← Back to the game

Privacy policy

This is a translation for convenience. The German version is legally binding.

1. Controller

Jens Deckardt, Ohrdrufer Str. 14, 99331 Geratal OT Geraberg, Germany
Email: info@exominer.de

2. Summary

• No advertising, no trackers, no analytics tools, no profiling.
• No content from third-party servers (no external fonts, scripts or videos).
• No sharing of your data with third parties – except the hosting provider that runs the site technically.
• You play with an account or start as a guest. I only store what is technically necessary for this.

3. Hosting and server logs

The site is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. When you visit the site, the server processes technically necessary data (e.g. IP address, time, requested address, browser identifier) in order to deliver the site and protect it against attacks. The legal basis is my legitimate interest in a secure and working service (Art. 6 (1) (f) GDPR). The hosting provider processes this data on my behalf (Art. 28 GDPR).

Error and performance reports: If a program error occurs in the game, your browser sends a short technical report to the server: game version, error text and the location in the program code. Every 5 minutes of play it also sends a performance summary: frames per second, share of slow frames, server response time and a rough device class (touch or mouse, pixel density, window size rounded to 100 pixels). These reports contain no account name, email address or IP address and are not linked to your account; they only go into the server's error log. I use them solely to find errors and make the game run more smoothly. The legal basis is my legitimate interest in a working service (Art. 6 (1) (f) GDPR). To prevent anyone from flooding the server with reports, their number is counted per account or IP address for at most 24 hours (see section 8).

4. Storage in your browser

The game stores your user name (as a guest: a random guest identifier) in your browser's storage (localStorage) as a marker so that it knows you are signed in. If you played without an account in the past, an old game progress may also still be stored there. You can delete this data at any time by removing the site data for exominer.de in your browser.

5. Player account

To play, you create an account. Your progress is then stored on the server and is available on all your devices. I store:

• your user name,
• your email address and the time you confirmed it,
• your password – only as an irreversible hash (Argon2id), never in plain text,
• your game progress including in-game currencies,
• a booking log of your Exos and code keys (amount, reason, time), so that every change can be traced,
• the times of creation and of the last save,
• technical check logs for synchronising your progress (game values and times, no IP address); they are deleted after 30 days.

The legal basis is providing the account you requested (Art. 6 (1) (b) GDPR). The data is kept until you delete your account. You can do this yourself at any time in the game (Menu → Account); the account and progress are then removed completely.

Playing as a guest: Without a user name, email address or password, I create a guest account with a random identifier and a random display name (e.g. “Vega-4821”). If you turn the guest account into a regular account, the display name is deleted. Only your game progress, the booking log of the in-game currencies, the times of creation and of the last save and the technical check logs mentioned above are stored. As a guest you can play up to level 15; after that you can turn the guest account into a regular account (your progress is kept). The legal basis is providing the game you requested (Art. 6 (1) (b) GDPR). If you do not play for 30 days, the guest account and its progress are deleted automatically. You can also delete it yourself at any time (Menu → Account).

6. Email address and codes

I need your email address for two things: to check that it belongs to you, and so that you can reset a forgotten password. For this I send you an eight-digit code that you enter in the game. Only a confirmed address can also be used to sign in. I do not send you advertising or newsletters.

I do not store the code itself, only an irreversible check value. It is deleted as soon as you have used it, at the latest after 24 hours (confirmation) or 60 minutes (password reset). The emails are sent by my hosting provider's mail server (see section 3). The legal basis is providing your account (Art. 6 (1) (b) GDPR).

7. Cookie for signing in

After you sign in, the site sets a single cookie (__Host-exo_sitzung). It contains a random session identifier, cannot be read by scripts, is only sent over encrypted connections and is valid for at most 90 days. On the server the identifier is only stored as an irreversible check value. It is strictly necessary to keep you signed in and therefore does not require consent (§ 25 (2) no. 2 German TDDDG). It is deleted when you sign out.

8. Protection against abuse

For sign-in and registration attempts and when codes are requested, the IP address is stored briefly in order to slow down password guessing, mass creation of accounts and sending many emails. If an email address is counted in the process, I only store it as an irreversible check value. These entries are deleted after 24 hours at the latest. The legal basis is my legitimate interest in keeping accounts secure (Art. 6 (1) (f) GDPR).

To protect against attacks, suspicious events are also recorded — such as wrong passwords, malformed or foreign requests to the game interface and requests for typical attack targets (e.g. “wp-login.php”). I store the time, the type of event, the account number where applicable and, instead of the IP address, only an irreversible check value. If such events pile up, the sender is blocked automatically for 15 minutes up to at most 24 hours. These entries are deleted after 14 days, blocks when they expire. The legal basis is my legitimate interest in the security of the service (Art. 6 (1) (f) GDPR).

Administration and automatic deletion: Only I access the stored data, through a separate administration area protected by a password and a second factor (one-time code); sign-ins and failed attempts there are recorded as described above. I use it to answer tickets, find errors and detect abuse. An automatic task on the server runs every 15 minutes: it deletes expired entries according to the periods stated in this policy and checks that the website's program files are unchanged (no personal data is processed in doing so). The legal basis is my legitimate interest in a secure and well-maintained service (Art. 6 (1) (f) GDPR).

9. App installation and offline use

So that the game can be installed as an app and loads faster, a so-called service worker stores game files (program code, graphics) in your browser's storage. No personal data is stored in this way. The ExoMiner Android app shows the same website; the same rules described here apply.

10. Contact by email and reports from the game

If you send me an email, I process your address and your message in order to reply (Art. 6 (1) (b) or (f) GDPR). The message is deleted once it has been dealt with and no statutory retention obligation applies.

Report a bug & support: Via Menu → “Report a bug & support” you can send me a bug, an idea or a question. I store your message, the type of report, the time and your account (so that I can trace your problem in your game progress). The game adds technical details that you can view before sending: game version, zone, level, progress of the starting mission, device class (touch or mouse, pixel density), window size, language, the browser identifier and the latest program errors of the session. I also receive the report by email. Your email address is only included if you tick “I'd like a reply by email” and it is confirmed. The legal basis is providing and improving the game (Art. 6 (1) (b) or (f) GDPR). Every report becomes a ticket: in the same window you can see its status and my replies and write back; these messages are stored with the ticket. If you asked for a reply by email, you also receive it at your confirmed address. Resolved tickets are deleted 90 days after the last entry, all others at the latest after 12 months, and always together with your account. To prevent anyone from flooding the inbox, the number of reports per account is counted for at most 24 hours (see section 8).

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). An informal email to info@exominer.de is sufficient.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for me:
Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (TLfDI), Häßlerstraße 8, 99096 Erfurt – www.tlfdi.de

12. Obligation to provide data

For an account you need a user name, an email address and a password. As a guest you can play up to level 15 without providing these. Beyond that you are not obliged to provide any data. There is no automated decision-making within the meaning of Art. 22 GDPR.