Privacy policy

1. Controller

Anatol Heinrich
Myrthengasse 12/7, 1070 Wien
Österreich (Austria)
Email: info@shadow-decker.com

An email to this address is all it takes for any data protection request.

2. Hosting and server logs

The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (server location Falkenstein, Germany). Hetzner processes the data as a processor under Art. 28 GDPR.

On every request the web server logs technical access data: IP address, date and time, requested address, status code, amount of data transferred, referrer and browser identifier (user agent). This serves the secure and stable operation of the site and the defence against attacks (legitimate interest, Art. 6(1)(f) GDPR). The logs are deleted after 14 days.

The connection is encrypted with TLS (certificate from Let's Encrypt).

3. Playing without an account

Without an account, saved games, unlocked images, mission progress and settings (volume, language, tutorial status) are stored only in your browser's local storage (localStorage) and are not transmitted to us. In addition, a service worker keeps pages and graphics in the browser cache so that the game loads faster and works offline.

This storage is strictly necessary for the service you requested (§ 165(3) of the Austrian Telecommunications Act 2021, TKG 2021) and therefore needs no consent. You can remove the data at any time in your browser settings ("clear site data"). Local saved games are lost when you do.

4. User account

When you create an account, we process:

• Email address and password. The password is stored only as a bcrypt hash, never in plain text.
• Codename, chosen avatar (from a fixed selection) and preferred language.
• Confirmation of the minimum age (16 years) with its time.
• Setting whether you appear anonymously on leaderboards.
• Game data: cloud saves, mission progress, statistics, achievements, daily mission results (including the move log used to check for tampering), streaks and leaderboard entries.
• Optional two-factor sign-in: the TOTP secret and the backup codes are stored encrypted or hashed.
• Account changes: for an email change, the old and the new address. Also a pseudonymised log of security-relevant account actions. It holds an irreversible hash instead of your user ID and, for email changes, only the domain.

Purpose and legal basis: providing the account and the game features (performance of a contract, Art. 6(1)(b) GDPR). The security log serves traceability and protection against misuse (Art. 6(1)(f) GDPR).

Minimum age: accounts are available from the age of 16.

Sign-in cookies

For sign-in, the website sets only technically necessary cookies:

• Session cookie (authjs.session-token, up to 30 days)
• Protection against cross-site request forgery (authjs.csrf-token, session)
• Return address after sign-in (authjs.callback-url, session)

They are strictly necessary for signing in (§ 165(3) TKG 2021, Art. 6(1)(b) GDPR).

Password check

At registration and on password changes we check whether the password appears in known data breaches. To do so we send the first 5 characters of the password's SHA-1 hash to the "Pwned Passwords" service (api.pwnedpasswords.com, run by Troy Hunt via Cloudflare). Neither the password itself nor the full hash leaves the server; no conclusion about you can be drawn. Legal basis: Art. 6(1)(f) GDPR (protecting your account).

5. Sending email

For confirmation, reminder and password emails we use Resend (Resend, Inc., USA) as a processor. Your email address and the content of the respective email are transmitted. The transfer to the USA is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR) in Resend's data processing agreement. Legal basis: Art. 6(1)(b) GDPR.

6. Leaderboards and publicly visible data

• Monthly leaderboard: it is publicly visible. Shown are rank, display name, total alarm, missions cleared and time of submission. The display name is your codename at the time of submission, or "Agent Anonymous" if you choose to appear anonymously.
• Daily mission leaderboard: it is visible to signed-in players and follows your current anonymity setting.

Your email address is never visible to others. You can change the anonymity setting in your profile at any time. Legal basis: Art. 6(1)(b) GDPR.

7. Protection against abuse

To limit sign-in and registration attempts, we briefly store the IP address or the entered email address as a counter in the in-memory database Redis. The counters expire automatically after their time window (at most 1 hour). Legal basis: Art. 6(1)(f) GDPR (protection against attacks).

8. Anonymous usage statistics

To understand how many people use the game and where they come from, we count page views and game events (e.g. "daily mission started") without cookies and without an identifier stored in the browser. The following applies:

• A hash is formed from the IP address and the browser identifier together with a random value that is newly generated every day. It serves only to count a visitor once within a day. The random value is deleted after 48 hours at the latest; after that, the hash can no longer be linked to anyone.
• The IP address is not stored.
• Only daily totals (e.g. "120 views of /daily-op"), the domain of the referring page (e.g. "reddit.com") and the identifier of a shared link (e.g. "daily") are stored.
• For signed-in players we also store on which days the account was active, to see whether players come back. This is deleted together with the account.
• If your browser sends "Do Not Track" or "Global Privacy Control", we do not count you.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is improving the game and measuring reach without tracking.

9. Backups

The database is backed up daily in encrypted form. Backups are deleted after 7 days. Deleted accounts are therefore still contained in backups for up to 7 days. If a backup is restored, the deletions are carried out again.

10. Retention and deletion

• Account data and all game data of the account: until the account is deleted. You can delete the account in your profile. It is locked immediately and permanently deleted after 30 days, with all saved games, leaderboard entries, achievements and the security log. All that remains is an irreversible hash as proof of the deletion.
• Local browser data: until you delete it in your browser.
• Server logs: 14 days.
• Backups: 7 days.

11. Disclosure to third parties

We do not pass your data on to third parties, except to the processors named above and where we are legally obliged to. There is no advertising, no sale of data, no profiling and no automated decision-making.

Links to external sites (e.g. ko-fi.com for voluntary donations or gamesbymanuel.com) are only loaded when you click them. The privacy policy of the respective provider then applies.

12. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR).

You can exercise many of them directly in your profile: export data (access and portability as a JSON file), change your codename and settings, delete account. For anything else, write to info@shadow-decker.com.

You can also lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde): Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at, www.dsb.gv.at.