Privacy

In short: you can play ZORALEN without an account – your progress then stays in your browser and we only receive anonymous gameplay statistics. With an account we store what is needed for progress, friends and leaderboards. Only if you agree in the banner do we additionally analyse how you play – on our own server, without ads and without sharing. No cookies.

1. Controller

We have not appointed a data protection officer as we are not legally required to do so. Please send any privacy questions to the address above.

2. Accessing the game: hosting and server logs

The game runs on a server operated by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in Germany. Hetzner processes the data as our processor (Art. 28 GDPR). When you access the game, the server processes technically necessary connection data: IP address, time, requested address, browser identifier (user agent) and referrer.

Our server and its reverse proxy also log this connection data. Purpose: delivering the game, security and debugging. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). Retention: at most 14 days, unless needed to investigate a specific security incident.

To prevent abuse (e.g. mass login attempts) the server counts requests per IP address. These counters exist only in memory and expire after one hour at most.

For the administration area (operator only, with a second factor) the server logs every sign-in attempt and every administrative action: time, affected account or entered email address, result and IP address. Purpose: protection against unauthorised access and traceability of changes to accounts. Legal basis: Art. 6(1)(f) GDPR. Retention: the IP address 14 days, the rest of the entry one year.

3. Storage in your browser

The game sets no cookies. It uses your browser's local storage. Most entries are needed for features you use – which does not require consent (§ 25(2) no. 2 TDDDG, Art. 5(3) ePrivacy Directive). The analytics ID is only created with your consent (§ 25(1) TDDDG, see section 5). The entries do not leave your device except where stated.

You can delete these entries at any time via your browser settings ("clear site data"). Without an account your progress is then lost.

4. Playing without an account

Without an account we store no data that identifies you. After a run (solo or as host, not in PvP) the game sends anonymous gameplay statistics to our server: world, mode, wave reached, score, kills, duration, chosen modules, weapons, build, level and cause of death. Without your consent they contain no name and no device or browser identifier; with consent they also carry your analytics ID (section 5). We use them to improve difficulty and balancing (Art. 6(1)(f) GDPR).

Error reports: if the game crashes or a script error occurs, it sends an error report: error message, technical location, game version, game state (e.g. world and wave) and browser identifier (user agent); if you are signed in, also your account ID and pilot name. The purpose is fixing bugs (Art. 6(1)(f) GDPR). We keep at most the 500 most recent error types.

Multiplayer: rooms run through our server (WebSocket). For the duration of a round it processes pilot name, ship, paint job, positions and game events and relays them to the other players in the room. There is no chat. Nothing of this is stored after the round (except the anonymous statistics above). Legal basis: Art. 6(1)(b) GDPR (providing the multiplayer mode you requested).

5. Usage analytics – only with your consent

When you first start the game, a banner asks whether we may analyse how ZORALEN is played. "Decline" and "Accept" are equal; the game works the same either way. Only if you agree do we create a random analytics ID (pd_aid) in your browser and send the following events to our own server:

• Session: start and duration, browser language, game language, time zone, whether it is your first visit;
• Device: device type (desktop/tablet/mobile), browser identifier (user agent), screen and window size, pixel density, number of CPU cores, approximate memory, touch support, connected gamepad, graphics card name;
• Origin: the page you came from (without query parameters), campaign data from the link (utm_source, utm_medium, utm_campaign), whether you came via an invite link;
• Usage: which menu sections you open, runs started and finished (world, mode, number of players, level, wave, score, kills, duration, quitting) with the average frame rate, in co-op also the ping (average, 95th percentile and maximum round-trip time to the host or guests); the run statistics from section 4 are linked to your analytics ID;
• with an account also your account ID, so that we can analyse usage and account together;
• your consent itself (time and banner version) as proof.

Purpose: understanding where players get stuck or stop, on which devices the game stutters and how players find us, and improving the game accordingly. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Recipients: nobody but us – the data stays on our server and is not passed to analytics or advertising services (the server is hosted by Hetzner in Germany, section 2). Retention: 13 months, then deleted automatically.

Withdrawal: at any time under "Privacy settings" (bottom of the menu sidebar). If you withdraw, we immediately delete all events linked to your analytics ID on the server, remove the link in the run statistics and the ID from your browser. Processing before the withdrawal remains lawful.

6. Game account

If you create an account, we store:

• email address, pilot name and password – the password only as a secure hash (scrypt), never in plain text;
• whether your email is confirmed, time of registration and of your last activity;
• your save game: level, experience, OsCoins, shards, bought and found items, builds, achievements, statistics, pilot emblem, expedition and co-op mission progress;
• your runs for the leaderboard (world, mode, score, wave, kills, team, time, duration – only the moderators see the duration, to spot implausible results) and the gameplay statistics from section 4 with your account ID;
• session keys (hashed only, valid for 60 days) and confirmation codes (valid for 30 minutes);
• your friendships and friend requests;
• your unlocks (e.g. the full version): product, source (browser purchase, Steam, key or granted by us), receipt number and time, and the time of any revocation (e.g. a refund);
• if you redeem a gift key: which key (we only store a fingerprint, not the key itself) was redeemed by which account and when. If you delete your account, the key stays marked as used, with no link to you. Failed attempts are only counted briefly in memory (at most 10 per hour, per account and IP address) to prevent guessing.

Legal basis: Art. 6(1)(b) GDPR – the account cannot work without this data. Retention: until you delete the account. Unconfirmed registrations are deleted automatically after 7 days, as are expired codes and sessions.

Deleting your account: at any time in the game under Pilot → Account → Delete account. Your account, save game, runs, friendships and reports are deleted immediately. Gameplay statistics and error reports are kept without any link to you (anonymised).

What others can see

• Leaderboard (public): pilot name, pilot emblem, score, wave and, if applicable, team name of your best runs. For co-op runs in the Rift, also the pilot names of all group members (including guests without an account) and the depth reached.
• Speedrun leaderboard (public, also on the page speedrun.html): only for runs you submit yourself – pilot name, time, splits, category/stage, ruleset (glitchless/anything goes), date and the video link you enter (only the link; we do not download or store the video). With the run we also store the flight recorder (position, speed, hit points, shield and nearby enemies about four times per second, plus events such as zone changes, chests, card picks, bosses, deaths, pauses and splits) and the run code; only the moderators see these, to review the run. Retention: rejected → video link and flight recorder deleted immediately, the entry after 90 days; without a video link deleted after 90 days; accepted → flight recorder deleted 90 days after the review, time and video link stay public until you delete your account or the moderators remove the entry. Runs you do not submit never leave your browser.
• Friends: whether you are online and when you were last active, which room you are playing in, your paint job, statistics and achievements.
• Players in your room: pilot name, ship and level.

So don't use your real name as pilot name if you don't want it to be seen.

Emails

We only send emails your account needs: a confirmation code when registering, a password reset link and a notice if someone tries to create a second account with your address. No newsletter, no advertising. Emails come from noreply@zoralen.com; they are sent by the mail server of our host Hetzner Online GmbH as our processor (Art. 28 GDPR).

Reports and moderation

Players can report other accounts (reason: name, cheating, other). We store who reported whom, when and why, and review the report. For violations of the terms of use we may reset a name, remove leaderboard entries or suspend the account; the suspension and its reason are stored with the account. Legal basis: Art. 6(1)(b) and (f) GDPR (enforcing the rules, fair leaderboards).

When we grant or revoke an unlock, or create or block gift keys, we record in an internal log who (the name of the admin account) did what, when, for which account. Only admins see this log; if you delete your account, the entry loses its link to you. Legal basis: Art. 6(1)(f) GDPR (traceability of unlocks).

The server automatically checks submitted results for plausibility (e.g. wave and score relative to play time) and caps rewards per minute. This serves fairness and has no legal or similarly significant effect within the meaning of Art. 22 GDPR.

Signing in with Steam

In the Steam version and on the website (“Sign in with Steam”) you can sign in with your Steam account or link an existing account to it. We then receive your Steam ID (a public number of your Steam account) from Valve Corporation (10400 NE 4th St, Bellevue, WA 98004, USA) and check with Steam whether the sign-in ticket is valid and whether you permanently own ZORALEN on Steam (to unlock the full version). We store the Steam ID with your account and as proof of the unlock; we never receive the password, email address or payment details of your Steam account. An account created with Steam only has no email address and no password with us; you can delete it in the game by confirming with your pilot name.

For Steam achievements, your game status shown to your Steam friends (e.g. “In room K7QX”) and invitations, the Steam version uses the Steam client on your computer; what Steam stores is governed by Valve’s privacy policy. Legal basis: Art. 6(1)(b) GDPR (you choose to sign in with Steam). Retention: until you delete the account.

Playing offline (Steam version): without a connection the Steam version keeps your results (runs, Expedition progress, chests, achievements) and your last account profile on your computer and sends them to our server the next time it is reachable. The server checks late reports like all others; they do not enter the leaderboard.

Buying the web version: Only when you start a purchase does the game load Paddle's checkout (cdn.paddle.com; Paddle.com Market Ltd, London, United Kingdom). Paddle is the seller (Merchant of Record) and processes payment, invoicing and tax data under its own responsibility, see Paddle's privacy notice. We pass your account id and – if available – your email address (to prefill the form) to Paddle. Paddle reports the purchase to us (transaction id, account id, product, refunds); we store this as proof of the unlock on your account for as long as the account exists (Art. 6(1)(b) GDPR); invoices and tax records are kept by Paddle. The EU Commission has issued an adequacy decision for the United Kingdom.

7. Minimum age

You must be at least 16 to create an account, or have your parent's or guardian's consent. Without an account, no data identifying you is collected. If you are under 16, you may only agree to usage analytics (section 5) with your parent's or guardian's consent (Art. 8 GDPR).

8. Recipients and third countries

Your data is only received by our host Hetzner (sections 2 and 6, Germany), Paddle when you buy the web version (section 6, United Kingdom) and – only if you sign in with Steam – Valve (Steam, USA; section 6, “Signing in with Steam”). We do not sell data or share it for advertising. Authorities only receive data where we are legally obliged to provide it.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw your consent (Art. 7(3)). Just email us at info@ossai.de.

Right to object (Art. 21 GDPR): where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.

Complaints: you may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in your country of residence. Our competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de. UK users may also contact the Information Commissioner's Office (ico.org.uk).

10. Other

Providing your data is voluntary, but you cannot use an account without account data. All connections are TLS-encrypted. We do not sell or share personal information within the meaning of the California Consumer Privacy Act. If the game changes in a way that affects data processing, we will update this policy. The German version of this policy is legally binding.

Last updated: October 2026