Privacy policy

Note: this is a translation for convenience. The German version of this page is the legally binding one.

In short

We collect as little as possible: a username, an e-mail address and a password that we never store in plain text. Beyond that, only what inevitably arises while playing.

We pass nothing on to third parties. This website runs no analytics, no advertising and embeds no content from other servers — which is why you see no cookie banner here.

1. Controller

[Vorname Nachname]
[Straße Hausnummer]
[PLZ Ort]
Germany
[email]

We are not required to appoint a data protection officer; the conditions of Art. 37 GDPR do not apply to us.

2. Where the data is held

Website, game servers and database run on a rented server operated by netcup GmbH in Nuremberg, Germany. netcup processes the data solely on our behalf and on our instructions (Art. 28 GDPR).

No transfer to countries outside the European Union takes place.

3. When you visit this website

When you open a page, the server records a log entry for security-relevant events. This includes:

• your IP address
• the time of access
• the address requested and any errors that occurred
• on sign-in, registration and failed attempts, the username used

Purpose and legal basis: we need this to detect attacks and to slow down mass guessing of passwords. The legal basis is our legitimate interest in secure operation (Art. 6 (1) (f) GDPR).

Retention: these entries are deleted automatically after seven days.

4. Game account: registration and sign-in

For an account we process:

• Username — freely chosen; it need not be your real name
• E-mail address — so we can reach you if there is a problem with the account
• Password — we do not store it in plain text, only a check value derived from it. We ourselves cannot read your password.
• Time of registration and the times of your last sign-in and sign-out

Legal basis: Art. 6 (1) (b) GDPR — without this data we cannot provide the game to you.

We do not ask for a date of birth. The field the game software provides for it is filled with a placeholder.

5. Data from the game

Playing inevitably produces further data belonging to your account: the names and equipment of your characters, progress, play times and connection data including the IP address you sign in from.

The game masters can view this data insofar as it is necessary for operation, for support and for investigating rule violations. The legal basis is Art. 6 (1) (b) and (f) GDPR.

6. Cookies

We set two cookies, both strictly necessary:

• dsn_sitzung — a random string and nothing else. It keeps you signed in during a session and protects forms against misuse from other sites. The cookie cannot be read by JavaScript (HttpOnly) and is not sent on requests coming from other sites (SameSite=Lax). It expires when you sign out or stay idle for a while.
• dsn_sprache — holds only the code of the language you chose (such as de or en) and is kept for one year so the site appears in your language on your next visit.

Because both cookies are strictly necessary, we may set them without your consent (§ 25 (2) no. 2 TDDDG). We use no other cookies.

7. No sharing, no profiling

We do not pass your data to third parties, do not sell it and do not evaluate it for advertising. No automated decision-making and no profiling takes place (Art. 22 GDPR).

The only exception is where we are legally obliged to do so, for instance towards law enforcement authorities.

8. How long we keep data

• Security log: seven days, then deleted automatically
• Account data: for as long as your account exists
• After account deletion: we remove the data without delay unless a statutory retention obligation stands in the way

Database backups are made daily and overwritten after some time. Until then, deleted information may still be contained in a backup.

9. Your rights

You have the right at any time to:

• access the data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interest (Art. 21 GDPR)

An informal e-mail to [email] is enough. We reply within one month.

Independently of this, you may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Saxon Data Protection Commissioner in Dresden.

10. Minimum age

If you are under 16, please create an account only with the consent of your parents or guardians (Art. 8 GDPR).

11. Changes

We adapt this policy when the service changes. The version published here is the one that applies.

Last updated: 31 August 2026