Privacy policy
This policy explains which data is processed when you visit shatterwork.com, when you join the waitlist and when you use the Shatterwork game. The leaderboard is still in progress; it is described as it is planned.
Controller
Marcus Gier, Thüringer Straße 15, 50733 Köln, Germany. Email: werkstatt@shatterwork.com
This website
This website sets no cookies and uses no analytics, no advertising and no content or fonts from other servers. All fonts and images are delivered by our own server.
Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in the Nuremberg data centre.
Server logs: for each request, the web server stores the shortened IP address (the last part is removed), date and time, the requested address, the status code, the amount of data transferred, the previously visited page (referrer) and the browser identification (user agent). We use this data only to operate the website securely and to find errors. Legal basis: Art. 6(1)(f) GDPR. The logs are deleted after 7 days.
If you write to us, we use your address and your message only to reply, or to let you know when Shatterwork can be played if you asked for that. Legal basis: Art. 6(1)(b) and (f) GDPR. We delete the message once it has served its purpose.
The mailbox is hosted by our hosting provider Hetzner Online GmbH in Germany, which operates it for us as a processor.
Waitlist and news
If you join the waitlist on shatterwork.com (the workshop letter), we use your email address only to let you know when Shatterwork can be played and to send you news from the workshop. This includes when we are looking for testers.
The legal basis is your consent, Art. 6(1)(a) GDPR. We use double opt-in: after you sign up, you receive an email with a confirmation link. You are only on the list once you confirm.
We store your email address, the language, the time of sign-up and of confirmation, the shortened IP address at each of these steps (the last part is removed) as proof, the version of the consent text and when we last wrote to you.
Storage period: we delete unconfirmed addresses after 48 hours. We keep confirmed addresses until you unsubscribe. Unsubscribing deletes the address.
Unsubscribing: every email contains an unsubscribe link, or you can send us a short email. You can withdraw your consent at any time. This does not affect the lawfulness of processing before the withdrawal (Art. 7(3) GDPR).
Recipients: we send the emails through the mail server of our host Hetzner Online GmbH, which acts as our processor. The emails contain no tracking pixels, and we do not track whether you click links. We do not pass your address on to anyone.
Without email: the news is also available as an RSS feed. For that we need no data from you. Only the server logs apply, as described above.
Game and account
The account in the game is optional. Without an account, your saved games stay on your device.
Quick account: you choose a nickname and state whether you are 16 or older. No real name and no email address are needed. Players under 16 choose their nickname from the suggestions of our name generator. When you create the account, you receive a recovery code with which you can restore your account, for example on a new device. Keep it in a safe place.
We store:
- the age band (16 or older, or under 16) and the language of the game
- your nickname and your profile symbol
- the recovery code, only as a scrypt hash, never in plain text
- pairing codes with which you connect another device, only as a hash. They are valid for 10 minutes and are deleted after use or at the latest two days after they expire.
- your sessions per device, with an optional device name. A session lasts 90 days from its last use; we delete expired sessions daily.
- your saved games, plus the last 5 versions of a saved game for 30 days, so that nothing is lost
- the state of your finished movements (“My movements”), your results and your game profile with milestones and best scores
- your runs with points, mistakes and playing time, as the basis for the leaderboard
- nickname reports: if you report an offensive nickname, we store the nickname, your reason, the time and your account
- replies to repeated requests, encrypted and for 7 days, so that an action is not carried out twice on a poor connection
IP addresses: the game interface writes no IP addresses to its logs. To prevent abuse, it keeps the shortened address in memory for rate limiting for about one hour at most. For the web server logs, the section “This website” applies.
Purpose and legal basis: providing the game and your account, Art. 6(1)(b) GDPR. Reports and rate limiting protect players and the service, Art. 6(1)(f) GDPR. The data is stored on servers of Hetzner Online GmbH in Germany. There is no transfer to third countries.
Leaderboard: it is still to come. Once it starts, nicknames and results will be visible to other players there.
Data export: in your account you can download all your data as a file (Art. 20 GDPR). Codes and hashes are not included.
Storage period and deletion: until you delete your account. You can do this at any time in the app under Account → Delete account. All data of your account is deleted immediately and completely, and your nickname is free again at once. We delete accounts automatically when they have not been used for 24 months.
Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object to processing based on Art. 6(1)(f) GDPR (Art. 21). A short email is enough.
You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.