Privacy policy

Last updated: 23 October 2026 · This is a translation of the German privacy policy. If the two versions differ, the German version applies.

1. Controller

Christian Stark, Maxstr. 14, 52070 Aachen, Germany, info@christianstark.net

A data protection officer is not required by law. For privacy questions, simply write to the email address above.

2. In short

• No ads, no tracking, no analytics tools. We do not sell data.
• Cookies are only used when you sign in (sign-in cookie, see 12) – and for administrators (see 11).
• No external fonts. All fonts come from your device.
• Our server keeps no access logs with IP addresses. To prevent abuse, we only count IP addresses briefly in memory (depending on the feature at most 10 minutes, 1 hour or 24 hours, see below).
• The AI (Buddy, image checks, captions, summaries, AI portraits) runs on the operator's own devices in Germany – nothing is sent to outside AI providers.
• Accounts are available from age 13; for 13- to 15-year-olds only with a parent's permission (see 12). Everything else, including a practice quiz and the safety course, works without an account.

3. Hosting and Cloudflare

The site runs on the operator's own devices in Germany and is delivered through the network of Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare processes technically necessary connection data such as your IP address, the date and time of the request and the address requested, in order to deliver the site quickly and securely (e.g. against attacks). Cloudflare acts as our processor (Art. 28 GDPR). The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); EU standard contractual clauses also apply. How long Cloudflare keeps this data is explained in Cloudflare's privacy policy.

Backup copies: so that nothing is lost if a device fails, we back up the databases (e.g. accounts, stars, gallery, parkour) and the uploaded images every night – on the server and as a second copy on another device of the operator in Germany, not in a cloud. Only the operator has access. We delete the copies automatically after 14 days (server) or 30 days (second device); anything you delete therefore also disappears from the backups after 30 days at the latest. We only use the copies to restore data after a failure. Legal basis: Art. 6(1)(f) GDPR (protection against data loss, cf. Art. 32 GDPR).

4. Images from Roblox

Game images, icons and avatar pictures come from the public Roblox platform. Our server loads them from Roblox itself and delivers them to you at mahshid.de/img/…; they stay in a cache on our server for up to 14 days. Your browser does not connect to Roblox for this, so your IP address is not sent to Roblox. Player counts and event data are also requested by our server only.

5. Storage on your device

We only set cookies for signing in (see 12) and in the admin area (see 11). Only when you use a feature does your browser store small entries in browser storage (localStorage):

• mahVoter, mahReact (formerly mahLiked): a random reaction ID and the list of your reactions – only once you react to a picture for the first time (see 7).
• mahPk, mahPkSet, mahPkGhost, mahPkC: your best times in Block Parkour, your game settings (sounds, music, graphics, ghost), the run path of your best time for the ghost race and your times in community levels – only once you finish a level or change a setting. Stays only in your browser.
• mahLearn: which lessons of the “Learn Roblox Studio” course you finished – only in your browser, we receive nothing.
• mahCode, mahCodeProg: which levels you finished in the code adventure (with how many blocks) and the program you last built for each level – only in your browser.
• mahPkDraft, mahPkDraftSolved: your draft in the level builder and whether you have already finished it yourself – only in your browser until you delete or submit it.
• mah-follow, mah-follow-sync: the games you follow with 🔔 and when your subscription was last synchronised (see 10).

In addition, a so-called service worker stores public parts of the site (e.g. home page, game pages, images, legal texts) in your browser so that they load faster and work offline as an app. It does not store personal pages or data (profile, stars, quiz, sign-in). When you sign out or delete your account, we clear this storage.

The legal basis for storing on your device is Section 25(2) no. 2 TDDDG (strictly necessary for the feature you use); for further processing Art. 6(1)(f) GDPR (providing the feature). You can delete everything at any time in your browser settings ("clear site data").

6. AI helper "Buddy"

Buddy is an AI. When you ask Buddy a question, your text is sent to our server and answered by a locally running AI model on the operator's own devices in Germany (on the server or on our own AI computer in the same network). No data is sent to outside AI providers. The chat history is not stored; it only exists in your browser window until you close the page. Answers are filtered automatically (e.g. outside links and unverified codes are removed); we only log what was removed, not your question. To prevent abuse, your IP address is counted briefly (at most 10 minutes, in memory only) to limit the number of requests (Art. 6(1)(f) GDPR). Please do not enter personal data in the chat. AI answers can contain mistakes.

7. Uploading screenshots, likes and stickers

With an account (see 12) you can voluntarily upload Roblox screenshots to the community gallery. The following applies:

• What is stored: the picture, the chosen game, your optional nickname (shown publicly next to the picture), the time and your account (not public – for stars and so you can see your pictures in your profile). Your IP address is not stored, only counted in memory for up to 1 hour (max. 3 uploads per hour).
• Metadata is removed: the picture is resized and saved again in your browser; hidden data such as GPS location or camera model is removed in the process and once more on the server.
• Automatic check and caption: every picture is checked twice by an AI on the operator's own devices (not shared with outside AI providers). The AI also suggests a short caption marked "🤖 AI". If the AI finds nothing, the picture is published without human review. Borderline cases are checked by a person; clearly unsuitable pictures are deleted by the AI immediately. You then see in your profile why, and whether the AI or a person decided. The AI only decides whether your picture appears in the gallery – this has no legal effect on you and does not significantly affect you (no decision within the meaning of Art. 22 GDPR). If you think your picture was deleted wrongly, write to us and a person will check it.
• Retention: rejected pictures are deleted immediately. We show you a short note (time, game, reason – without picture and nickname) in your profile for 30 days; after that it is deleted too. Approved pictures stay in the gallery until you delete them or your account, or until we remove them. Every picture can be reported with 🚩 and is then hidden immediately until it has been checked again. When reporting, we count your IP address in memory for at most 24 hours so that nobody reports the same picture several times.

The legal basis is providing the gallery under the terms of use (Art. 6(1)(b) GDPR).

Likes and stickers (❤️ 🔥 😮, with the sticker pack also 👏 😂 🤩 🏆): reacting works without an account, one reaction per picture. So that nobody can react several times, your browser creates a random ID with your first reaction and stores it locally together with your reactions. On our server we only store an irreversible hash of this ID and the chosen sticker – no name. Publicly visible is only how often each sticker was given, never who reacted. For pack stickers we check at the click whether your account has the pack; we do not store your account with the reaction. To prevent abuse, we count your IP address in memory for at most 1 hour (max. 120 clicks per hour). Reactions earn no stars. Legal basis: Art. 6(1)(f) GDPR (fair counting). If you delete your browser data, the link to your reactions is gone.

Weekly theme: if you enter a picture for the weekly theme, we also store for which week. If our team picks your picture as the winner of a category, we show it with the category, the game and your optional nickname in the gallery and credit stars to you (an entry in the ledger). Legal basis: Art. 6(1)(b) GDPR.

Block avatar in the gallery: only if you switch it on yourself in the avatar workshop (default: off), we show a small head picture of your block avatar next to your approved screenshots – without a name. You can switch it off at any time; it then disappears immediately.

8. Reporting codes

When you report a code on a game page, we store the code, the optional reward, the game and the time. If you are signed in, we also store which account made the first report (not public), so that you get stars if we confirm the code. Your IP address is only counted briefly in memory (max. 5 reports per hour, Art. 6(1)(f) GDPR). Reported codes only appear after we have checked them.

9. Requests to the AI Studio and contact by email

The AI Studio is an offer for adults only. If you send a request through the form on the AI Studio page, we store: the chosen package, your name or nickname, email address, optionally the link to your Roblox game, your description, optionally budget and preferred date, your confirmation that you are at least 18, and the date and language. Your IP address is not stored, only counted briefly in memory (max. 3 requests per hour).

The purpose is to answer your request and, if applicable, make an offer (Art. 6(1)(b) GDPR, pre-contractual measures). We reply by email. The information is needed so we can answer; without it we cannot handle the request. The data stays on our own server and is not passed on to third parties. Completed requests without an order are deleted automatically after 12 months at the latest; on request we delete them immediately. If an order is placed, we keep the offer, invoice and correspondence for as long as commercial and tax law require (usually 6 or 10 years, Section 257 HGB, Section 147 AO; Art. 6(1)(c) GDPR).

If you email us directly, we only process your address and message to reply (Art. 6(1)(f) GDPR, for order requests (b)) and delete them once the matter is settled and no retention obligation applies.

10. App, offline storage and push notifications

If you install the app, your device caches public parts of the site so that it works offline (see 5). This data stays on your device.

Push notifications: only if you tap 🔔 on a game page and allow it in your browser, we store your browser's push address with the related keys, the games you follow, the language, when the subscription was created and when a message was last delivered – no name, no email, no IP address. We send at most 2 messages per day and never between 8 pm and 8 am; only about new codes, official events and updates of your games, never ads and never hints about stars or promotions. Summaries written by an AI are labelled. The legal basis is our legitimate interest in providing the notification service you requested (Art. 6(1)(f) GDPR; for storage on your device Section 25(2) no. 2 TDDDG). If you are under 16, please ask your parents first. Messages are delivered through the push service of your browser maker (e.g. Google Firebase Cloud Messaging for Chrome/Android, Mozilla for Firefox, Microsoft for Edge, Apple for Safari), which processes your push address and technical connection data; these services may transfer data to the USA. The content of the message is end-to-end encrypted. You can unsubscribe at any time: tap the button again or turn off notifications in your browser settings. We then delete your subscription immediately; invalid addresses and subscriptions that could not be reached for 12 months are deleted automatically. When a subscription is created, we count your IP address in memory for at most 1 hour (abuse protection).

11. Admin area

For sign-ins to the non-public admin area (/admin) we log the time and IP address of each sign-in attempt to detect attacks (Art. 6(1)(f) GDPR). The log is deleted automatically after 30 days. A technically necessary session cookie is also set there – only for administrators, not for visitors. In the admin statistics we only see totals and short account numbers, no names.

12. Account with "Sign in with Roblox"

An account is voluntary and available from age 13 (Roblox only allows signing in to other services from 13). For 13- to 15-year-olds we need a parent's permission. When you click "Sign in with Roblox", your browser takes you to Roblox; there you sign in to Roblox and allow us access to your public profile. We never see your Roblox password. Our server then requests your profile data from Roblox Corporation (USA) once.

• Age question: after the first sign-in we ask whether you are 16 or older, 13 to 15, or younger than 13, and store only this group (no date of birth). If you are younger than 13, we delete the account that was just created immediately. Until you answer, the account cannot be used; if the question is not answered, we delete it after one day.
• Parental permission (age 13 to 15): you enter a parent's email address. We send an email there with a short explanation and a link (valid for 7 days) through which a parent can agree or decline; at most 3 emails per day. Only after permission can your account be used (stars, quiz, uploads). We store the email address only until permission is given, at most 7 days; after that we keep only an irreversible check value and the time of permission, so that parents can withdraw their permission at any time through the link in the confirmation email – we then delete the account immediately. Through the same link parents see an overview (stars, latest star activity, badges, public screenshots, block avatar); they cannot change anything there except withdrawing. If parents have lost the email, they can enter their address at mahshid.de/eltern/link: if the check value matches, we send a new link (the old one then stops working). We do not store the address entered; to prevent abuse we count the IP address in memory for at most 1 hour (max. 3 requests per hour). If a parent declines or nobody agrees within 7 days, we delete the account. We send the emails from [email protected] through the email service Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France; processing in the EU), which acts as our processor (Art. 28 GDPR). Brevo processes the email address and the content of the message for this. Our emails are plain text without images or tracking pixels; Brevo's sending statistics are set to "anonymous", i.e. without reference to individual recipients. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 8 GDPR (obtaining parental permission) and Art. 6(1)(f) GDPR (proof of permission).
• What we store: your Roblox user ID, your Roblox username and display name, the address of your avatar picture (we load the picture itself through our server, see 4), the time of your first and last sign-in, your age group (for 13 to 15 also the details of parental permission, see above), your star balance with a ledger (amount, reason and time of every credit and every swap), the extras and badges you have (including avatar parts, profile themes and sticker packs), your block avatar (only the selection of our fixed parts and colours, no picture, no free text) and whether it should appear in the gallery, your contributions to the community pot (only in the ledger, not public – only the total of all contributions is public) and your answers in the daily quiz (day, question, chosen answer, right or wrong – so each question only counts once; we delete them after 30 days). If you upload screenshots or report codes, we store which account they came from so we can credit stars; only your freely chosen nickname is shown publicly. Your profile is not public. We use Roblox access tokens only once during sign-in and do not store them.
• Sign-in cookie: to keep you signed in, we set a cookie with a random ID (valid for 30 days). On the server we only store an irreversible hash of it. The cookie is strictly necessary for the sign-in you requested (Section 25(2) no. 2 TDDDG).
• Purpose and legal basis: providing your account and its features under the terms of use (Art. 6(1)(b) GDPR); for 13- to 15-year-olds only after parental permission. The age question serves to protect minors (Art. 6(1)(c) and (f) GDPR).
• AI portrait (optional): on request an AI paints a picture of your block avatar. The only input is a description made from your chosen avatar parts and the chosen style – no photos, no free text, no name. The picture is created on the operator's own computer in Germany (image model Stable Diffusion XL, running locally, not shared with AI providers) and is then checked for unsuitable content by an AI on our server; if this check is not possible, a person looks at it first. Only then do you see the picture. It is only visible to you (and to us for checks), not public, and labelled as an AI image – visibly on the page and machine-readable in the image data. We store the picture, the style, the description, the time and your account; at most your 3 newest portraits, older ones are deleted automatically. You can delete portraits yourself at any time. Notes about rejected or failed orders (without a picture) are deleted after 30 days. Legal basis: Art. 6(1)(b) GDPR.
• Practice quiz without an account: without an account you can play a practice quiz without stars. Your answers are only checked and not stored.
• Block Parkour: the game runs entirely in your browser and works without an account; then your best time stays only in your browser. With an account we store your best time and when you reached it for every level you finish, and credit stars to you the first time you finish a level (ledger). Legal basis: Art. 6(1)(b) GDPR.
• Healthy play (play time): in the Mahshid games your browser reminds you to take a break after 30 minutes of active play; for this it keeps this session's play time in session storage (mahPlayRun, deleted when you close the browser) and whether you switched the reminder off (mahPause, in local storage). This stays in your browser. With an account you can set yourself – and parents of 13- to 15-year-olds can set through their overview – a daily play-time limit. Only while a limit is set, your browser reports active play to our server at most once a minute; we then only store the minutes per day and delete them after 14 days (immediately when no limit is set any more, and together with the account). Parents see today's minutes in their overview. Legal basis: Art. 6(1)(b) GDPR (the feature you or your parents asked for).
• Code adventure: the learning game runs in your browser and works without an account. With an account, your browser sends your program to our server when you finish a level; the server replays it and only stores which level you finished, with how many blocks and when – we do not store the program itself. You get stars the first time you finish a level. None of this is public; parents of 13- to 15-year-olds see the progress in their overview. It is deleted with the account. Legal basis: Art. 6(1)(b) GDPR.
• Leaderboard and ghost race: only if you switch it on in the game yourself (default: off), we show your best time under a random nickname made of fixed words (e.g. "Swift Fox 42") in the level's top-10 list – visible to all visitors. Your Roblox name, your avatar or other details never appear there. For this we store the run path of your best time (rough positions every 0.1 seconds, no inputs, no device data). We use the run path to check whether the time was reached fairly; if it is not plausible, it simply does not appear in the list. The run path of number 1 is shown to others as a see-through "ghost" – only movements and the nickname. You can switch it off any time; we then delete the entry and run paths at once. Without playing we delete them after one year, and immediately together with the account. There are no rewards and no notifications for places. For 13- to 15-year-olds the parents have to allow the leaderboard (with their permission or through the parent overview). Every entry can be reported; it is then hidden until we have checked it. Legal basis: your consent or your parents' consent (Art. 6(1)(a), Art. 8 GDPR), which can be withdrawn at any time.
• Level builder and community levels: if you submit a level you built, we store the level (squares made of fixed blocks, world, name made of fixed words), your account as its creator, timestamps, the review status and reports. We check every level before others can see it. Publicly we only show the level and its name – never who built it. There are no likes, comments or view counts. If our team picks a level as “level of the week”, we store which level was picked in which week and credit stars to the account; even then no name is shown publicly. If we reject a level, you see the reason in the builder for 30 days; after that we delete it. You can delete your own levels at any time; they are also deleted with the account. For 13- to 15-year-olds the parents have to allow publishing. Legal basis: Art. 6(1)(b) GDPR (providing the feature) and Art. 6(1)(f) GDPR (protecting users through review and reports).
• "Safe online" course and badge album: anyone can take the course without an account; the answers are only checked and not stored. With an account we only store that you completed it (an entry in the star ledger and the badge). We calculate the progress in the badge album from your ledger and your account; we store nothing extra except the badges you have earned. The album is not public.
• Deletion: you can delete your account yourself at any time on your profile page; we then immediately delete all account data, your star ledger, your extras, your block avatar, your AI portraits, your quiz answers and your uploaded screenshots, and we remove the link between your code reports and your account. Accounts without a sign-in for 2 years are deleted automatically. Signing out only ends the session and clears your browser's offline storage.
• Roblox: Roblox itself is responsible for the sign-in process on roblox.com. More in the Roblox privacy policy.

13. Recipients and third countries at a glance

• Cloudflare, Inc. (USA) – delivery of the site, processor (see 3)
• The push service of your browser maker – only if you turn on push notifications (see 10)
• Roblox Corporation (USA) – only if you sign in with Roblox (see 12)
• Sendinblue SAS "Brevo" (France) – sending the email to parents for accounts of 13- to 15-year-olds, processor (see 12)
• Zoho Corporation B.V. (Netherlands, EU data centre) – our mailbox [email protected] when you write to us (see 9), processor

Beyond this we do not pass on or sell any data.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interest (Art. 6(1)(f)), you can object at any time on grounds relating to your particular situation.

An email to the address above is enough – parents can also contact us on behalf of their children. You can also complain to a data protection supervisory authority, e.g. the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

← Back to the home page