Only the German version is legally binding.
This notice supplements the Privacy Policy with the user account and the server rental. Visiting the website, the game and the official servers are covered by that policy.
1. Controller
Patrick Hackl, HACKLWORKS, Vogelkammweg 3, 94518 Spiegelau, Deutschland, e-mail: info [at] hacklworks [dot] de.
2. User account
- E-mail sign-up: e-mail address, display name, password. We store the password only as an Argon2id hash; we cannot read it. You confirm the address via a link (valid for 48 hours); unconfirmed sign-ups are deleted after 7 days.
- Protection against automated sign-ups: we check sign-up and sign-in forms for automated input; after several attempts your browser has to solve a small computing task. No data is sent to third parties.
- Password check: when you set a password we check it against known breaches using the “Have I Been Pwned” service (Troy Hunt, delivered via Cloudflare, Inc., USA) with the k-anonymity method: only the first 5 characters of the SHA-1 hash are sent – neither the password nor your e-mail address. The request is made by our server, not your browser. Legal basis Art. 6(1)(f) GDPR (protecting your account).
- Steam sign-in (OpenID 2.0): you are redirected to Valve Corporation, 10400 NE 4th St, Bellevue, WA 98004, USA (steamcommunity.com). Valve only tells us your public SteamID64; we never receive your password. Optionally we fetch your public persona name and avatar via the Steam Web API. According to Valve, it is certified under the EU-US Data Privacy Framework.
- PESTBOUND ID: the ID derived from the game's public key (of-…) and that public key, proven by a signature from the game.
- Two-factor sign-in (optional): an encrypted TOTP secret and hashed recovery codes.
- Sessions and security: per sign-in the time, sign-in method, user agent and IP address – shown under Account › Security so you can recognise and end unknown sign-ins. Failed sign-ins are counted to lock accounts briefly after several attempts. IP addresses in the audit log are removed after 30 days.
Legal basis: Art. 6(1)(b) GDPR (account contract) and (f) (security, abuse prevention).
3. E-mails
We only send e-mails required for your account or contract (confirmation, password reset, security notices, deletion confirmation, required notices about your contract) – no marketing. They are sent through an e-mail service provider acting as our processor under Art. 28 GDPR. Send log (recipient, template, time) 30 days; the content (with one-time links) is deleted after sending.
4. Orders, billing, server operation
- Order: plan, region, server name, subscription status, consents (time, version, wording hash, IP address, user agent) as proof under Sections 356(4), 357a(2) BGB – Art. 6(1)(b) and (c) GDPR.
- Payment by Stripe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, receives name, e-mail, billing address, payment data and the order and is partly an independent controller for them (payment services law, fraud prevention). A transfer to Stripe, Inc. (USA) is possible; Stripe bases it on the EU-US Data Privacy Framework and standard contractual clauses. We never store card data. Stripe issues invoices on our behalf.
- Server operation: settings, admin and whitelist IDs, server logs, save backups, RCon commands with time and IP address (audit log). Your server also processes the player data described in the Privacy Policy (including chat in the server log) – Art. 6(1)(b) and (f) GDPR.
- Server list: your server's name, description, rules, Discord link, banner address, player count and address are visible in the game's public server list.
5. Hosting and regions
The website, account database and control plane run at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data centre in Germany). Rented servers run in the chosen region: “Germany” at Hetzner (Nuremberg) or OVH GmbH, Christophstr. 19, 50670 Cologne; “Finland” at Hetzner (Helsinki); “US East” and “US West” at Hetzner in the USA (Ashburn, Hillsboro) or at OVH US LLC (Virginia, Oregon). If you choose a region in the USA, the server's data – including the data of the players on it – is stored and processed in the USA, based on the providers' data processing agreements with standard contractual clauses (Art. 46(2)(c) GDPR). Data processing agreements under Art. 28 GDPR are in place with all providers.
6. Retention
- Account data until the account is deleted (Account › Privacy; carried out 14 days after the request, not before the last paid period ends).
- Invoices and accounting records up to 10 years (German tax and commercial law) – at Stripe; order data and proof of consent until the limitation period ends (usually 3 years from the end of the year in which the contract ended).
- Backups of deleted servers 30 days; sessions at most 30 days; IP addresses in the audit log 30 days; server log files at most 14 days.
7. Your rights
Access (Art. 15 GDPR) – as a file under Account › Privacy › “Download your data” (also Art. 20), rectification (16), erasure (17) – under Account › Privacy, restriction (18), objection to processing based on legitimate interests (21), withdrawal of consent (7(3)), complaint to a supervisory authority (77), e.g. the Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach, Germany. Requests to info [at] hacklworks [dot] de.
8. Cookies and local storage
The account, sign-in, order and administration area only uses technically necessary cookies (Section 25(2) no. 2 TDDDG, no consent required). There is no tracking there; analytics and advertising services are not loaded in this area.
| Name | Purpose | Lifetime |
|---|---|---|
| __Host-pb_sid | Sign-in session | 30 days |
| __Host-pb_bind | CSRF protection, binding the Steam/ID sign-in to this browser | 1 day |
| __Host-pb_mfa | Second sign-in step (2FA) | 5 minutes |
| __Host-pb_next | Return address after Steam sign-in | 15 minutes |
Your choice in the cookie settings is kept by the website as “pb_consent” in your browser's local storage (as a cookie only if local storage is blocked), with time and version, for 12 months. Stripe sets its own fraud-prevention cookies on checkout.stripe.com.
9. Reach measurement
Google Tag Manager and Google Analytics only run after your consent and only on the website's public pages, never in the account, sign-in, order and administration area. Details: Privacy Policy, section 4.