Privacy policy

Last updated: 23 October 2026

Who is responsible

For anything about your data, write to privacy@storegga.org.

Visiting this site

When you open a page, your browser sends its IP address, the address of the page, the time and a description of the browser, as it does with every website. We use this only to deliver the page. Neither our web server nor the proxy in front of it writes access logs.

Without your consent this site sets no cookies and loads nothing from other companies: pictures, fonts and scripts come from storegga.org and stats.storegga.org.

Visitor count without cookies

We count visits with Umami, which runs on our own server at stats.storegga.org. It sets no cookies and stores no IP address; it records a visit under a pseudonymous code that does not contain your IP address. We see which pages are viewed, the site you came from, your country, region and city (looked up from the IP address, which is then discarded), browser, operating system and type of device, and clicks on buttons such as the wishlist or the sign-up. If your browser sends “Do Not Track”, nothing is counted. We use this to see how STOREGGA is received. The legal basis is our legitimate interest in that (Art. 6(1)(f) GDPR).

Google Analytics and Google Ads, only with your consent

On your first visit a banner asks whether we may use Google’s services. Only if you choose “Accept all” or “Statistics only” does your browser load Google Tag Manager, which then loads Google Analytics (statistics) and, with “Accept all”, Google’s advertising tags (to measure which ads work). Google then sets cookies and processes your IP address and data about your device and visit, and may transfer them to the United States; Google is certified under the EU-U.S. Data Privacy Framework. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The legal basis is your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). You can change or withdraw it at any time under “Privacy settings” at the bottom of the page; when you withdraw it, we delete Google’s cookies from your browser. Your choice itself is kept in your browser’s local storage, because without it we could not respect it.

Signing up for the playtest or the newsletter

If you enter your e-mail address in one of the forms, we store:

• your e-mail address,
• which list you chose (playtest or newsletter),
• which version of the consent text you agreed to,
• when you signed up and when you confirmed.

We then send you one e-mail with a link. Only when you click it and confirm are you on the list (double opt-in). If you do not confirm within 7 days, we delete the address. To limit how many sign-ups one connection can send, the server keeps your IP address in memory for at most an hour; it is never written to disk.

We use your address only for the list you chose: to tell you when the playtest opens, or to send the newsletter. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every e-mail or by writing to privacy@storegga.org; we then delete your address.

Taking part in the playtest

When your playtest wave opens, we create a tester access for you: a tester name made up by our server, never taken from your e-mail address, and a tester token. With your sign-up we store the tester name; with the access we store a one-way hash of the token (never the token itself), when it was issued, when it was last used, and whether it was revoked. We send the token by e-mail. If you sign up again, we send a new token, and the old one stops working once you use the new one.

If we have to end someone’s access for abuse, we keep a keyed one-way hash of that inbox, so it cannot simply sign up again; the address itself is not kept. The legal basis is our legitimate interest in a fair playtest (Art. 6(1)(f) GDPR).

While you play, the game sends our server (Storegga Command, on the Hetzner server named below):

• for each match in the list: the host’s tester name, the match settings and the host’s Steam ID, which other players need to join;
• at the end of each match, for every player: the Steam ID, side, kills, deaths, shots and kills per weapon, best streak, time played and whether they survived;
• a player profile per Steam ID with league, saved loadouts and match statistics;
• once a minute while the game runs: Steam ID and Steam name, whether you are in the menu or a match, ping, average frame rate, graphics settings and resolution, graphics card, Windows version and how long the game has been running;
• feedback you send from the game, with your Steam ID and name, the build, and our replies.

We use this only to run the playtest and to balance and fix the game. The legal basis is the playtest you asked to join (Art. 6(1)(b) GDPR) and our legitimate interest in a game that works (Art. 6(1)(f) GDPR). The server checks your IP address only to limit request rates and does not store it. Unsubscribing from the playtest list ends your tester access and removes your e-mail address from it. To have your playtest data deleted, write to privacy@storegga.org.

Our Discord server

Our pages link to the STOREGGA server on Discord (discord.com), a separate service. The link itself loads nothing from Discord. Only when you follow it and join the server does Discord process your data, under its own privacy policy and terms.

On the server we see what members see: your username, your profile picture and what you post there. We can remove posts or members that break the server’s rules. Once the server is large enough, Discord also shows us summarised statistics about it. We use this to run the community and to see how STOREGGA is received; the legal basis is our legitimate interest in that (Art. 6(1)(f) GDPR). Questions about this go to privacy@storegga.org.

Who processes the data for us

• Hosting: the site, the visitor count and the sign-up run on a server of Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany, in a data centre in Finland.
• E-mail: our e-mails go out through Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google may process data in the United States; it is certified under the EU-U.S. Data Privacy Framework.
• Analytics and advertising: Google, as described above, and only with your consent.

We do not sell or share your data with anyone else.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to object to it, and to receive it in a portable format. Write to privacy@storegga.org. You can also complain to a data protection supervisory authority, for example the one where you live.