Privacy policy

1. Controller

Andre Semek
Zossener Straße 31
10961 Berlin
Deutschland
Email: hello@semek.org

2. General

I process personal data only as far as needed to run these pages and the game portal, and only on the basis of the GDPR.

3. Hosting (Cloudflare)

erdlabs.com and play.erdlabs.com run on Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; Cloudflare Workers, Cloudflare D1 database). When you visit, Cloudflare processes technically necessary connection data such as IP address, time, requested URL and browser identifier, among other things for delivery, security and error diagnosis. The legal basis is Art. 6 (1)(f) GDPR. Transfers to the USA rely on the EU-US Data Privacy Framework and standard contractual clauses.

4. Fonts and scripts

Fonts, scripts and images are served from the same server. There is no connection to Google Fonts, CDNs, advertising or analytics services.

5. Cookies and local storage

erdlabs.com sets no cookies and uses no local storage.

After you sign in, play.erdlabs.com sets a session cookie (__Host-erd_session). It is technically necessary to keep you signed in (§ 25 (2) no. 2 TDDDG), so no consent is required. The games may keep saves and settings in your browser's local storage. That data stays on your device.

6. Game account (play.erdlabs.com)

Playing in the browser needs an account. For that I store: the username, a salted hash of the password (PBKDF2), the time the account was created, and for each session the hash of the session key and its expiry. No email address is collected, so a forgotten password cannot be reset.

To protect against abuse, sign-in and registration attempts are counted briefly. The network range of the IP address is stored only as a salted hash, and the entries are deleted automatically.

The legal basis is Art. 6 (1)(b) GDPR (providing the account) and (f) (protection against abuse). Sessions expire after 30 days without use and after 90 days at the latest. You can delete your account yourself at any time under "Account"; user data and sessions are then removed. The username stays blocked for 30 days so that nobody else takes it over immediately.

7. Contact by email

If you write to me (hello@semek.org), I store your name, email address and message to answer it. The legal basis is Art. 6 (1)(b) or (f) GDPR. I delete the data once the purpose is fulfilled and no retention duties apply.

8. External links

These pages link to other sites, for example semek.org. When you click, you leave this site; the provider's own privacy terms apply there.

9. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). An email to hello@semek.org is enough.

10. Right to complain

You can complain to a data protection authority. The competent one is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61, 10555 Berlin
datenschutz-berlin.de