Privacy notice · Version 2026-09-17-v1
1. Controller and contact
Darius Düppetell & Sascha Stedtler GbR
Wiesenweg 9, 21376 Salzhausen, Germany
Privacy contact: To be completed
Business website: ds-digitalwerk.de. Partners authorised to represent the partnership: Darius Düppetell and Sascha Alexander Stedtler. Legal notice.
2. Account and Steam link
For your optional account, we store your email address, a salted password hash, display name, internal administrator permission, Steam-verified SteamID and account link, registration and verification times, and the time and number of requested verification emails to limit delivery. Email is used for activation, not advertising. The purpose is to provide and secure the account you requested; the legal basis is Article 6(1)(b) GDPR. Registration is offered to people aged 16 or older.
Your Steam link is verified only after you initiate a Steam sign-in. Valve then transmits your SteamID. The Valve privacy notice applies on steamcommunity.com; processing outside the EU may occur. Email verification alone does not verify a SteamID. We do not receive your Steam password. Your email and SteamID are neither displayed to other visitors nor included in public API responses.
3. Persistent statistics only with consent
Only after email and Steam verification and explicit selection do we store the permitted categories: kills/deaths, accumulated playtime and visit count, highest cash value, accumulated observed cash gains and/or current clan membership. Global and seasonal totals and daily values (UTC) are created for the selected categories. Daily values show your progress only in your own account and are not disclosed to other users. Linking requires your private SteamID, display name and the time statistics were first recorded. The legal basis is your optional consent under Article 6(1)(a) GDPR.
Separate optional permission allows display to signed-in users under your display name in the player profile, leaderboard and clan totals. When clans change, permitted values count towards the current clan. Awards are derived from selected overall totals and displayed with the profile. They are removed when the underlying values are deleted. Calculations such as K/D and kills/h require the corresponding data permissions. Points use only new gains in the selected categories. The private account stores the balance, incomplete progress towards points, time of last processing, daily cap counters and transactions with amount, reason and time. Previously earned points are retained when statistics consent is withdrawn; deleting the account also deletes the balance and transactions. No automated decision with legal or similarly significant effects is made.
We store the current selections, the time and the version of the consent text. Without permission, no persistent statistics are stored. Having an account and playing the game do not require statistics or publication permission.
4. Live display only with registration and permission
Only registered users with verified email, a verified Steam link and optional live visibility enabled are displayed to signed-in users. The legal basis is this consent under Article 6(1)(a) GDPR. Unregistered players are not displayed. The game server interface technically returns the full player list; entries without valid permission are immediately filtered out and are not added to tracking memory or the database.
For permitted live sessions, we hold the display name, SteamID for internal matching, faction, clan tag, kills/deaths, cash, ping and session duration exclusively in memory. SteamIDs remain private. Registered users without live permission also remain invisible; separately authorised persistent statistics may still be collected.
Live data stops being delivered no later than the configured offline timeout after the player was last seen (45 seconds by default). Technical cleanup takes place no later than the next maintenance run, which runs every minute, or a backend restart. There is no persistent session history. You can withdraw permission in your account at any time. After account deletion, you will not appear live again.
5. Retention and deletion
Unverified registrations are automatically deleted after 24 hours (maintenance runs every minute). Verified account data and permitted aggregated statistics, including daily values, are retained until account deletion or withdrawal, as applicable. Completed season totals are retained until then. Changes to statistics permissions delete existing statistics and start new recording.
The delete button removes the account, its verification tokens, sign-in sessions, Steam link and all its stored statistics from the active database. Withdrawal deletes statistics but retains the account and prevents further recording. Full account deletion prevents both live display and persistent statistics recording. The operator must also account for deletions in backups and restores. The application does not create backups itself.
Backups and deletion procedures: To be completed. Access logs and retention periods: To be completed.
6. Recipients, hosting and email
Hosting: To be completed. Email service provider: To be completed. Your email address is transmitted to the email provider to send verification. Authorised operators may access stored data for administration. Public profiles and live data are available only to signed-in users. We do not use advertising trackers, analytics tools or externally loaded fonts.
Before public launch, the operator must establish processing agreements, actual processing locations and, where applicable, safeguards for third-country transfers for the providers used. Hosting in Germany alone does not guarantee full GDPR compliance.
7. Necessary cookies and security
We use only necessary sign-in cookies: byteraid_session for users, including administrators (maximum eight hours, HttpOnly, and Secure on HTTPS). Only hashes of user tokens are stored on the server. Single-use email tokens are valid for no more than 24 hours; Steam linking requests for ten minutes. Expired tokens are removed automatically. Passwords are hashed with scrypt.
To prevent automated sign-in attempts, pseudonymised IP- and email-related counters are held in memory for no more than 15 minutes. We also limit verification emails per account and store server-wide delivery counters without recipient details for hourly and daily limits. The application does not log SteamIDs, emails, player names or live snapshots. Infrastructure and proxy logs are the responsibility of the operator. In particular, Steam callback URLs must not be stored in access logs because they contain identity data. Security processing is based on Article 6(1)(f) GDPR; necessary cookies support the explicitly requested sign-in.
8. Your rights
You may request access, rectification, erasure, restriction and, where applicable, data portability. A JSON export of your account data and statistics is available in your account. You can request corrections or a change to your Steam link through the privacy contact. You can withdraw consent in your account at any time with effect for the future; this does not affect the lawfulness of earlier processing.
You may object to processing based on legitimate interests under Article 21 GDPR on grounds relating to your particular situation. You have the right to complain to a data protection supervisory authority. Competent authority: To be completed.