Privacy policy

1. Who is responsible

The controller under the GDPR is:

[First and last name]
[Street and number]
[Postcode and city]
Germany
Email: hello@example.com

We are not required to appoint a data protection officer.

2. What data we process and why

• Visiting the website: your IP address, the time, the page requested and your browser's details, to deliver the site and keep it secure (Art. 6 (1) (f) GDPR). Our host keeps these server logs only briefly.
• Bot protection: the sign-up, login and password reset forms use Cloudflare Turnstile, which checks your browser and IP address to tell people from bots (Art. 6 (1) (f) GDPR; our interest is protecting accounts from abuse).
• Account: email address, display name, password (stored only as a hash), whether you want drop emails, and when you accepted the terms and withdrawal policy. We need these to provide your account and the membership (Art. 6 (1) (b) GDPR) and to be able to prove the acceptance (Art. 6 (1) (f) GDPR).
• Membership and payment: Stripe sells the membership as reseller (merchant of record) and processes your payment details as its own controller; we never see your card details. From Stripe we receive your plan and the status and dates of your subscription. We pass Stripe the time you accepted the terms and withdrawal policy, as the record of your consent to immediate access (Art. 6 (1) (b) and (c) GDPR).
• Member codes: your personal discount codes. The merch code is registered with Fourthwall without your name or email. When you open the shop in the member area, product images load from Fourthwall's servers, which see your IP address (Art. 6 (1) (b) and (f) GDPR).
• Emails: emails about your account, membership, cancellation and withdrawal (Art. 6 (1) (b) and (c) GDPR), and an email when a new drop goes live, as part of the membership (Art. 6 (1) (b) GDPR). You can turn drop emails off in your account or with the link in every drop email. We record which emails we sent, so none goes out twice. We don't track whether you open them or click links.
• Spotlight: what you submit (title, description, images, links, engine, and the handles you want credited), to review it and, if we feature it, publish it on @thats_gamedev with credit. Reviewing your submission is part of the membership (Art. 6 (1) (b) GDPR); publishing it is based on your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time for the future.
• Cancellation and withdrawal forms: name, email address, the reference you give, and the date and time, to carry out and prove your request (Art. 6 (1) (c) GDPR; §§ 312k and 356a BGB). To stop abuse of these forms, we also store a keyed hash of your IP address, which can be compared but not turned back into the address (Art. 6 (1) (f) GDPR).
• Emails to us: what you write and your address, to answer you (Art. 6 (1) (b) or (f) GDPR).

You need to give us the account data to become a member; without it we can't provide the membership. We don't use automated decision-making or profiling.

3. Cookies and similar technologies

We only use technically necessary cookies: they keep you logged in (§ 25 (2) No. 2 TDDDG). The bot protection on the account forms works the same way. There are no analytics, advertising or tracking cookies, and our fonts are hosted on our own server.

4. Who receives data

These service providers process data on our behalf, bound by a data processing agreement (Art. 28 GDPR):

These recipients process data as their own controllers:

Where data goes to a country outside the EU, it is protected by an adequacy decision (for the USA: the EU-US Data Privacy Framework, for certified companies) or by the EU's standard contractual clauses (Art. 45 and 46 GDPR). You can ask us for a copy of the safeguards.

5. How long we keep data

• Account and membership data: as long as your account exists. When it is deleted, we delete your profile, codes, Spotlight submissions and images, and our record of the emails we sent you. We keep the subscription records without any link to you, for our statistics.
• Payment records: Stripe keeps invoices and payment records for the periods tax law requires (up to 10 years, § 147 AO, § 257 HGB), also after your account is deleted.
• Payment notifications from Stripe: deleted after one year.
• Cancellation and withdrawal requests: kept as proof until the end of the third year after the request (the regular limitation period, § 195 BGB).
• Server logs: deleted by our host after a short time, at most 30 days.

6. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on Art. 6 (1) (f) GDPR (Art. 15 to 21 GDPR). You can withdraw a consent at any time, with effect for the future.

Deleting or exporting your data: use “Request data export or deletion” in your account, or email hello@example.com from your account's address. We answer within one month (Art. 12 (3) GDPR). Deleting your account ends a running membership.

You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you think your data was misused (Art. 77 GDPR).

7. Changes

We update this policy when our services or the law change. The current version is always on this page.