Privacy Policy

1. Data Controller

The party responsible for data processing on this website and within the game "Project Maelstrom" is:
[Name/address to be added — see Legal Notice]
Email: projectmaelstrom@fastmail.com

No Data Protection Officer has been appointed, since the legal requirements for one (Section 38 of the German Federal Data Protection Act, in particular the ongoing employment of at least 20 people involved in the automated processing of personal data) do not currently apply. Please direct any data protection inquiries to the email address above.

2. Your Rights at a Glance

You have the right, at any time, to:

• Access the data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing based on legitimate interest (Art. 21 GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR) — either the data protection authority of your own country of residence, or the authority responsible for the controller's place of business.

Please send any request informally by email to projectmaelstrom@fastmail.com. These are currently handled manually within the statutory one-month period (Art. 12(3) GDPR) — as of July 2026 there is no automated self-service "delete my account" function within the game itself yet.

3. This Website (Marketing Landing Page)

This static landing page (the domain root and any page outside /play/) uses no cookies, no tracking, and no analytics services. No form data is collected, and no personal data is shared with third parties. On each visit, the web server (nginx) automatically generates standard access logs (server logfiles — IP address, timestamp, requested file) for a few days, for troubleshooting and to secure operation, as is technically unavoidable with essentially any web server. These logfiles are never combined with any other data source.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website).

4. Registration and Game Account

Actually playing "Project Maelstrom" (available at /play/) requires a game account. Depending on how you sign in, we process:

Sign-in method	Data processed
Email + password	Email address, password (stored exclusively as a salted hash — the plaintext is never known to us after registration), your chosen display name
Sign in with Discord	Your Discord user ID (not your password — sign-in runs through Discord's own OAuth flow, so we never receive your Discord password)
Sign in with Steam	Your Steam ID64 (also via Steam's official OpenID flow — no access to your Steam password)

You may optionally upload a profile picture, which is automatically cropped and resized to a standard size on our server before it's stored. Your visible game progress (planets, fleets, in-game messages, etc.) is retained for as long as your account exists, since it's the basis of the game itself.

Legal basis: Art. 6(1)(b) GDPR (performance of the usage agreement you enter into by registering).

5. Login Records and Abuse Prevention

For every login attempt (successful or failed), we record the IP address, user agent (browser/device identifier), and timestamp. This is used to detect brute-force attacks (automatic lockout of an account after several failed attempts), and to detect multi-account abuse and other behavior harmful to the game (anti-cheat). Anomalies are first flagged internally ("suspicion flags") and always reviewed by a human — not automatically — before any action (such as suspending an account) is taken; there is no solely automated decision-making with legal effect within the meaning of Art. 22 GDPR.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, fair game and in preventing abuse).

6. Cookies

Within the actual game (/play/), after a Discord or Steam sign-in, a technically necessary cookie is set for a maximum of 10 minutes, used solely to securely hand off Discord's/Steam's own callback to our application during the sign-in process. This cookie is exempt from consent requirements under Section 25(2) No. 2 of the German Telecommunications-Telemedia Data Protection Act ("TTDSG"), since it's technically required to carry out the sign-in you explicitly requested — that's why we don't show a separate cookie banner for it.

Once you're signed in, your session token is not stored as a cookie, but in your browser's localStorage (purely client-side — it isn't automatically sent with every page request, only when the game application actively makes a request to our server). It's used exclusively to keep you signed in and expires automatically after 7 days.

7. Disclosure to Third Parties

Your data is only shared where technically necessary to provide the service:

• Discord Inc. and Valve Corporation (Steam) — as external sign-in providers you choose yourself, these receive the information technically required for the respective OAuth sign-in process; we have no influence over their own data processing and refer you to their own privacy policies. As both companies are based outside the EU (USA), a transfer of data to a third country may occur; please refer to Discord's and Valve's own privacy policies for details of the legal basis they rely on (e.g. the EU-US Data Privacy Framework).
• Hosting — our servers are operated by Hetzner Online GmbH, Germany (data processing agreement under Art. 28 GDPR). Your data does not leave the EU as a result.
• We do not share data for advertising purposes. No analytics, tracking, or advertising services are currently integrated.

8. Retention Period

We only store personal data for as long as necessary for the purposes stated above — as a rule, for the lifetime of your game account. Login records (Section 5) are automatically deleted or anonymized after a reasonable period used for abuse detection. On request (see Section 2), we delete your account and the associated personal data in full, unless legal retention obligations require otherwise.

9. Changes to This Privacy Policy

We may update this privacy policy as needed, for example if new features (such as future paid content — see our Terms of Service) introduce new data processing. The version published on this page at any given time applies.