Privacy Policy

Privacy Policy

As of: April 27, 2026 · GDPR compliant

1. Controller (Art. 4 No. 7 GDPR)

The operator named in the Legal Notice is responsible for the processing of personal data on this website. If you have any questions about data protection, please contact us by e-mail at the address provided in the Legal Notice.

2. Legal Grounds for Processing

We process personal data only on the basis of one of the following legal grounds:

  • Art. 6 para. 1 lit. a GDPR – Consent (e.g., when registering via Steam OpenID)
  • Art. 6 para. 1 lit. b GDPR – Performance of a contract or pre-contractual measures (e.g., payment processing for promotions)
  • Art. 6 para. 1 lit. f GDPR – Legitimate interests (e.g., security, fraud prevention, platform operation)

3. Data Collected & Purposes of Processing

3.1 Registration & Login via Steam OpenID

When registering via Steam, Steam transmits the following data, which we store permanently:

  • Steam ID (unique, public identifier)
  • Display Name (Steam username at the time of registration)
  • Avatar URL (link to the public profile picture)
  • Steam Profile URL

Purpose: User identification, profile display, assignment of servers, API keys, and orders. Storage Duration: Until the account is deleted upon request.

3.2 Server Claiming

When claiming a server, a temporary verification token is generated and stored together with the server IP. The token serves exclusively as proof of server control and is no longer actively used after verification. Legal Basis: Art. 6 para. 1 lit. b GDPR.

3.3 Payment Processing via Stripe

For paid promotion services, we use the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.

Payment-related data (credit card details, bank details) are processed exclusively by Stripe and never reach our servers. We only receive from Stripe:

  • An anonymized Checkout Session ID to assign the order
  • The payment status (paid / pending / cancelled)
  • The amount paid and the duration booked

Stripe may also transfer data to the USA. This transfer is based on EU Standard Contractual Clauses. Stripe's privacy policy: stripe.com/privacy. Legal Basis: Art. 6 para. 1 lit. b GDPR.

3.4 API Keys

For each API key, the following are stored: Label, creation date, time of last use, number of requests per day. Purpose: Compliance with rate limits, fraud prevention. The daily counters are automatically reset every day at 00:00 UTC.

3.5 Server Log Files

When accessing the platform, the following data is automatically stored in server log files: IP address, date and time of access, accessed URL, HTTP method and status code, amount of data transferred, referrer URL, browser type, and operating system (User-Agent).

This data is used exclusively for technical error diagnosis and security analysis and is automatically deleted after 30 days at the latest. No personal evaluation or profile building takes place. Legal Basis: Art. 6 para. 1 lit. f GDPR.

3.6 GeoIP Localization

To determine the approximate location of game servers (for country display), we use the GeoLite2 database from MaxMind, Inc. This database contains only information about IP address ranges and no personal user data. No user IP addresses are transmitted to MaxMind.

4. Cookies & Sessions

We use exclusively technically necessary session cookies. There is no tracking, no analysis cookies, and no advertising cookies.

  • Session Cookie (PHP Session): Stores the authentication status after login. It is automatically deleted when the browser is closed or after logout. Login is not possible without this cookie.

No external web tracking (e.g., Google Analytics, Matomo, Facebook Pixel) takes place.

5. Disclosure of Personal Data to Third Parties

Personal data is generally not passed on or sold to third parties. Exceptions exist only in the following cases:

  • Stripe: Exclusively for the payment processing of promotions (see 3.3)
  • Law Enforcement: In the event of a legal obligation to provide information

6. Your Rights under GDPR (Art. 15–22)

You have the following rights regarding your personal data:

  • Access (Art. 15 GDPR): You can request information about the type, scope, and purpose of the stored data at any time.
  • Rectification (Art. 16 GDPR): You can request the immediate correction of incorrect data.
  • Erasure (Art. 17 GDPR): You can request the deletion of your account and all directly linked data, provided there are no legal retention obligations.
  • Restriction of Processing (Art. 18 GDPR): You can request the restricted processing of your data under certain conditions.
  • Data Portability (Art. 20 GDPR): You can receive your data in a structured, machine-readable format (JSON).
  • Objection (Art. 21 GDPR): You can object to data processing based on legitimate interests at any time.
  • Withdrawal of Consent (Art. 7 para. 3 GDPR): You can withdraw consent at any time with effect for the future.

To exercise your rights, please contact the e-mail address provided in the Legal Notice. You also have the right to complain to a competent data protection supervisory authority.

7. Data Security

We use technical and organizational measures to protect your personal data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. All transmissions between your browser and our server are encrypted via HTTPS/TLS (Transport Layer Security).

Passwords are not stored – authentication is carried exclusively through Steam OpenID. Database access is limited to the necessary minimum.

8. Storage Duration

Personal data is only stored for as long as is necessary for the respective purpose or as required by law. After the processing purpose no longer applies or at the request of the user, data is immediately deleted or anonymized.

9. Validity of this Policy

This privacy policy is currently valid. Due to the further development of the platform or changed legal requirements, it may be necessary to adapt this policy. The current version can always be accessed on this page under /privacy.