Privacy policy

Controller

The controller within the meaning of the GDPR is the operator named above. The contact details are also in the imprint.

1. The short version

This website sets no cookies, stores nothing on your device, uses no analytics or advertising services and loads no content from other servers. There are no forms, no registration, no comments and no newsletter. Only the technically necessary connection data that arises with every page request is processed (section 2).

2. Hosting and server log files

This website runs on a virtual server that the controller rents from dataflair – Kurz & Lankow GbR, Hochkoenigstr. 2, 83395 Freilassing, Deutschland (Marke Index-Hosting.com). The provider supplies the server infrastructure.

When you open a page, your browser technically has to send data to the server, in particular your IP address. The full IP address is processed only for the duration of the connection so that the page can be delivered to you. It is written to the web server's log file only in shortened form: for IPv4 addresses the last octet is removed, for IPv6 addresses only the first three blocks (/48) are kept. The shortened address does not allow a direct conclusion about you as a person.

The log file contains: the shortened IP address, date and time, HTTP method, requested path (without parameters after a question mark), HTTP status code, amount of data sent, and the browser identification your browser sends (user agent). The referring page (referrer), cookies and any input are not logged. The error log contains only serious server errors and normally no personal data.

Purpose: delivering the website, ensuring stability and security, error analysis and defence against abuse. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest is the secure and trouble-free operation of the website.

Retention: the logs are rotated daily and kept for at most seven rotations, then deleted; the data is therefore deleted after eight days at the latest. It is not combined with other data, not statistically evaluated and not passed on to third parties.

The hosting provider operates network and virtualisation and may, for technical reasons, process connection data itself. It is responsible for this under its own privacy notices.

3. Encryption

The website is delivered only over an encrypted connection (HTTPS, TLS), and your browser is told to use only HTTPS in future (HSTS). Requests over unencrypted HTTP are redirected to HTTPS. The certificate is issued by Let's Encrypt; no data of visitors is sent to Let's Encrypt in the process.

4. Cookies, local storage and tracking

The website uses no cookies and writes no data to your browser's local storage or session storage. No information is stored on or read from your device beyond what is technically necessary to load the page. Therefore neither a consent banner nor consent under § 25 TDDDG is required.

There is no tracking, no audience measurement, no profiling and no advertising. No fonts, scripts, images, videos, maps or social media buttons are loaded from other servers; all content comes from the same server. Your browser settings for light or dark appearance and for reduced motion are evaluated only in your browser and are not sent to us.

5. Contact

If you contact us by email (address in the imprint), we process your email address, the content of your message and the time in order to handle your request. The legal basis is Art. 6 (1) (b) GDPR if your request relates to a contract or pre-contractual measures, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). We delete the data once your request is settled and no statutory retention duties apply.

Note: emails sent unencrypted can be read by third parties in transit. Do not send confidential information unencrypted.

6. RSS feed

Fetching the RSS feed causes the same connection data as any other page request (section 2). No registration is needed. If you read the feed with a third-party service or program, that provider processes your data under its own privacy notices.

7. Links to other websites

If we link to third-party websites, their own privacy policies apply to them. By following a link you leave our website; we have no influence on the data processing there.

8. The game and further services

This policy covers the website. The game Sunfallow is not publicly available; there is currently no public download, no public user accounts and no public game servers. Before any such service starts, this policy will be extended in advance to cover the data processing that then occurs.

9. Recipients, third countries and automated decisions

The recipient of the connection data is the hosting provider as a technical service provider. The controller does not transfer personal data to countries outside the European Union or the European Economic Area. There is no automated decision-making, including profiling, under Art. 22 GDPR. Providing the connection data is technically necessary to open the website; without it the page cannot be delivered.

10. Your rights

You have the following rights against the controller regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR, see below)
• Right to withdraw consent at any time with effect for the future (Art. 7 (3) GDPR); this website does not process data on the basis of consent

11. Right to object

Where we process data on the basis of Art. 6 (1) (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An objection needs no form, for example an email to the address in the imprint.

12. Right to lodge a complaint with a supervisory authority

Without prejudice to other remedies you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your residence, place of work or place of the alleged infringement. The supervisory authority responsible for the controller is: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

13. Currency and changes

This policy describes the website as it was at the stated date. We adjust it when the website or the law changes, before the change takes effect.

As of: 30 October 2026