← Back to the game

Privacy policy

This is a translation for convenience. The German version is legally binding.

1. Controller

Jens Deckardt, Ohrdrufer Str. 14, 99331 Geratal OT Geraberg, Germany
Email: info@exominer.de

2. Summary

• No advertising, no trackers, no analytics tools, no profiling.
• No content from third-party servers (no external fonts, scripts or videos).
• No sharing of your data with third parties – except the hosting provider that runs the site technically.
• You play with an account or start as a guest. I only store what is technically necessary for this.

3. Hosting and server logs

The site is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. When you visit the site, the server processes technically necessary data (e.g. IP address, time, requested address, browser identifier) in order to deliver the site and protect it against attacks. The legal basis is my legitimate interest in a secure and working service (Art. 6 (1) (f) GDPR). The hosting provider processes this data on my behalf (Art. 28 GDPR).

Error and performance reports: If a program error occurs in the game, your browser sends a short technical report to the server: game version, error text and the location in the program code. Every 5 minutes of play it also sends a performance summary: frames per second, share of slow frames, server response time and a rough device class (touch or mouse, pixel density, window size rounded to 100 pixels). These reports contain no account name, email address or IP address and are not linked to your account; they only go into the server's error log. I use them solely to find errors and make the game run more smoothly. The legal basis is my legitimate interest in a working service (Art. 6 (1) (f) GDPR). To prevent anyone from flooding the server with reports, their number is counted per account or IP address for at most 24 hours (see section 8).

4. Storage in your browser

The game stores your user name (as a guest: a random guest identifier) in your browser's storage (localStorage) as a marker so that it knows you are signed in. If you played without an account in the past, an old game progress may also still be stored there. You can delete this data at any time by removing the site data for exominer.de in your browser.

5. Player account

To play, you create an account. Your progress is then stored on the server and is available on all your devices. I store:

• your user name,
• your email address and the time you confirmed it,
• your password – only as an irreversible hash (Argon2id), never in plain text,
• your game progress including in-game currencies,
• the times of creation and of the last save,
• technical check logs for synchronising your progress (game values and times, no IP address).

The legal basis is providing the account you requested (Art. 6 (1) (b) GDPR). The data is kept until you delete your account. You can do this yourself at any time in the game (Menu → Account); the account and progress are then removed completely.

Playing as a guest: Without a user name, email address or password, I create a guest account with a random identifier. Only your game progress, the times of creation and of the last save and the technical check logs mentioned above are stored. As a guest you can play up to level 15; after that you can turn the guest account into a regular account (your progress is kept). The legal basis is providing the game you requested (Art. 6 (1) (b) GDPR). If you do not play for 30 days, the guest account and its progress are deleted automatically. You can also delete it yourself at any time (Menu → Account).

6. Email address and codes

I need your email address for two things: to check that it belongs to you, and so that you can reset a forgotten password. For this I send you an eight-digit code that you enter in the game. Only a confirmed address can also be used to sign in. I do not send you advertising or newsletters.

I do not store the code itself, only an irreversible check value. It is deleted as soon as you have used it, at the latest after 24 hours (confirmation) or 60 minutes (password reset). The emails are sent by my hosting provider's mail server (see section 3). The legal basis is providing your account (Art. 6 (1) (b) GDPR).

7. Cookie for signing in

After you sign in, the site sets a single cookie (__Host-exo_sitzung). It contains a random session identifier, cannot be read by scripts, is only sent over encrypted connections and is valid for at most 90 days. It is strictly necessary to keep you signed in and therefore does not require consent (§ 25 (2) no. 2 German TDDDG). It is deleted when you sign out.

8. Protection against abuse

For sign-in and registration attempts and when codes are requested, the IP address is stored briefly in order to slow down password guessing, mass creation of accounts and sending many emails. If an email address is counted in the process, I only store it as an irreversible check value. These entries are deleted after 24 hours at the latest. The legal basis is my legitimate interest in keeping accounts secure (Art. 6 (1) (f) GDPR).

9. App installation and offline use

So that the game can be installed as an app and loads faster, a so-called service worker stores game files (program code, graphics) in your browser's storage. No personal data is stored in this way. The ExoMiner Android app shows the same website; the same rules described here apply.

10. Contact by email

If you send me an email, I process your address and your message in order to reply (Art. 6 (1) (b) or (f) GDPR). The message is deleted once it has been dealt with and no statutory retention obligation applies.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). An informal email to info@exominer.de is sufficient.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for me:
Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (TLfDI), Häßlerstraße 8, 99096 Erfurt – www.tlfdi.de

12. Obligation to provide data

For an account you need a user name, an email address and a password. As a guest you can play up to level 15 without providing these. Beyond that you are not obliged to provide any data. There is no automated decision-making within the meaning of Art. 22 GDPR.