Privacy notice
1. Who is responsible
The controller under the GDPR is Michael König-Weichhardt, Sporgasse 24, 8010 Graz, Austria, email hello@orvaldar.com. More in the imprint.
2. In short
I use no advertising or analytics. I process data to deliver the website, run the prototype, receive feedback and manage optional support. Language and supporter-access cookies serve the features you request; they are not tracking cookies.
3. Visiting this website
The website is delivered by Cloudflare, Inc. (USA) on my behalf as my processor. When you open a page, Cloudflare's servers receive and process technical connection data: your IP address, the time, the address you asked for, your browser's user-agent, the referring page and the response status. I use this to deliver the website, keep it secure and stop abuse, for example by limiting repeated requests. The legal basis is my legitimate interest in a fast and secure website (Art. 6(1)(f) GDPR). I do not use these data to identify you and do not combine them with other data. Cloudflare may process data in the USA; this relies on the EU-US Data Privacy Framework and standard contractual clauses. You can get a copy of these safeguards by writing to the email address in the imprint. I keep no access logs of my own; Cloudflare keeps the connection data only as long as it needs them to deliver the website and keep it secure, as set out in its terms for processors. Your browser sends these data automatically: without them I cannot deliver the website to you. More: Cloudflare's privacy information at www.cloudflare.com.
When you open the home page, the server reads the language your browser prefers (the Accept-Language header) once, to send you to a supported language version. This is not stored.
4. The test build
The browser test build runs on its own address (play.orvaldar.com) and is delivered by Cloudflare in the same way as described above. The game runs entirely in your browser and sends no gameplay data to me. It may keep settings or saved games in your browser's local storage on your device. This storage is needed for the function you asked for, stays on your device and can be deleted in your browser settings.
5. The feedback form
If you send feedback I process what you type: your message, the type and device you picked, the language of the page, the build number and the time. I do not ask for your name or email address and I do not store your IP address with the message. To protect the form from abuse Cloudflare briefly uses your IP address to limit how often it can be sent.
My server code turns your message into a note (an issue) in my private project tracker at GitHub, Inc. (USA), which acts as my processor. My project workflow reads and sorts the notes with the help of an automated text-processing service from Anthropic in the USA. Anthropic receives the text of the note (never an IP address, which I do not store) and is a recipient of it, not my processor. Please do not write personal data into the message. Sending feedback is voluntary; without a message I cannot receive any. I make no decision about you that rests solely on automated processing and has legal or similarly significant effects (Art. 22 GDPR); the automated service only helps sort feedback notes. The legal basis is my legitimate interest in receiving and evaluating feedback to improve the game (Art. 6(1)(f) GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework and standard contractual clauses; you can get a copy of the safeguards from the email address in the imprint.
I keep a feedback note as long as it is useful for developing the game. Because I do not store who you are, I can only find a message by its text: to have one deleted, send me its text using the email address in the imprint.
6. Cookies and similar technologies
Choosing a language stores lang for one year. Starting or recovering a supporter profile stores __Host-orvaldar_support for one year to protect access to that profile. A new payment return may set __Host-orvaldar_receipt for 15 minutes to establish access once. These access cookies contain random values, not your name, email or payment amount, and are Secure, HttpOnly and SameSite=Lax. They are used for the service you request (§165(3) TKG 2021). You can delete them in browser settings; keep your recovery code if you want access from another browser.
7. Your rights
Under the GDPR you can ask me for access to your data, rectification, erasure, restriction of processing and data portability, (Art. 15 to 20 GDPR). Write to the email address in the imprint. If you think I process your data unlawfully you can complain to the Austrian data protection authority (Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at) or to the authority in your country.
Right to object (Art. 21 GDPR): you have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data that rests on my legitimate interests (Art. 6(1)(f) GDPR), that is, the delivery and security of the website and the evaluation of feedback. Send your objection to the email address in the imprint. I then stop the processing unless I can show compelling legitimate grounds for it.
8. Changes
I update this notice when the website or its features change. The date of the last update is shown at the top.
9. Optional support payments
You visit Stripe’s separate payment page only when you choose to support me. This website loads no Stripe resource. Stripe Payments Europe, Limited (Ireland) processes payment, contact and connection data for me; Stripe also acts as a controller for fraud prevention and its legal duties. I receive the amount, date, status, reference and contact details provided, but no full card number or security code. I use them to handle the contribution and any refund (Art. 6(1)(b) GDPR) and meet accounting duties (Art. 6(1)(c)); accounting records are kept for seven years, longer if legally required. I do not add supporters to marketing lists. Stripe may process data outside the EEA, including in the USA, using the safeguards in its privacy policy and Privacy Center.
10. Your supporter profile and public name
My private registry stores random profile identifiers, protected access keys, minimal payment references and status, confirmed EUR totals after refunds, recognition level, allocation and timestamps. It uses a keyed fingerprint of the checkout email to combine repeat payments; the raw email is discarded from this registry. Cloudflare processes these records for me. I do not store card details, legal names or IP addresses in the registry.
Publishing a nickname is optional and requires your consent (Art.6(1)(a) GDPR). The public registry exposes the chosen name, recognition level, opaque profile/allocation identifiers, revision and eventual world placement. It never exposes your email, amount or payment references. You can withdraw consent through your profile or the contact in section 1; I erase the stored nickname and publish a withdrawal marker. Withdrawal does not affect earlier lawful processing. I cannot recall screenshots or copies already saved by others.
Temporary access and form tokens expire; expired records are cleaned up daily. Funded profiles and allocation records remain as needed to administer recognition. Financial records follow the accounting retention stated in section 9, including longer statutory requirements. Removing a public name does not automatically erase records I must retain. I use no supporter data for marketing.
For a requested sign-in email, I use the address you enter to deliver a one-use link through my transactional mail provider. It is not stored in the supporter database. Only protected token and browser hashes are stored for 15 minutes; expired entries are removed daily. Two necessary random access cookies, __Host-orvaldar_login_browser and __Host-orvaldar_login_token, last 15 minutes. The link works in the browser where it was requested and requires confirmation. Address fingerprints used to limit requests are removed after one day by daily cleanup. Mail providers process the recipient and message for delivery; I send no marketing emails. Your account total and website milestones remain private.