Privacy
What is stored, what for — and how to get rid of it.
Email address, display name and a password hash. The password itself is not stored and cannot be derived from the hash.
Completed tasks, hideout build state, item stock, trader reputation and the id of the game profile. This comes either from the game's log files — via the agent you install yourself — or is entered by hand.
Anyone using the position display transmits screenshots from the game. Position and heading are read from them. The screenshots can be switched off in the settings and are then not transmitted.
A cookie with a random identifier so you stay signed in. It holds no personal data and expires after thirty days.
The web server in front records requests with the IP address — needed for operation and abuse prevention. They are not linked to the account.
Every processing operation needs a legal basis. Here there are three: performance of the user relationship, a legitimate interest in secure operation — and, for the most precise data, explicit consent.
| Processing | Legal basis | Retention |
|---|---|---|
| Account, sign-in, settings | Art. 6(1)(b) GDPR — providing and managing the account | until the account is deleted |
| Game profile, progress, items, trader reputation | Art. 6(1)(b) GDPR — the tracking the user asked for | until the account is deleted |
| Raid history | Art. 6(1)(b) GDPR | 90 days |
| Position and heading from screenshots | Art. 6(1)(a) GDPR — consent, revocable at any time | 30 days |
| Squads, memberships, invite codes | Art. 6(1)(b) GDPR; for data of others invited, additionally Art. 6(1)(f) GDPR | unredeemed codes 30 days after expiry |
| Cookies for language setting and filters | Sec. 25(2)(2) TDDDG (strictly necessary), Art. 6(1)(f) GDPR | 1 year, or until the browser clears them |
| Sessions | Art. 6(1)(b) GDPR | 30 days, immediately on sign-out |
| Agent access keys | Art. 6(1)(b) GDPR | until revoked; then 90 days |
| Server logs with IP address | Art. 6(1)(f) GDPR — IT security and abuse prevention | 7 to 14 days |
Hashed passwords, session identifiers and access keys remain personal data as long as they can be linked to an account. Hashing is a security measure, not anonymisation.
IONOS SE, Frankfurt am Main — operating the server as a processor under Art. 28 GDPR. The data is held in Germany.
STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin — sending the password e-mails as a processor under Art. 28 GDPR. The servers are in Germany. Only your e-mail address is transmitted, and only when you request a password reset yourself.
Beyond that, no data is passed on. There is no advertising, no analytics and no selling of data.
- No sharing with third parties, no selling of data.
- No advertising, no ad networks, no profiling.
- No analytics services, no tracking across other sites.
- No fonts or scripts from foreign servers — the display font is served from here, so no page view reports your IP to a third party.
- No images from foreign servers. Item icons and map artwork come from tarkov.dev and tarkovdata, but are fetched and passed on by this server — the visitor's browser only talks to this domain.
- Access (Art. 15)
- A complete export of all stored data is available under Settings → Account.
- Rectification (Art. 16)
- Display name, language, player level and faction can be changed in the settings. For anything else, a message is enough.
- Erasure (Art. 17)
- Under Settings → Account you can delete the account and everything attached to it. This happens immediately and cannot be undone.
- Restriction (Art. 18)
- Data portability (Art. 20)
- The export is a JSON file — machine-readable and usable elsewhere without asking.
- Objection (Art. 21)
- Against processing based on legitimate interest — here the server logs.
- Withdrawal of consent (Art. 7(3))
- Position transmission can be switched off in the settings at any time. Doing so also deletes the positions transmitted so far.
- Complaint to a supervisory authority (Art. 77)
- The competent authority is the data protection supervisor of the federal state where the operator is based.
Two of them can be exercised right away: under Settings → Data there is a complete export of all stored progress data as a file, and that is also where you delete your account and everything attached to it.
For anything else: Kevinbethge1@gmail.com