To measure reach, we count without cookies and without third parties: the page visited, origin (referring page), device type, the country when operated via Cloudflare, and cart activity are stored under an identifier formed from the IP address and browser identifier with a random value that changes daily. After the end of the day it can no longer be attributed, and the figures are deleted after 90 days (Art. 6 (1) (f) GDPR, interest in improving our offer). From these figures we show aggregated information in the shop, such as how many different visitors were in the shop in the last 30 minutes or how often a product page was viewed today; no conclusions about individual persons can be drawn from this. If “Do Not Track” or “Global Privacy Control” is active, nothing is counted. The daily treasure chest awards a discount code, which is stored under the same daily identifier; the code itself is also kept in your browser’s storage. The cart is kept exclusively in your browser’s storage (localStorage) and is not transmitted to us before you order.

Images and fonts

Product images are loaded directly from eBay’s image servers; in doing so, eBay (eBay GmbH, Albert-Einstein-Ring 2-6, 14532 Kleinmachnow, Germany) receives your IP address. The font is delivered from our own server; there is no connection to Google.

Buying on eBay

The buy button leads to eBay. The eBay privacy notice applies to data processing there. We receive order data (name, address, items purchased) from eBay to process the contract (Art. 6 (1) (b) GDPR) and retain it for ten years in accordance with commercial and tax law requirements.

Ordering and payment on this website

If you order here, we process your name, delivery address, email address, optionally your phone number, the items ordered and the payment data (transaction ID and email address or name of the payment service) to perform the contract (Art. 6 (1) (b) GDPR). Payment is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; we transmit the amount, items and delivery address to them. The PayPal privacy statement also applies. PayPal’s script is loaded from paypal.com, which means PayPal receives your IP address. When paying with Amazon Pay, the payment is processed by Amazon Payments Europe S.C.A., 38 avenue John F. Kennedy, L-1855 Luxembourg; we transmit the amount, delivery address and email address, and the Amazon Pay privacy notice applies. A script is loaded from payments-amazon.com, which means Amazon receives your IP address. For shipping, we pass your name and address on to the shipping company. We retain invoices and order data for up to eight years in accordance with commercial and tax law requirements (Art. 6 (1) (c) GDPR). We send order and shipping confirmations by email via the server of our technical operator.

Customer account, loyalty points and newsletter

If you create a customer account, we store your name, email address, a password stored in encrypted (hashed) form, your orders, collected loyalty points and the time of your consent to the terms and conditions and privacy information (Art. 6 (1) (b) GDPR). The email address is confirmed via a link (double opt-in). The session is maintained via a necessary cookie (cs_konto). If you use the set tracker with an account, we also store which cards you have marked as owned in which set (Art. 6 (1) (b) GDPR), so that your progress is available across devices. Without an account, progress remains exclusively local in your browser (localStorage) and is not transmitted to us. When the account is deleted, this progress is deleted as well. You can delete the account yourself at any time; orders and invoices remain stored for commercial and tax law reasons. The newsletter is voluntary (Art. 6 (1) (a) GDPR): you confirm your consent via a link, we store the time of confirmation, and you can withdraw it at any time with effect for the future in your account or by email to armin.mueller.bayreuth@gmail.com. We process information submitted via the withdrawal button (name, email, order number) to handle your withdrawal (Art. 6 (1) (c) GDPR).

Wildlands books (reading on pinnry)

At pinnry.com/buecher we offer interactive books from “Beanlings Wildlands”. To read them, you need a customer account (see “Customer account, loyalty points and newsletter”). If you create an account via the books page, we store the same account data as for any customer account: name, email address, the hashed password and the time of your consent to the terms and conditions, privacy information and your confirmation that you are at least 18 years old. Your first name appears in the dedication of your copy, which only you can see in your account.

For each copy, we store how it came into your account (gift code, “Secure a copy” button, purchase), the edition, for numbered editions the serial number and a random copy ID (for example SF-P012-AB3C), as well as the time. Copy numbers are never assigned a second time. While you read, we store your reading progress: the current section, the decisions on your path, endings reached, unlocked sections, items found and a bookmark (position and chapter), so that you can continue reading at the same point on any device. The legal basis is Art. 6 (1) (b) GDPR (providing the book in your account).

Gift copies: for participants of certain groups (testers of Wildlands, players of Beanlings Kickoff, individual personal invitations) we create a personal code. For this, we store who it is intended for (an internal identifier of the game account, the club or the email address of the invited person), where applicable a name for the dedication, and after redemption, which account redeemed it and when. Anyone who receives a copy via the “Secure a copy” button also gets such an entry. The legal basis is Art. 6 (1) (b) GDPR.

Age confirmation

The books are aimed at adults. Before you open a book or secure a copy, you confirm that you are at least 18 years old. We only store that and when you confirmed this, no date of birth and no ID document (Art. 6 (1) (c) GDPR in conjunction with youth protection law, alternatively (f)). This information remains stored as long as your account exists.

Reading statistics

So that we can improve the books (which chapters are read, where readers stop, which decisions are made), the reader records simple events in the browser and sends them to our server: opening the reader with a random identifier for this reading session, every 30 seconds a signal that reading continues (only while the tab is visible and you have recently interacted with it), chapter and page, the time spent reading, decisions made, going back to a fork and opening a secret path. This is stored with your account and your copy ID. We do not store an IP address, a browser identifier or any text you enter. The statistics are evaluated by us and by the Wildlands team (see “Link with Beanlings Wildlands”) in an internal overview. The Wildlands team only sees them in pseudonymised form: per copy, the copy number and copy ID with group (for example tester or Kickoff), reading time, chapter, number of decisions, endings, finds and ink redeemed, plus totals and distributions across all readers. Names (neither your name nor your keeper name nor the name in the dedication), email address and account number are not transmitted to them. The legal basis is Art. 6 (1) (f) GDPR, our interest in improving the books. You can object to this at any time by email. The entries are deleted when you delete your account, but no later than twelve months after they were recorded. Before deletion, we aggregate them into monthly totals per book (for example number of reading sessions, total reading time, how often a decision was made); these totals contain neither account nor copy and do not allow any conclusions about individual persons. When the books page is visited and when you secure a copy, we also only count daily totals, without a cookie and without an identifier: which step it was, the language and the country from the language setting that your browser sends anyway (for example “de-AT” for German, Austria), and the source of the link. We do not read anything from your browser for this. IP address and account are not stored for this; we and the Wildlands team see the totals in the internal overview, and they do not allow any conclusions about individual persons (Art. 6 (1) (f) GDPR, interest in finding out into which languages we should translate the books).

Origin of a link

Some links to the books page carry an addition such as “?von=instagram”. If you secure a copy or sign up for the first edition via such a link, we only store the name of the source (permitted are instagram, bluesky, discord, kickoff and newsletter) with your copy or your sign-up. This shows us through which channels readers find us. Other values are discarded, and no identifiers from the platforms are taken over (Art. 6 (1) (f) GDPR).

Waiting list for the first edition

At pinnry.com/buecher you can sign up for the first edition of a book. The sole purpose is a single email message when the first edition is published. The list is not a newsletter, we do not use the address for anything else and do not pass it on. It is stored separately from the newsletter.

For this, we only store: your email address, the language of the page (German or English, so that the message arrives in your language), the source of the link if you came via a link with an addition such as “?von=instagram” (see “Origin of a link”), the time of the request, the time of your confirmation, later the time at which we sent the message, and until confirmation a confirmation key, of which we only keep a hash value. We do not store names, account numbers or IP addresses with the sign-up.

Sign-up uses the double opt-in procedure: after you enter your address, we send you an email with a link (valid for 48 hours). Only when you confirm on the linked page are you on the list. If you do not confirm, we delete the entry after seven days. If you are signed in to pinnry and the email address of your account has already been confirmed, you can sign up with this address with one click and without another email. The sign-up is not linked to your account but only stored under the email address.

You can remove yourself at any time: via the link in every email about the waiting list or, if you are signed in, with the “Remove me” button on the books page. The entry is then deleted completely. We delete your sign-up no later than 30 days after sending the message about the first edition. If you delete your customer account, we also delete any sign-up with the confirmed email address of that account.

The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time with effect for the future. We keep the times of request and confirmation as proof of consent as long as you are on the list (Art. 6 (1) (c) and (f) GDPR). We send the emails via the same mail server as our other emails (see “Hosting”). To prevent misuse, the server counts how often sign-ups are requested from an IP address (at most five in ten minutes); this count is kept only in working memory, not in the database, and expires at the latest with the next restart of the server (Art. 6 (1) (f) GDPR). An additional field in the form that is invisible to humans keeps out automated entries; whatever is entered there is not stored.

Link with Beanlings Wildlands

You can voluntarily link your pinnry account with your game account in “Beanlings Wildlands”. To do this, you generate a code in the game (valid for 30 minutes) and enter it on pinnry. The following data flows: from pinnry to Wildlands, the code entered and the internal number of your pinnry account; from Wildlands to pinnry, the internal number of your game account, your keeper name and whether you are one of the current testers; after that, from pinnry to Wildlands, the items you find in the book (book, item, type, for numbered editions your copy number), so that they arrive in your game account. Your email address, your name from the pinnry account and your reading progress are not transmitted; we show your keeper name to you on your bookshelf and use it for the dedication of a tester gift; it is not included in the reading statistics for the Wildlands team.

The link is stored on both sides until you link your game account with another pinnry account or delete one of the two accounts; on request, we remove it by email. If you delete one of the two accounts, both sides remove the link: for this, pinnry only reports the internal number of your pinnry account and of your game account to Wildlands, and Wildlands in turn reports the same two numbers to pinnry. If the other server is not available at that moment, we keep these two numbers in a queue until the message has arrived (usually within one hour) and delete them afterwards. The legal basis is Art. 6 (1) (b) GDPR (the link you requested). The data transfer only takes place between our own servers. The section “Reading statistics” applies to the reading statistics in the internal overview of the Wildlands team.

Link with Beanlings Kickoff

Players of “Beanlings Kickoff” see a notice about the book with their personal code in the game. So that this notice no longer appears once you already have a copy, the Kickoff server checks whether a pinnry account with a copy belongs to your game account. For this, it reads from pinnry which accounts have a copy and compares this with your existing link between pinnry and Kickoff or with your email address confirmed in the game. No data is stored in the process; the notice is merely shown or not shown (Art. 6 (1) (f) GDPR, interest in not bothering you with unnecessary notices).

Settings in the browser

If you choose a language on the books page, we remember it in a cookie (buch_lang, one year). If you open a gift link before you are signed in, a cookie (buch_code, 14 days) remembers the code so that you do not have to enter it again after signing in. Font size, night mode and reader view are only kept in your browser’s storage (localStorage) and are not transmitted to us. We deliver the fonts of the books page from our own server (Art. 6 (1) (f) GDPR, Section 25 (2) No. 2 TDDDG, German Telecommunications Digital Services Data Protection Act).

Deletion

If you delete your customer account, we delete with it your reading progress, unlocks, list of finds, bookmarks, age confirmation, reading statistics, the assignment of your copy, the link to Wildlands on pinnry and any sign-up for the first edition with the confirmed email address of your account. Your copy number remains counted as assigned so that the print run is correct, but is no longer assigned to any person and is not reassigned. A redeemed gift code remains marked as “redeemed”; the recipient and dedication name are removed. Orders remain stored for the reasons stated above; the section “Ink (credit)” applies to Ink. Wildlands is informed of the deletion and removes the link between your game account and your pinnry account number there (see “Link with Beanlings Wildlands”). Items from the book that have already arrived in your game account remain there, because they belong to the game account; their origin from pinnry is then no longer assigned to any pinnry account. If you instead delete your game account in Wildlands, your pinnry account, your copy and your ink remain; only the link to Wildlands is removed.

Ink (credit)

“Ink” is a credit in your customer account that you can redeem with us for digital offers on pinnry (for example Wildlands books) and for digital offers of “Beanlings Kickoff” (see section 3d of the terms). We store every transaction and every reservation (for example top-up by purchase, gift, Bonus Ink, payment of an order, redemption in the book, reservation and redemption of a league place, release, reversal, refund) with amount, pot (purchased Ink or Bonus Ink), type, reference or reason and time. You can see this history and your balance yourself in your customer account on the “My Ink” page. Purchased Ink is an order like any other (see “Ordering and payment on this website”); storage and redemption take place for the performance of the contract (Art. 6 (1) (b) GDPR). We retain transactions relating to purchased Ink and their redemptions for commercial and tax law reasons, even if you delete your account (Art. 6 (1) (c) GDPR); we refund unused purchased Ink on request. We delete transactions relating to Bonus Ink together with your customer account.

Bonus Ink from Beanlings Wildlands

For Bonus Ink (see section 3e of the terms), the game server of “Beanlings Wildlands” evaluates your game activity: active minutes of play per calendar day, finished chapters, solved riddle chains, first catches of a species, completed daily tasks, implemented feedback, whether a tester you invited was active on three days and, for the welcome task for players of “Beanlings Kickoff”, whether you completed the first day. For each credit the game stores occasion, amount, day and time. If your game account is connected to pinnry, Wildlands only transmits to pinnry the internal number of your game account, a booking key, the occasion and the amount; pinnry books it to your connected account (pot “Bonus Ink”). The legal basis is the performance of the game and account use agreed with us (Art. 6 (1) (b) GDPR). Bonus Ink is free of charge; we delete these transactions together with your customer account. In the game, the credits are deleted together with the game account.

Supporter Ink

If you have taken out the Kickoff Supporter subscription, we credit Bonus Ink to you from the second paid subscription month for each paid subscription month (section 3e of the terms), on the basis of the subscription payments that we process for the subscription anyway. For this we only use your customer account, the subscription payments received and their time (Art. 6 (1) (b) GDPR). The credits appear in your Ink history.

Ink at Beanlings Kickoff

If your pinnry account is linked to your game account in “Beanlings Kickoff” (you set up the link in your customer account), you can also use Ink in the game, for example for a place in an open friends league. For this, the Kickoff server and pinnry exchange data. For the linked game account (internal number of the game account or of the club), Kickoff queries your Ink balance from pinnry (available, purchased, bonus, reserved) and whether a Supporter subscription is active. To reserve, redeem and release Ink, Kickoff sends pinnry the amount, the purpose, a display text (for example the name of the league), a booking key and, where applicable, a link; pinnry replies with the result and the new balance. Your name, your email address and your payment details are not transmitted to Kickoff. The legal basis is Art. 6 (1) (b) GDPR (performance of the contract on the redemption of Ink). The transfer only takes place internally on our server and is not routed over the internet. “Beanlings Kickoff” is operated by Tim Ebner (provider details in the legal notice on beanlings.com). For the monthly settlement between Cards and Supplies and Beanlings Kickoff, we only use monthly totals of redeemed purchased Ink, without reference to individual persons.

Protection against misuse of Ink. To detect misuse of Ink (for example many new accounts from the same internet connection, several welcome credits for the same person or reversed payments), we create hashed device and connection features from data that is generated anyway: from the access logs of our web servers we only use registrations at pinnry, “Beanlings Kickoff” and “Beanlings Wildlands”, and from “Beanlings Kickoff” the last IP address of new clubs stored there. IP address and browser identifier (user agent) are irreversibly encrypted with a secret key (HMAC-SHA256); only these check values are stored, together with the service, the type of event (registration, new club), the internal account or club number and the time, not the IP address itself. We use the check values exclusively to prevent misuse: a daily check reports anomalies to us; this does not lead to an automatic suspension, a human decides on any measures. We delete the check values after 30 days, as well as the counters of how often an account reached the limits for topping up or reserving. In addition, we regularly check the payment status of your Ink top-ups with PayPal (completed, refunded, reversed, dispute); for this we only send PayPal the transaction number of the payment. If a payment is reversed or disputed, we temporarily suspend the Ink account (section 3f of the terms and conditions) and store the reason, order, amount and time of the suspension as well as the note on its release for as long as your customer account exists, and for payments beyond that in accordance with the statutory retention periods. The legal basis is our legitimate interest in preventing fraud and misuse of Ink and free Bonus Ink (Art. 6 (1) (f) GDPR). You can object to this processing on grounds relating to your particular situation (Art. 21 GDPR).

Deletion

If you delete your customer account, we will refund unused purchased Ink on request; Bonus Ink lapses and open reservations are cancelled. We delete transactions relating to Bonus Ink together with the account; transactions relating to purchased Ink and their redemptions remain stored for the reasons stated above.

Hosting

The site is operated on servers of Amazon Web Services EMEA SARL (Luxembourg) in the Frankfurt region; Cloudflare Inc. provides encryption and protection against attacks. Data processing agreements are in place with both providers.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15-21 GDPR) as well as the right to lodge a complaint with a supervisory authority, in Bavaria the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.