Privacy

1. Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer as we are not legally required to. For privacy questions, write to the address above.

2. Cookies and browser storage

This website sets no cookies and embeds no third-party services (no third-party analytics or advertising, no social media plugins, videos or maps); fonts and images come from our own server. In your browser’s local storage we keep:

• zr_consent – your choice in the privacy banner (version, yes/no, time). This is needed so we don’t ask again on every visit (§ 25(2) no. 2 TDDDG).
• zr_aid, zr_aid_at – only with your consent: a random analytics ID and when it was created (§ 25(1) TDDDG, see section 3).

You can delete these entries at any time in your browser settings.

3. Usage analytics – only with your consent

On your first visit a banner asks whether we may analyse how the website is used. “Decline” and “Accept” are equal; the website works the same either way. Only if you agree do we send the following to our game server (play.zoralen.com) together with your analytics ID:

• Visit: page viewed, duration, maximum scroll depth, sections seen, browser language, time zone, whether it is your first visit;
• Device: device type (desktop/tablet/mobile), browser identifier (user agent), screen and window size, pixel density;
• Origin: the page you came from (without query parameters), campaign data from the link (utm_source, utm_medium, utm_campaign);
• Interaction: clicks on buttons and links (e.g. Steam, Play, Pricing, gallery) and the number of shards shot in the header;
• your consent itself (time and banner version) as proof.

Purpose: understanding how visitors find us, what interests them and what makes them play, and improving the website accordingly. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Recipients: nobody but us – the data stays on our server and is not passed to analytics or advertising services. The game server is hosted by Hetzner in Germany (section 4). Retention: 13 months, then deleted automatically. If you are under 16, you may only agree with your parent’s or guardian’s consent (Art. 8 GDPR).

Withdrawal: at any time via “Privacy settings” in the footer. If you withdraw, we immediately delete all data linked to your analytics ID on the server and remove the ID from your browser. Processing before the withdrawal remains lawful.

4. Hosting and server logs

When you visit this website, your browser automatically sends data to our server, where it is briefly stored in log files: IP address, date and time, page or file requested and amount of data, HTTP status code, referrer (if sent), browser type and version, operating system.

Purpose: delivering the website, stability and security (e.g. fending off attacks). Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the secure and error-free operation of the website. Retention: log files are deleted after 14 days at the latest, unless needed longer to investigate a specific security incident.

The website is operated on a server in Germany. Where we use a hosting provider, it processes the data only on our behalf under a contract pursuant to Art. 28 GDPR.

Leaderboards: the home page and the speedrun page load the leaderboards (speedrun, weekly challenge, Rift, PvP) directly from our game server (play.zoralen.com). The game server receives the technically necessary connection data (IP address, time, list requested, browser identifier), as with any page request; nothing is stored in your browser for this. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in displaying the leaderboard). The leaderboards show what pilots have published in the game: pilot or group names, times, splits, scores, waves, depths, wins, dates and video links.

Host: the website and the game server (analytics data from section 3, leaderboards) run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes the connection data as our processor (Art. 28 GDPR).

All transfers are encrypted with TLS (“https://” in the address bar).

5. Contact by email or phone

If you contact us, we process your details (e.g. name, email address, message) to answer your request. Legal basis is Art. 6(1)(b) GDPR where the request relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering). We delete the data once the request is settled, unless statutory retention obligations apply.

6. Links to other services

Buying the web version: Purchases happen in the game, not on this website. Only when you start a purchase there does the game load the checkout of Paddle (Paddle.com Market Ltd, London, United Kingdom), which as Merchant of Record processes payment, invoicing and tax data under its own responsibility; see Paddle's privacy notice. Paddle sends us the purchase confirmation (transaction id, account id, product, refunds), which we store as proof of the unlock on your game account for as long as the account exists (Art. 6(1)(b) GDPR); invoices and tax records are kept by Paddle. The EU Commission has issued an adequacy decision for the United Kingdom.

This website links to the game at play.zoralen.com and to the Steam store of Valve Corporation (USA). Only when you click such a link do you leave our website, and the respective provider processes data under its own privacy policy. Nothing is sent to these providers before that. With Steam, data may be transferred to the USA; see Valve’s privacy policy.

Data processing in the game itself (game account, leaderboard, multiplayer) is described in the game’s privacy policy.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR)

Where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in your country of residence or work. Our competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de. UK users may also contact the Information Commissioner’s Office (ico.org.uk).

8. Other

You are not obliged to provide personal data; without the connection data that is transmitted technically, the website cannot be delivered. There is no automated decision-making within the meaning of Art. 22 GDPR. A transfer to countries outside the EU/EEA only happens if you follow a link to a provider there yourself (section 6). We do not sell or share personal information within the meaning of the California Consumer Privacy Act.

Last updated: October 2026