Privacy Policy
Last updated: 2026-09-08. This policy will be updated whenever our data processing changes.
1. Controller
The controller responsible for data processing on this website is: Maximilian Iliew Eislebener Str. 4 10789 Berlin Germany Email: [email protected]
2. Hosting
This website is hosted on a dedicated server of IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) located in Germany. On our behalf, IONOS processes server log files that arise technically when the site is accessed (including IP address, timestamp, requested resource, user agent). The legal basis is our legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR). A data processing agreement (Art. 28 GDPR) is in place with IONOS.
3. Account, sign-up & authentication
A user account is required to use Warcodex. During registration and sign-in we process: - email address, display name/username, optionally a profile picture, - for password registration: a cryptographically hashed password (bcrypt; the plaintext password is not stored), - a technical user identifier and, where applicable, the email verification status. The legal basis is the performance of a contract (Art. 6 (1) (b) GDPR).
3a. Sign-in via Google (OAuth)
Optionally, sign-in can be performed via a Google account. In this case Google LLC / Google Ireland Ltd. transmits to us the profile data required for sign-in (name, email address, optionally a profile picture and a Google account identifier). Data may be transferred to the USA. Such transfers are covered by Google's certification under the EU-US Data Privacy Framework; in addition, Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR are in place and continue to apply should the certification lapse. The legal basis is the performance of a contract or your consent to the sign-in process (Art. 6 (1) (b) or (a) GDPR).
3b. Protection of the registration form (Cloudflare Turnstile)
To prevent automated mass registrations and abuse, we use the bot protection service „Turnstile“ provided by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) on our registration page. Turnstile is loaded exclusively on the form pages where this protection is required, and not during the rest of your visit to the website. When the verification widget loads, your browser connects to Cloudflare. Cloudflare processes technical signals in doing so, in particular your IP address, browser and operating system information (user agent), characteristics of the encrypted connection and the identifier of our site. According to the provider, content you type into the form is not read or transmitted. In our configuration the widget does not set cookies; the optional cookie feature („pre-clearance“) is disabled. We subsequently transmit only the verification result generated by the widget back to Cloudflare for validation; we do not additionally pass on your IP address. The verification result is not stored and is not linked to your account. The legal basis is our legitimate interest in defending against automated attacks and in the secure operation of the Service (Art. 6 (1) (f) GDPR). Access to information on your device is strictly necessary in order to provide the registration you have expressly requested (Section 25 (2) no. 2 TDDDG). According to its own documentation, Cloudflare processes these signals partly as a processor on our behalf and partly as an independent controller in order to improve its own bot detection. A data transfer to the USA takes place; Cloudflare is certified under the EU-US Data Privacy Framework and additionally provides standard contractual clauses. For details see Cloudflare Turnstile Privacy Addendum. If you do not wish to use the bot protection, you can contact us at [email protected]; registration without executing the widget is technically not possible.
3c. Confirmation of your email address (double opt-in)
After registration we send a confirmation email to the address provided. It contains a single-use link with which you confirm that the address belongs to you. Only then is sign-in possible. This prevents accounts from being created on other people's email addresses and ensures that we can reach you in security-relevant matters. For this purpose we store your email address, a cryptographic check value of the confirmation link (not the link itself), the time it was created and its expiry time. The link is valid for 24 hours. After confirmation or expiry the check value is deleted; only the time of successful confirmation is retained. Accounts that are not confirmed within 30 days are deleted automatically and in full. The legal bases are the performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR) and our legitimate interest, together with the interest of the holders of third-party email addresses, in preventing registrations by others (Art. 6 (1) (f) GDPR). The confirmation email contains no advertising. Regarding dispatch see section 6.
3d. Record of the Terms of Use and the age confirmation
During registration you accept our Terms of Use and confirm that you are at least 16 years old. In order to be able to evidence this, we store with your account only: the time at which the Terms of Use were accepted, the version (date of issue) of the Terms accepted, and the time of the age confirmation. We deliberately store neither your date of birth nor your IP address for this purpose: the time, the version and the link to your account suffice as evidence, and anything further would not be necessary (principle of data minimisation, Art. 5 (1) (c) GDPR). No age verification via identity documents or payment data takes place. We do not, and cannot, obtain consent to the Privacy Policy: the Privacy Policy informs you pursuant to Art. 13 GDPR, it is not a consent. The processing operations in the Service that are actually consent-based (public profile, share links, leaderboard, avatar on the leaderboard) are granted and withdrawn separately in your privacy settings; see sections 5a to 5d. The legal basis for storing this record is our legitimate interest in being able to evidence the conclusion of the contract and the age declaration (Art. 6 (1) (f) GDPR) as well as the performance of the contract (Art. 6 (1) (b) GDPR). The record is deleted together with your account.
4. Cookies & session
We use exclusively technically necessary cookies to maintain your sign-in for the duration of the session (session cookie, CSRF protection; JWT-based session). These cookies are required for operation and do not require consent (§ 25 (2) no. 2 TDDDG). Tracking or analytics cookies are currently not set. The bot protection used on the registration page also does not set any cookies in our configuration (see section 3b). Information about third parties. When you record a game, you may enter the name of your opponent. We process this entry solely to maintain your personal game history; the legal basis is our legitimate interest in providing a comprehensible record of your games (Art. 6(1)(f) GDPR). The entry is voluntary, is not visible to other users, and is technically suppressed on public profile pages: an opponent's name appears there only if that person holds an account of their own and has expressly enabled this in their privacy settings. Otherwise only the label "Opponent" is shown. We are unable to notify the named person separately as we hold no contact details for them (Art. 14(5)(b) GDPR); you can change or remove the entry at any time. Data subjects may contact us at the address stated in the imprint.
5. User content (collection, lists, games, photos)
Content you create yourself (army lists, collection/Pile of Shame, game tracking, uploaded photos) is stored to provide you with the features. Uploaded images are stored on our own object storage (MinIO/S3) on the server in Germany mentioned above. During game tracking you can enter an opponent's name as free text; please only record data you are authorized to provide. Legal basis: Art. 6 (1) (b) GDPR. If you enter an opponent's name during game tracking, it is server-side pseudonymized as "Opponent" on all public/anonymous surfaces (public profiles, shared links); an opponent's real name only appears there if that person is registered and has themselves consented to showing their name.
5a. Public profiles, shared links & user search
By default your profile is private and nothing is published (privacy by default, Art. 25 GDPR). You may voluntarily choose to make individual areas visible at any time: a public profile at /u/<handle> (for everyone or for signed-in users only), individual areas (statistics, achievements, lists, games) via toggles, and open share links to single games (/g/<token>) or lists (/l/<token>) that can be viewed without an account. Which data each setting exposes is shown to you directly in the respective control. The legal basis for any such publication is your consent (Art. 6 (1) (a) GDPR), not contract performance — publication is not required to operate the service. Every grant and every withdrawal is logged for proof purposes (Art. 7 (1) GDPR). You can withdraw any consent at any time with effect for the future (Art. 7 (3) GDPR) — via the respective setting, by revoking a link, or via "Withdraw all public data", which immediately sets your profile to private, hides all areas and disables every shared link; a revoked link stops working instantly. User search & discoverability: If you enable "Discoverable in user search", your public handle or display name can be found by signed-in users via an internal search; for this we operate a technical search index (trigram index) over handle and display name, whose sole purpose is social discoverability. This discoverability is also based on your consent and is off by default. Search-engine indexing only happens for public, discoverable profiles; game and list links are excluded from indexing entirely. Minimum age (Art. 8 GDPR): Publishing profile data, creating open share links, participating in the leaderboard (section 5c), and showing your profile picture to other users (in particular the leaderboard consent under section 5d) require that you have reached the age needed for valid consent. Persons under 16 cannot give valid consent to publication without the authorization of a parent/guardian. Access & portability: Your profile, privacy and sharing settings (public handle, visibility, area releases, discoverability, share links, consent log) are covered by your rights of access and data portability (Art. 15, Art. 20 GDPR).
5b. Achievements, Rank & Titles (Gamification)
Based on the games you record, we derive playful achievements, a rank calculated from them and freely selectable titles, and store these associated with your account. Some achievements (e.g. defeated enemy characters or opposing armies you played against) rely on a trust-based self-declaration you make yourself after the game. Rank and titles are a purely additive evaluation of your own game progress; they serve solely as playful motivation and have no legal effect. By default, achievements, rank and titles are private and visible only to you. Only once you release the “Achievements” section of your public profile do rank, active title and trophies become visible to the audience you choose (public profile, shared links, gallery) — on the basis of your consent (Art. 6(1)(a) GDPR), revocable at any time via the same switch or via “Withdraw all public data”. Only if you additionally enable “Discoverable in user search” and have released the Achievements section can a rare achievement (e.g. reaching the highest rank) appear with your public handle in a general achievement announcement to other users; otherwise any such announcement is made exclusively anonymised, without your name. Opponents are always treated pseudonymously in achievement-related public representations.
5c. Leaderboard
If you separately enable this in your privacy settings, you appear with your display name or public handle, your rank, your active title, and the values of the following metrics on Warcodex's internal leaderboard: win rate, number of ranked games, trophy count, rank points, and current win streak. The leaderboard is visible to signed-in users only; it is never public or accessible without an account, and it is not indexed by search engines. The legal basis is your separate, freely revocable consent (Art. 6(1)(a) GDPR) — this consent is independent of releasing the "Achievements" section on your public profile (section 5b) and covers the leaderboard exclusively. If you enable the leaderboard while your profile is still set to "private", your profile's visibility is raised to "signed-in users only" in the same step; both consents are logged separately (Art. 7(1) GDPR). You can withdraw participation at any time with a single click via the same toggle (Art. 7(3) GDPR); the withdrawal takes effect immediately — you are removed from the leaderboard on the next page load. The leaderboard shows no game details, no opponent identities, and no financial data; opponents are never displayed on the leaderboard. Sorting by metrics is a purely additive evaluation of existing game data and does not constitute automated decision-making or profiling within the meaning of Art. 22 GDPR (see section 11). Your leaderboard setting (participation status, consent log) is covered by your rights of access and data portability (Art. 15, Art. 20 GDPR).
5d. Profile picture (avatar)
In addition to a profile picture optionally taken over at sign-in (see section 3/3a), you can upload your own profile picture in your profile. It is stored on our own object storage (MinIO/S3) in Germany, resized server-side, and stripped of metadata (including location data). The legal basis is performance of a contract (Art. 6(1)(b) GDPR). Your profile picture is shown to you wherever you are signed in, and to people with whom an existing relationship already exists (your current opponent in a shared game, your direct-message contacts, people you have already played against). On the leaderboard, your profile picture is only shown if you have given a separate, freely revocable consent in addition to general leaderboard participation. On public pages accessible without sign-in (public profile, shared game/list links), your profile picture is not shown. If you delete or replace your profile picture, the previously stored image file is removed from our object storage. Please only upload images to which you hold the necessary rights (see Terms of Use).
6. Email delivery
For transactional emails (e.g. confirmation of your email address at registration, password reset, notifications and summaries you have activated) we use the service provider Resend (Resend Inc., USA) as a processor. Your email address is transmitted to Resend; a data transfer to the USA takes place (safeguarded via standard contractual clauses/DPF). Legal basis: performance of a contract or legitimate interest (Art. 6 (1) (b) / (f) GDPR). A data processing agreement (Art. 28 GDPR) is in place with Resend.
7. Protection against abuse (rate limiting)
To defend against brute-force and abuse attempts (e.g. at sign-in and registration) we process your IP address as a technical counter. Your IP address is not stored in clear text: it is converted into a non-reversible check value using a secret key, and only that check value is stored, together with a counter and an expiry time. Once the respective time window has elapsed, these entries are deleted automatically. The legal basis is our legitimate interest in IT security (Art. 6 (1) (f) GDPR).
8. Feedback
If you send feedback, we process your message and accompanying technical data (page accessed, browser identifier/user agent) for processing and product improvement (Art. 6 (1) (f) GDPR).
9. Retention period
We store personal data only as long as necessary for the stated purposes or as long as your account exists. If your account is deactivated (blocked), your identifying data is retained for a short window of up to 30 days so that an accidental deactivation can be reversed and any abuse can be traced; after this window the identifying data is automatically anonymised, with only non-personal, aggregate figures (e.g. the number of departures per day) being retained. If you request the permanent erasure of your account (Art. 17 GDPR), your personal data is erased without undue delay and any email snapshots in the internal administration logs are redacted in the same operation. To request erasure, simply contact us at the address stated in the imprint. We will confirm receipt and carry out the erasure within the statutory period under Art. 12(3) GDPR. We do not currently offer a self-service deletion function in the account settings. Independently of this, the email snapshots in the administration log are replaced by a non-reversible placeholder after at most 12 months. Rate-limiting entries are deleted automatically once the time window has elapsed. An uploaded profile picture is also removed as a file from our object storage when replaced, deleted, or as part of the automated anonymisation/erasure described above, not just as a database reference. Statutory retention obligations, where applicable, remain unaffected. Confirmation links for email verification expire after 24 hours and are deleted thereafter; accounts that have not been confirmed are deleted automatically no later than 30 days after registration (see section 3c). The record relating to the Terms of Use and the age confirmation is deleted together with your account (see section 3d).
10. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17 – “right to be forgotten”), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise your rights, a message to [email protected] suffices. You also have the right to lodge a complaint with a data protection supervisory authority.
11. No automated decision-making
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place. In particular, the playful achievement and rank system (gamification) does not constitute such a decision: rank and titles are a purely additive evaluation of your own game progress, have no legal effect and do not significantly affect you.
12. Administrative access & logging
To operate the service, manage users and prevent abuse, an administrator of this private fan project may access your account data. Specifically, an administrator may: (a) view your account data (display name, email address, profile picture or the profile-image URL provided by your sign-in service, sign-in method/provider, verification status and aggregate usage figures such as your number of lists, games and collection items); (b) change your role/permission; (c) send you a password-reset link by email (via the processor Resend, see section 6 “Email delivery”); and (d) deactivate your account (reversible block), permanently erase it, or undo a deactivation. To produce internal statistics (e.g. the number of new/active/departed accounts, the distribution of sign-in methods) we evaluate individual account attributes (registration date, sign-in method, verification status, deactivation timestamp); however, only non-personal daily totals are stored from this, not personal individual records. Plain viewing is not logged. The modifying administrative actions above are recorded in an internal, admin-only log containing the action type, a timestamp and a snapshot of the email addresses involved (acting administrator and affected account). This log serves IT security and accountability. It contains no passwords and no security tokens. The legal basis is our legitimate interest in secure, abuse-free operation and account security (Art. 6 (1) (f) GDPR); for the admin-triggered password reset, performance of a contract (Art. 6 (1) (b) GDPR) applies as a secondary basis.