Updated 12 October 2026
Who is responsible?
Controller: Viliam Kanis (Kaudo), Vendelínska 1, 841 01 Bratislava, Slovakia. Email: [email protected].
Data, purposes and legal bases
- Account and service: email, password hash, username, account status and timestamps, submitted projects, ownership evidence, revisions, moderation correspondence and terms acceptance. We use these to provide your requested account, publishing and battle services (GDPR Article 6(1)(b)). Email and username are needed for an account; optional profile fields are not.
- Google sign-in, if chosen: Google supplies your identity identifier, verified email and name. We store the identifier, email and profile name to authenticate you (Article 6(1)(b)); we do not receive your Google password. Google applies its own privacy policy.
- Security and voting: session identifiers, a random anonymous voting cookie, hashed voter identifiers, vote counters, server/network logs including IP address, request, browser information and time. Our legitimate interests are service security, preventing duplicate votes, fair results and investigating misuse (Article 6(1)(f)). Account-linked participation may remain identifiable while associated records exist.
- Contact and operations: messages and operational emails support requests, verification, password resets and moderation. Service provision, legitimate interests in resolving disputes, or legal obligations apply as appropriate (Articles 6(1)(b), (f), (c)). We do not currently send marketing newsletters or use advertising/analytics tracking scripts.
Public information and recipients
Public profiles, chosen contact links, published project information and battle-creator attribution can be viewed, indexed and shared by others. Email is not a public profile field unless you publish it yourself. Listings can also be submitted by other users or prefilled from public project websites; contact us about inaccurate personal information. Reports show aggregate votes, not voters' identities.
Authorized administrators and infrastructure providers process relevant data: Hetzner hosting, Cloudflare network/security, and mail transport and recipients' email providers. Optional Google sign-in and externally hosted logos/images may involve Google or the image host; loading them exposes technical connection data. Share buttons are links, not embedded social trackers. External services apply their own policies. We do not sell personal data.
Hosting and international processing
Our selected Hetzner server is in the United States. Data stored there, including accounts and uploads, is processed outside the EEA. Cloudflare and Google may also process data internationally. Hetzner describes its US arrangements and available processing agreement here; Cloudflare describes its transfer safeguards here. Contact us for information about the applicable contractual safeguards and copies.
Retention
Account data is retained while your account is used, then deleted or anonymised on a valid closure request unless necessary for a legal obligation or a documented dispute/security investigation. Listings and aggregate battle results remain while needed for the public directory and permanent results; personal attribution is reviewed on an erasure request. Voting guards expire with their battle and are cleared by background maintenance; the voting cookie lasts 30 days. Tokens expire after one hour. Logs, queues, moderation records and backups are retained only as needed for security, delivery, recovery and legal claims, with duration determined by incident relevance, provider settings and applicable legal periods. Contact us for the current retention settings.
Your rights
Depending on the legal basis, you may request access, correction, erasure, restriction or portability, and object to legitimate-interest processing. Withdraw consent whenever processing relies on it; this does not affect earlier lawful processing. Email us; we may verify your identity and normally respond within one month. You may complain to the Slovak Office for Personal Data Protection or your local supervisory authority. There is no automated decision-making producing legal or similarly significant effects; community scores do not make decisions about you.