EmberwakeRPG
DE

Privacy Policy

This is a courtesy translation. The German version at Datenschutzerklärung is authoritative.

1. Controller

Controller within the meaning of the EU General Data Protection Regulation (GDPR):

Emberwake — Luis Philip Kosok
c/o Online-Impressum 10742
Europaring 90
53757 Sankt Augustin
Germany
Email: service@emberwakerpg.com
Contact form: emberwakerpg.com/contact

2. The essentials first

This website is deliberately designed to be data-minimal:

The following sections explain exactly which data is processed for these purposes.

3. Hosting

The website, database, email service, domain and Minecraft server are hosted by MC-HOST24.de, a label of Gericke KG, Mühlenstr. 8a, 14167 Berlin, Germany. The provider processes the data required to operate these services under the hosting agreement.

Processing on our behalf: The requested confirmation from MC-HOST24 regarding a data processing agreement for webspace, database, email and game server services, processing locations and subprocessors has not yet been received (as of 13 September 2026). These details remain unconfirmed and will be updated when the response arrives.

Server log files: When you access the website, the host processes technically necessary data that your browser transmits automatically: the IP address, date and time of access, the requested resource and the browser identifier (user agent). This processing is necessary to provide the website and ensure its stability and security.

Storage period for server logs: The actual retention and deletion rules, log fields and operator access for our plan have not yet been confirmed by the host. We cannot currently specify a provider retention period.

PHP error log: The application records technical errors server-side in a non-public PHP error log. Depending on the error, it may contain the time, the affected function and brief technical context; passwords and complete secrets are not intended to be logged. Storage period: Rotation and deletion periods for the production PHP error log have not yet been conclusively confirmed. The requested information will be added once it is received.

Email and delivery logs: Messages are sent using PHP's local mail function and the host's email service. Mail server logs may process sender and recipient addresses, time, subject or message identifier and delivery status. Storage period: The provider has not yet confirmed retention and deletion rules for technical email, delivery and backup data. The specific retention period for automatic operator notifications is also not yet fully documented.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the secure and efficient provision of this website, troubleshooting and reliable delivery of operational messages).

4. Invitation, user account and sign-in

Invitation request: The public form can be used to request access to the private alpha. A name or pseudonym and a reachable email address are required; Minecraft name and free-text message are optional. We store the request, time of receipt, processing status, deciding administrator and mail-delivery status. The operator's private notification address receives only the request number and a link to the protected admin area, not the form contents. An administrator can approve the request and send a single-use invitation or reject it; the decision is communicated by email. The legal basis is Art. 6 (1) (b) GDPR where the request concerns the requested participation and Art. 6 (1) (f) GDPR (orderly and abuse-resistant access procedure). No automated decision is made.

New accounts are created only through a personally issued, time-limited invitation link. Invited persons then enter their account details themselves. For each invitation, we store the hashed token, intended role, an optional recipient email address entered in advance, internal note, creator, expiry time and redemption. The plaintext token is not stored. The account email address is a required field when the invitation is redeemed.

For each account, we store:

A username, email address and password are required for the requested account; the invitation cannot be redeemed without them. The display name is optional. Minecraft and Discord details are required only for the respective game-server or community link that the user expressly chooses. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

If an invitation is sent by email, the mail service processes the recipient address, single-use invitation link and inviter's name. After successful redemption, the application automatically sends an operator notification containing the username, display name, role, inviter and time to the configured operator mailbox. The periods for mail logs and this notification are marked in section 3 as details that still need to be confirmed.

Legal basis: Art. 6 (1) (b) GDPR (provision of the requested access and sending the invitation) or Art. 6 (1) (f) GDPR (legitimate interest in secure operation and administrative awareness of newly redeemed invitations).

Erasure: When an account is deleted, the account data, pending Minecraft linking codes, OAuth states and the most recent game state stored on the website are removed. Account-related throttling counters and local skin/avatar cache files are also deleted; the email and note in the redeemed invitation are cleared and names in historical invitations are anonymised. Time-limited security logs remain until their retention period expires.

5. Session cookie and browser storage

Normal content pages, downloads and the world map are delivered without starting a session or setting a cookie. Exactly one cookie is set only when the sign-in page, a personal invitation link or protected account functions are accessed. In production it is named __Host-ew_session and contains only a random session identifier — no profile or other content. The map proxy does not pass through cookies from BlueMap.

BlueMap 5.23 is configured with useCookies=false. In this version, that also prevents the map web app from reading or saving user preferences in Local Storage. The current map position appears only in the fragment of the browser address (the part after #); that fragment is not transmitted to the server in HTTP requests.

The cookie is strictly necessary for the sign-in, invitation and account functions expressly accessed and is therefore permitted without consent under Section 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). The related processing of personal data is based on Art. 6 (1) (b) GDPR (providing the requested function) and Art. 6 (1) (f) GDPR (secure operation and prevention of abuse).

No analytics or marketing technology requiring consent is used. For this reason, no cookie-consent banner is displayed. The abuse protection used exclusively on form pages deliberately opened by the visitor is treated as technically necessary for that function and is explained separately in section 12. The website also does not automatically register a service worker or place data in CacheStorage. General browser caching functions are unaffected.

6. Security log

For security-relevant and administrative events in the members-only area — in particular sign-in and sessions, invitations, account, role and security settings, Minecraft links, bug reports and administrative actions — we store a log entry containing the time, event type, username and truncated IP address. Depending on the event, a brief context value may also be recorded, such as the affected target account, Minecraft name, ticket identifier, invitation email, block reason or technical error status. Passwords, two-factor secrets, complete invitation or linking tokens, bug-report contents and browser identifiers are not stored in the application's security log.

The IP address is truncated before it is stored: for IPv4 the last octet is set to 0, and for IPv6 the last 80 bits are removed. The full IP address is not stored in the application's security log; the host's access logs described in section 3 are separate.

Separately, the application uses lockout and quota counters to limit repeated sign-in attempts and automated abuse. An IP address or username is processed only briefly for this purpose and stored as a deterministic one-way verification value; for IPv6, only the /64 network is used first, not the changing device portion. This allows repeated inputs to be assigned to the same counter without storing the plaintext IP address in that counter. These values are pseudonymous, not anonymous, data. Database-backed counters are removed by the daily maintenance run after the relevant window or lockout has expired. File counters used only for the public forms stop being considered after the one-hour window. Later form requests trigger a cleanup run no more than once per hour; that run removes files whose last change was at least two hours ago. If there is no later form request, the technically unused HMAC file remains until a later cleanup run.

Purpose and legal basis: protecting accounts and the service, preventing misuse, diagnosing technical errors and ensuring administrative traceability — Art. 6 (1) (f) GDPR (legitimate interest in secure and accountable operation of the protected area).

Storage period of the security log: After 90 days, entries are removed by the next daily deletion run, normally within a further 24 hours. A daily scheduled server task runs this deletion; the first database access on each new UTC day is an additional fallback.

7. Minecraft account, game server and Mojang/Microsoft

When a Minecraft name is registered or changed, our server queries Mojang's public name API at api.mojang.com. The Minecraft name entered is transmitted; the corresponding UUID and the spelling held by Mojang are returned. The provider is Microsoft/Mojang. The request is made server-side only after your input, so Mojang receives neither your website session nor your email address.

We store the Minecraft name, UUID and the times of the linking claim and confirmation. The game server receives the resulting authorisation and suspension information. After confirmation in the game, it regularly transmits only the current game state for linked accounts. This may include, in particular, levels, skills, playtime, class, RPG XP, balance, reputation, quests, plots, combat and movement statistics, world, title, dragon, attributes and equipped items. Only the most recent report is stored; no historical progression is retained.

For displaying the skin after a link has been confirmed, the website retrieves profile and texture information exclusively server-side from sessionserver.mojang.com and textures.minecraft.net and stores a local cached copy. The current copy is reused for no more than 24 hours without a fresh check; obsolete variants are removed on the next retrieval and all variants when the account is deleted. If server-side retrieval fails, a local placeholder or error response is used; there is no direct browser fallback to Microsoft/Mojang. Microsoft/Mojang therefore receives the server IP and the Minecraft profile or texture data requested, but not the browser IP, website cookie or email address. Equipment types come from the most recent game-state report and are displayed in the browser using our own solid-colour materials; no extracted Minecraft armour textures are delivered for that purpose.

Where Microsoft acts as controller for these services, Microsoft names Microsoft Ireland Operations Limited for individuals in the European Economic Area. Processing may also take place outside the EEA, in particular in the USA. According to Microsoft's privacy information, Microsoft Corporation is certified for transfers covered by the EU-US Data Privacy Framework; for other international transfers Microsoft refers in particular to the European Commission's Standard Contractual Clauses. The safeguard that applies depends on the actual Microsoft recipient and processing route.

Purpose and legal basis: enabling and operating the game account and displaying the user's own profile — Art. 6 (1) (b) GDPR; protection against incorrect assignments and misuse — Art. 6 (1) (f) GDPR.

Further information: Microsoft Privacy Statement.

8. Optional Discord link

If you choose “Connect with Discord”, you are redirected to Discord. The OAuth permissions identify and guilds.join are requested. After successful authorisation, we store the Discord ID, Discord username and the time the link was created. We also use the Discord API to join the user to the Emberwake Discord server and to display membership status. The OAuth code and access token are processed only during this operation and are not stored by us on a permanent basis.

Linking is voluntary and can be disconnected independently at any time in the account settings without deleting the website account; this removes the Discord link stored by us. This does not automatically leave the Discord server or revoke an app authorisation held by Discord; those must be managed with Discord itself. The provider for users in the European Economic Area is Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, the Netherlands; data may also be processed in the USA. Depending on the transfer route, Discord's privacy policy describes adequacy decisions including the EU-US Data Privacy Framework, Standard Contractual Clauses or other lawful safeguards. Processing to perform the requested link is based on Art. 6 (1) (b) GDPR; checking and displaying membership status and preventing abusive links are additionally based on Art. 6 (1) (f) GDPR.

Further information: Discord Privacy Policy.

9. Bug reports to GitHub

The members-only area provides a “Report a bug” form. When you submit it, the title, error description, expected behaviour, reproduction steps, selected server and severity are transmitted to GitHub, where they become a ticket in the project's bug tracker. The website username is not added to the issue. The website cookie and browser IP address are not forwarded to GitHub; the API request comes from our server.

The provider is GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (“GitHub”) — a subsidiary of Microsoft Corporation. This entails a transfer to the USA. GitHub states that it participates in the EU-US Data Privacy Framework. For international transfers not based on an adequacy decision, GitHub refers in particular to the European Commission's Standard Contractual Clauses. The safeguard that applies in an individual case depends on the actual GitHub processing route.

The transfer takes place only if you actively submit the form. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in receiving, tracking and resolving voluntarily submitted bug reports).

Please note: The issue repository used is public. The title and report content are therefore visible worldwide. They generally remain public even after the issue has been closed, until it is deleted or the repository's visibility changes; copies made by third parties may persist. Do not enter confidential data or personal data relating to third parties. If you subsequently follow a link to the issue, your browser communicates directly with GitHub.

For more information, see GitHub's privacy statement: GitHub General Privacy Statement.

10. BlueMap world map

The world map is generated by BlueMap on the Minecraft server operated by us and made publicly available through a same-origin proxy under our website address. It contains rendered world and building data as well as markers for plots, villages, marketplaces, warehouses, special buildings and market stalls. Plot markers may contain the owner's Minecraft or family name and the coordinates of the property; market-stall markers may name the trader's Minecraft account.

Players are not displayed: The transmission of live player positions and the player list is disabled on the server. BlueMap is configured not to store user preferences in the browser, and the proxy does not pass through origin cookies. Changes to the world are detected continuously; in addition, the system checks for missed changes at least every five minutes. Markers generated from game data are also synchronised every five minutes.

The technical raw BlueMap origin is blocked from direct public access. The browser communicates only with our website; the proxy does not forward the browser IP, cookie or authorisation data to BlueMap and does not pass through cookies from the BlueMap origin. The raw origin sees only the connection from our server. Because the map is offered publicly, its content and markers are nevertheless publicly visible game data. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in providing a clear world map for the gaming community).

11. Anonymous request statistics

For successful GET responses, the application increments only a daily counter from a fixed allowlist: page category or download package, UTC calendar day and count. It stores no IP address, visitor identifier, session, cookie, browser identifier, referrer, query parameter or freely supplied URL. Different spellings of the same page are combined. HEAD, 304 and failed responses are not counted. These values measure origin-server requests, not unique people; bots, reloads and aborted downloads may be included.

The counters help us understand which content and downloads are actually used and are removed by the next daily deletion run after 400 days, normally within a further 24 hours. Because the application neither accesses information on the user's device nor stores personal data for these statistics, it creates no visitor profile and requires no analytics cookie. The technically necessary host logs in section 3 are separate.

12. Contact, post, public forms and Cloudflare Turnstile

Email and contact form: If you contact us by email or through the public form, we process an optional name, email address, subject and message in order to handle and answer the enquiry. The form forwards the message through the host's mail service to service@emberwakerpg.com; it stores no additional content copy in the application database. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in accessible communication) or Art. 6 (1) (b) GDPR where the enquiry concerns a requested service or participation.

Invitation request: Its scope, decision process and legal bases are described in section 4. Separate quota counters limit external CAPTCHA validation to 20 attempts per form and hour, and successful submissions to five contact messages or three invitation requests per form and hour. For this purpose the IP address is processed only briefly and stored as a separate deterministic one-way verification value for each form and counter purpose; for IPv6, only the /64 network is taken into account, as described in section 6.

CAPTCHA: Both public forms use Cloudflare Turnstile, a service of Cloudflare, Inc., USA, and affiliated companies. The Turnstile script is not loaded on the rest of the website; it is loaded only on the form page that the visitor deliberately opens. Cloudflare may process in particular the IP address, user agent, TLS/browser characteristics, website and widget identifiers, origin, interaction and timing data to detect automated access. We do not use pre-clearance, an optional visitor identifier or cData, and we do not send the IP address a second time during subsequent server-side token validation. The short-lived token is checked server-side for success, expected hostname and the separate form action.

We use Turnstile solely to protect the specifically requested form function from spam and automated abuse and rely on Section 25 (2) no. 2 TDDDG for the necessary device access. The subsequent personal-data processing is based on Art. 6 (1) (f) GDPR (legitimate interest in functional and secure contact channels). Under its terms, Cloudflare may use certain signals under its own responsibility for Turnstile security and improvement. Processing may take place in the United States; Cloudflare refers in particular to the EU-US Data Privacy Framework and, additionally, Standard Contractual Clauses. Before production use, the current data-processing agreement must be accepted in the Cloudflare account and retained for documentation. Further information: Turnstile Privacy Addendum, Cloudflare Customer DPA, Cloudflare Privacy Policy.

External links, including Instagram, YouTube, GitHub, Modrinth and Fabric: We do not embed plug-ins, videos, tracking pixels or externally loaded profile images from these platforms. Merely loading our page therefore creates no connection to them. Only after you select a labelled external link does your browser open the platform; its respective provider is responsible for processing there.

Post sent to the c/o address: Online-Impressum.de / Clear-Media UG is commissioned under the subscribed postal service to receive, digitise and make the mail available. Sender data and letter contents are processed in the course of this. The purposes and legal bases above apply to our subsequent handling; Art. 6 (1) (c) GDPR may additionally apply to correspondence required by law. Details and periods follow from the subscribed service and the Online-Impressum.de privacy policy.

The contractual role, any required data processing agreement and the specific recipients, processing locations and retention rules of the subscribed postal service have not yet been confirmed in our documentation.

13. Storage periods

14. Your rights

As a data subject, you have in particular the following rights:

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority at your habitual place of residence.

15. Changes to this policy

We will update this privacy policy whenever the functionality of the website changes, for example when new services are introduced. The version published here applies.

Last updated: 3 September 2026

← Back to home