Privacy policy

Controller

Shayan Nosratzadegan
Sentruper Straße 216a
48149 Münster
Germany
Email: info@datlogic.de

In short

This website sets no cookies, uses no tracking or analytics tools and loads nothing from third-party servers. Fonts and images are hosted on our own server.

For the game we need an account with a player name, email address and password. For the waitlist we only need your email address, which we send via Brevo. We do not sell data or pass it on for advertising.

Hosting

The website and the game run on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its Nuremberg data centre. Hetzner processes data only on our behalf (Art. 28 GDPR).

Cloudflare

As long as the website and the game run under a provisional Laravel Forge address (ending in “on-forge.com”), all requests pass through Cloudflare (Cloudflare, Inc., San Francisco, USA). Cloudflare processes your IP address and the technical data of the request to forward it to our server and to fend off attacks. Data may be transferred to the USA in the process. This section no longer applies once we use our own domain without Cloudflare.

Visiting the website

When you visit, the server necessarily processes your IP address, date and time, the requested address and your browser identifier in order to deliver the page. We do not store access logs.

If a technical error occurs, the server error log may contain your IP address. We delete error logs after 52 days at the latest. The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR).

Your game account

When you create an account, we store your player name, your email address, your password (only as a scrypt hash, never in plain text), the time of registration and last login, and the language you play in. We need this to provide the game (Art. 6(1)(b) GDPR).

Your game state is also part of the game: business, furnishings, goods, cash, staff, diamonds and the appearance of your character. Every credit and spend of diamonds is recorded in a ledger for your account. While the game is open, it regularly fetches the state of your business, for example for the report on what happened while you were away; this creates no further data about you.

To prevent mass registrations, the server briefly keeps your IP address in memory; it is not stored.

If you reach the game through a link with a source tag (for example “?von=tiktok” from a profile or “?von=web” from this website), we store this tag with your account. This shows us which channels bring new players. We set no cookie for this and store nothing in your browser (Art. 6(1)(f) GDPR).

Password reset and emails

If you want to reset your password, we send you a link by email. We use Brevo (Sendinblue GmbH, Berlin, Germany) as a processor for this (Art. 28 GDPR). Brevo receives your email address, your player name and the link. The legal basis is providing your account (Art. 6(1)(b) GDPR).

We only keep a hashed check value of the link (SHA-256) with an expiry time. The link is valid for one hour, can be used once and is deleted afterwards.

Waitlist and news by email

On the home page you can join the waitlist with your email address. We will then email you when Mainstreet launches and with news about the game. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by ticking the box in the form.

For sign-up and sending we use Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany) as a processor (Art. 28 GDPR). Brevo receives your email address and the language of the page. We use double opt-in: after you submit the form you receive an email with a confirmation link, and you are only added to the list once you click it. Brevo logs sign-up and confirmation so that your consent can be proven. Without confirmation you will not receive any further emails.

We do not track whether you open our emails or click links in them.

When you submit the form, our server briefly processes your IP address in memory to limit abuse (at most five sign-ups in ten minutes, discarded afterwards). The legal basis is our legitimate interest in a secure form (Art. 6(1)(f) GDPR).

You can withdraw your consent at any time: via the unsubscribe link in every email or by writing to info@datlogic.de. We then remove your address from the list. Until then it remains stored.

What other players see

Mainstreet is a multiplayer game. Other players see your player name, the name and level of your business, your business from outside and inside (when they visit it), the appearance of your character and your offers on the town market. The leaderboard shows the name of your business, your player name, your town, your level, your number of sales and your reputation. Nobody sees your email address or your cash.

Cookie and browser storage

After you log in, the game sets a single cookie (“ms_session”) so that you stay logged in. It cannot be read by scripts, is valid for 30 days and is extended while you play. For each session we store your browser identifier so that sessions can be told apart.

In your browser storage (localStorage) the game only keeps settings: language, graphics level, wall view and whether the goal card is hidden. If you choose the language yourself, a short-lived marker stays in your browser until the language is saved to your account. This data does not leave your browser.

Both are technically necessary for the game, so we do not ask for consent (Section 25(2) no. 2 TDDDG).

How long we keep data

Your account and game state are kept until you request deletion. Write to info@datlogic.de. If an account violates the game rules, we may suspend it and store the time and the reason.

Payments

There are currently no purchases with real money. Diamond packages can so far only be bought with a test payment that involves no money. For each purchase we store the package, number of diamonds, price, payment method, status and timestamps (Art. 6(1)(b) GDPR).

If a payment provider is added, we will extend this policy before you can pay with real money.

Your rights

You can request access to your data, have it corrected or deleted, restrict processing, receive your data in a common format and object to processing based on legitimate interests (Art. 15 to 21 GDPR). An email to info@datlogic.de is enough.

You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.