Legal · Effective October 9, 2026

Privacy Policy

This privacy policy explains what personal data is processed when you visit the website playexopolis.com (the “Website”), why this happens, and what rights you have. The game Exopolis is not yet released. Before it is, this policy will be extended to cover the game.

In short

• The Website has no user accounts, no forms and no newsletter.
• The Website uses no cookies, no advertising and no social media tracking.
• Fonts and images are served from our own domain. No connection is made to Google or other third parties.
• We measure visits with the privacy-friendly Cloudflare Web Analytics, which does not track or identify you.

1. Who is responsible

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

Kevin Hartmann
Jahnstraße 5
61250 Usingen
Germany
Email: support@playexopolis.com

We are not required to appoint a data protection officer. For any privacy question or request, simply email us at the address above.

2. Hosting and access data

The Website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which delivers it through its global network. Each time you visit the Website, the following data is processed:

• IP address
• date and time of the request
• requested page or file
• referrer URL
• browser type and version, operating system

Purpose: delivering the Website, ensuring its stability and security, and defending against attacks. We do not combine this data with other data or use it to identify visitors.

Legal basis: our legitimate interest in the secure and reliable operation of the Website (Art. 6(1)(f) GDPR). Cloudflare acts as our processor under a data processing agreement (Art. 28 GDPR). Log data is deleted after a short period, unless it is needed longer to investigate a specific security incident.

3. Cloudflare Web Analytics

To understand how the Website is used and how quickly it loads, we use Cloudflare Web Analytics, a service of Cloudflare, Inc. (address see section 2). A small script in your browser sends the following information to Cloudflare when you open a page:

• visited page (URL) and referring website (referrer)
• browser, operating system and device type (derived from the user agent)
• country (derived from your IP address)
• page load and performance metrics (e.g. Core Web Vitals)

Cloudflare Web Analytics does not use cookies, local storage or fingerprinting, does not store your IP address, and does not track you across websites or visits. We only see aggregated statistics such as page views, referrers and load times, which do not allow us to identify you.

Legal basis: our legitimate interest in analysing the reach and technical performance of the Website in a privacy-friendly way (Art. 6(1)(f) GDPR). Cloudflare acts as our processor under a data processing agreement (Art. 28 GDPR). You can object at any time (see section 8), or prevent the measurement by blocking the script static.cloudflareinsights.com with a content blocker. More information: Cloudflare Privacy Policy.

4. No cookies, no advertising

The Website does not set cookies, does not use advertising or social media tracking, and does not embed content from social networks or video platforms. Fonts are hosted on our own domain, so no connection is made to Google or other font providers.

5. Contacting us

If you email us, we process your email address, name (if provided) and the content of your message to answer your request. Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract or pre-contractual steps, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete the correspondence once your request has been dealt with, unless statutory retention periods (e.g. under German commercial and tax law) require longer storage.

6. Recipients and international transfers

We do not sell your personal data. Personal data is only disclosed to:

• Cloudflare, Inc. as hosting and web analytics provider (processor), see sections 2 and 3
• our email provider, as a processor, when you contact us
• authorities, where we are legally obliged to do so

Cloudflare may process data in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, Standard Contractual Clauses (Art. 46(2)(c) GDPR) are in place where required.

7. How long we keep data

We only keep personal data for as long as necessary for the purposes described above, or as long as required by law.

8. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• withdraw any consent you have given, with effect for the future (Art. 7(3))
• lodge a complaint with a supervisory authority (Art. 77)

Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, email support@playexopolis.com.

The supervisory authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany (datenschutz.hessen.de). You may also contact the authority in your country of residence.

9. Users in the United States

We do not sell or share personal information for cross-context behavioural advertising, and we do not use it for profiling. Residents of California and other US states with privacy laws may request access to or deletion of their personal information by emailing support@playexopolis.com. We will not discriminate against you for exercising these rights.

10. Children

The Website is not directed at children under 16. We do not knowingly process personal data of children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Security

The Website is only served over encrypted connections (HTTPS/TLS).

12. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

13. Changes to this policy

We will update this privacy policy when the game is released, and whenever the Website or the law changes. The current version is always available at playexopolis.com/privacy-policy. The date at the top shows when it last changed.