Privacy policy

1. Controller

See the legal notice.

2. Visiting the website

Whenever a page is requested, the web server processes technically necessary data: IP address, date and time, the requested address, status code, amount of data transferred, the previously visited page (referrer) and the identifier of the browser. This data is kept in the server's log files and deleted automatically: access logs after 14 days, messages from the application (e.g. failed login attempts at the administration area) after eight weeks at the latest. It serves secure operation, troubleshooting and defence against attacks; repeated attempts to attack the server lead to a temporary block of the IP address. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning service).

3. Cookies, tracking, external services

The public pages do not set any cookies. There is no tracking, no analytics or advertising services and no embedded content from other providers: fonts, images and scripts come exclusively from this server.

Only the non-public administration area uses a session cookie after login, which is technically necessary for signing in (Section 25(2) no. 2 TDDDG).

4. Online leaderboard

When you play an online match in the game, the game uploads its recording to this server. The following is processed:

• the Steam ID and Steam display name of the players,
• the recording of the match: settings, commands, course of the game, result and statistics (e.g. kills, damage),
• the game version and the time of the match,
• the IP address the recording came from; it is deleted after 90 days.

Purposes: calculating the leaderboard, checking for manipulation (fair play) and evaluating game balance. The legal bases are Art. 6(1)(b) GDPR (the leaderboard is part of the online service the players use) and Art. 6(1)(f) GDPR (fair competition, protection against fraud, improving the game).

Publicly visible are the player name, Steam ID (in the address of the player profile and as a link to the Steam profile), leaderboard points, wins and losses, statistics and the mini replays of ranked matches; the player list shows all players with public matches. The public version of a replay contains no Steam IDs, no commands and no IP addresses. Banned players are marked with a public reason.

Turning off public display: In the game, under Settings, you can switch off “In der öffentlichen Rangliste zeigen” (“Show in the public leaderboard”). After that, your name, Steam ID and profile no longer appear anywhere on this website or in the public interface, not even retroactively in old matches; rank and points continue to count anonymously (“Anonymous commander”) so that the leaderboard stays fair. This is also your objection to the publication under Art. 21 GDPR.

Automated checks only produce hints for the administration. A ban is always decided by a human.

The leaderboard data is kept for as long as the leaderboard exists. On request, we delete or anonymize a player's data unless legitimate grounds speak against it, such as an ongoing check for manipulation.

5. Error reports (“Weiterentwicklung unterstützen”, “Support further development”)

As long as the “Weiterentwicklung unterstützen” (“Support further development”) setting is switched on in the game, the game sends an error report to this server when it crashes or hits a serious error. It contains: game version, operating system, processor, graphics card, memory, runtime, the game situation (e.g. screen, map size, pulse), the error message, the call stack, the end of the game log and a random identifier of the installation that is not linked to your Steam account.

The report contains no Steam ID. Before saving it, the server also removes user names in file paths, Steam IDs, e-mail addresses and IP addresses from the text. Your IP address is only used briefly to limit the number of requests and is not stored. The purpose is to find and fix errors; the legal basis is Art. 6(1)(f) GDPR. You can object at any time by switching the setting off. Error reports are deleted after 90 days.

6. Hosting and backups

The website runs on a rented server. The hosting provider processes the data only on our behalf (Art. 28 GDPR). The database and the recordings are backed up daily; older backups are deleted automatically.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise these rights, contact the address given above. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).