Privacy

Who handles your information

Sebastian Noschka, Curiehof 13, 30627 Hannover, Germany. Email: info@bad-arrows.com

Hosting

Lovable hosts this website. When you visit, essential technical information such as your IP address, visit time and requested page is processed to deliver the site and keep it secure. This processing is based on our legitimate interest under the GDPR.

The waitlist

When you join the waitlist, we store your email address, referral code, the code of the person who invited you and your confirmation time. This information is stored on servers in Frankfurt, Germany. Processing is based on your consent under the GDPR.

Email confirmation

After signing up, you receive an email to confirm your registration. Your signup becomes active only after confirmation.

Cookies

We do not use tracking cookies. A referral code from an invitation link may be stored in your browser so the invitation can be credited.

Keeping and deleting information

We keep your information until you withdraw consent. You can request deletion at any time by emailing the address above.

Your rights

You can ask to access, correct, delete, restrict or transfer your information, and withdraw your consent. You can also complain to a data protection authority, such as the authority for Lower Saxony, Germany.

Optional analytics and campaign measurement

With your permission, we measure how visitors discover BAD ARROWS and use our website and browser game. This helps us understand which campaigns bring interested players and where people encounter difficulties.

We collect page and feature interactions, campaign identifiers, login completion, run starts, duel results, run outcomes and clicks to services such as Steam or Discord. We use a random visitor identifier. If you sign in while analytics is enabled, we connect the collected activity to an internal account reference.

We do not include your email address, password, authentication codes, private messages or form answers in analytics events. Our analytics database does not store raw IP addresses. Infrastructure providers may separately process connection information to deliver and secure their services.

Optional analytics starts only after you select "Allow analytics". You can reject it and still use the website, create an account, play and subscribe to updates. You can change your choice through "Privacy settings".

The legal basis is your consent under Article 6(1)(a) GDPR and, for optional storage on or access to your device, Section 25(1) TDDDG.

We retain the optional browser identifier for up to 90 days and detailed analytics events for up to 90 days. We retain campaign history used for account attribution for up to 180 days. We keep aggregated statistics without identifiable user histories for up to 24 months.

Withdrawing consent stops future optional collection. Our configured deletion process also removes associated identifiable analytics records. Withdrawal does not affect the lawfulness of earlier processing. Necessary account and game records are handled separately.

We use Supabase to store and process this information on our behalf and Vercel to operate the website and backend. Our core database is configured in Frankfurt. Some support and operational processing can occur outside the EEA under the safeguards described in our processor information.

Steam and community links

Some links to Steam contain campaign labels identifying the publication or placement. These labels do not contain your account ID, email address or individual visitor identifier. Steam provides aggregate campaign statistics; we do not receive a person-level list of users who added BAD ARROWS to their wishlist.

Clicking a Discord link does not tell us that you joined. External services process your information under their own privacy policies when you visit them.

Email updates and referrals

Email subscription is separate from analytics permission. We confirm subscriptions through double opt-in and provide an unsubscribe option. Referral codes are used to administer the referral programme and its rewards. Optional analytics is not required to receive eligible rewards.

Your choices and rights

You may withdraw analytics consent through "Privacy settings". You may also request access, correction or deletion of personal data and exercise other applicable GDPR rights by contacting the controller listed in this policy. You may lodge a complaint with a supervisory authority.