Privacy policy
Gladius et Pilum is a browser game. We process only the data we need to provide you with a game account and to run the game securely. We use no analytics or tracking tools, show no advertising and embed no third-party content: no external fonts, no third-party scripts, no social media plugins.
1. Controller
The controller responsible for processing your personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Christian Metzenjoy dialogs
Albert-Einstein-Str. 6
87437 Kempten (Allgäu)
Germany
Email: info@enjoy-dialogs.de
Contact form:
Send a message
Please send any question about data protection to this email address.
2. Visiting the website
When you open the website, your browser necessarily sends data to our server: your IP address, the date and time, the address requested, your browser's identifier (user agent) and, where applicable, the page you came from (referrer). We process this data to deliver the website, protect it against attacks and find errors. To protect sign-in and registration against automated guessing, the server counts the account forms submitted per IP address, holding the IP address briefly in memory for that purpose.
This information may be stored in server logs together with error messages and, when an email is sent, the recipient's address and the subject. The logs are deleted after 14 days at the latest. We keep individual entries longer only while they are needed to investigate a specific security incident.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is operating the website securely and without disruption.
3. Game account and game data
To play, you create an account. For this we process your email address, which is also your user name, and your password. We store the password only as a cryptographic hash, never in plain text. The account also holds technical details: whether your email address is confirmed, failed sign-in attempts and any temporary lockout that follows from them.
You may, if you wish, add a phone number in your account settings and set up two-factor sign-in. We then store these details too; for two-factor sign-in, the key for your authenticator app and your recovery codes. We do not currently use the phone number.
When you join a game world, we store your participation: the ruler name you choose, your realm, your moves and the time of your last access. Other players in that world can see your ruler name and your realm, but not your email address.
The legal basis is Art. 6(1)(b) GDPR: we need this data to provide the game you signed up for. Without an email address and a password we cannot set up an account; everything else is optional.
We keep your account data until you have your account deleted. Your moves then remain part of the history of the world concerned, but without any link to your account or your email address.
4. Emails
We only write to you when your account requires it: to confirm your email address, to reset your password and to confirm a changed email address. We do not send newsletters or advertising.
We send these emails through the SendGrid service of Twilio Inc. (USA). Twilio processes your email address, the content of the message and technical delivery data such as time and delivery status on our behalf (Art. 28 GDPR). Twilio is certified under the EU-U.S. Data Privacy Framework; the transfer to the USA is based on the European Commission's adequacy decision (Art. 45 GDPR). Open and click tracking are switched off for our emails: they contain no tracking pixel, and their links lead straight to us.
The legal basis is Art. 6(1)(b) GDPR.
5. Contact
When you email us, we process your email address, your message and any details you choose to
give. Our contact form is provided by the Aidbase service of Highware GmbH, Baar (Switzerland).
It opens on their site hosted.aidbase.ai; our own pages load nothing from Aidbase.
What you enter there (such as name, email address and message) is processed by Aidbase on our
behalf (Art. 28 GDPR), together with technically necessary connection data such as your IP
address. Switzerland is covered by an adequacy decision of the European Commission (Art. 45 GDPR).
We use this data only to answer your request and delete it once the request is settled, unless a statutory retention duty applies. The legal basis is Art. 6(1)(b) GDPR where your request concerns your game account, otherwise Art. 6(1)(f) GDPR; our legitimate interest is being able to answer requests.
6. Cookies
We set only cookies that are strictly necessary for operating the website. Under § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) these need no consent, which is why there is no cookie banner. We use no tracking or advertising cookies.
| Cookie | Purpose | Lifetime |
|---|---|---|
.AspNetCore.Identity.Application |
Keeps you signed in after you log in. | Until you close the browser; with “Keep me logged in” up to 14 days |
.AspNetCore.Antiforgery.… |
Protects forms against forged requests (cross-site request forgery). | Until you close the browser |
.AspNetCore.Mvc.CookieTempDataProvider |
Carries a status or error message over to the next page. | Until the message has been shown |
Identity.TwoFactorUserId |
Two-factor sign-in only: remembers during sign-in that the second factor is still due. | A few minutes |
Identity.TwoFactorRememberMe |
Only if you choose “Don't ask again on this computer”: skips the second factor on this device. | Up to 14 days |
.AspNetCore.Culture |
Only if you pick a language in the header: remembers that language. | One year |
The legal basis for the processing involved is Art. 6(1)(b) GDPR (signing in) and Art. 6(1)(f) GDPR (protecting the forms).
7. Hosting and backups
The website and its database run on a server of Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, in a data centre in Germany. We back up the database daily to storage operated by Hetzner Online GmbH in Falkenstein (Germany). Each backup is deleted after 30 days at the latest; until then it may still contain data of an account that has since been deleted. Hostinger and Hetzner process the data solely on our behalf (Art. 28 GDPR).
8. Disclosure
Apart from the service providers named here, nobody receives your data unless we are legally obliged to disclose it. We do not sell data.
9. Your rights
You have the right
- to access the data we hold about you (Art. 15 GDPR),
- to have inaccurate data corrected (Art. 16 GDPR),
- to have your data erased (Art. 17 GDPR),
- to have processing restricted (Art. 18 GDPR) and
- to receive the data you have provided to us in a common, machine-readable format (Art. 20 GDPR).
To exercise these rights, write to us at the email address given above.
Right to object (Art. 21 GDPR)
Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR, here the server logs, the protection of forms and requests unrelated to an account), you may object to that processing at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.
10. No automated decisions
We make no automated decisions within the meaning of Art. 22 GDPR and create no profiles.
11. Changes
If the game or the way we process data changes, we will update this policy. The version published here applies.