Privacy Policy

We take the protection of your personal data seriously. Below we inform you about the collection and use of personal data on this website, in the Hero Basar and at the game table.

Data Controller

The responsible party within the meaning of the GDPR is:
Florian Heuberger
Weickenricht 25, 92271 Freihung, Germany
Email: info@fh-softdev.de

Hosting

This website is hosted on a private server accessible via IONOS SE. The server may store technical data such as IP addresses in server log files. This data is used exclusively for technical monitoring and troubleshooting.

Visiting the website

When you simply visit this website, we use no cookies and no tracking and create no user profiles. Whether you have already seen our notices (e.g. the privacy notice) is remembered locally by your browser (local storage) – this information never leaves your device.

User account and Hero Basar

If you create an account, we store your email address, your password (only as a secure hash, never in plain text), your display name and optionally a profile picture, plus the content you publish in the Hero Basar (adventures, ratings). When you download an adventure, we store the time and your IP address (download statistics and abuse protection). When you accept the terms of use, we store the version, time, IP address and browser identification as proof of your consent. You can delete your account at any time in your profile – this removes your account and all associated data.

Cookies

Only when you log in do we set two technically necessary cookies that keep you logged in: "access_token" (valid for 15 minutes) and "refresh_token" (valid for 30 days). They serve login only, not analytics or advertising, and are deleted when you log out. Technically necessary cookies do not require consent (Section 25 (2) TDDDG).

Sending emails

We send you emails to confirm your email address and to reset your password. They are sent via the mail server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.

Game table (table.dm-hero.com)

With the game table, a game master shares content from their DM Hero campaign with their group. Everything shared – texts, images, maps, fog and pings – is end-to-end encrypted: it is encrypted on the game master’s device and only decrypted on the players’ devices. Our server only stores and relays it in encrypted form and cannot read it.

Stored on the server: the game code, the player names chosen by the game master, PINs only as a hash, public keys of the game master and devices, the encrypted content and times of last use. To prevent abuse, IP addresses are briefly used in memory to limit requests, but not stored. On your device, the game table sets two technically necessary cookies – "dmh_player" for joining the game and "dm_hero_player_lang" for your language – and keeps your device’s private key and which content and notices you have already seen in the browser. No consent is required for this (Section 25 (2) TDDDG).

When the game master ends the game, everything about it is deleted from the server right away. If the server can’t be reached at that moment, the data stays until the automatic cleanup: games without contact to DM Hero are deleted after 30 days, unused logins after 90 days. The legal basis is our legitimate interest in running the game table for you and your group (Art. 6(1)(f) GDPR).

Legal Basis for Processing

Your account data and content are processed to fulfil the terms of use (Art. 6(1)(b) GDPR). Server log files, storing IP addresses for downloads and the proof of your consent to the terms of use are based on our legitimate interest in secure, abuse-free operation (Art. 6(1)(f) GDPR).

External Content

This website embeds external content: profile pictures from GitHub (github.com) for the testimonials section and an image from Buy Me a Coffee (cdn.buymeacoffee.com). When loading this content, your IP address may be transmitted to these providers.

GitHub API

The public GitHub API is used to display release information. Technical data may be transmitted to GitHub. GitHub's privacy policy applies.

Your Rights

You have the right to request access to, correction or deletion of your personal data, to restrict processing, and to object to the processing of your personal data. You also have the right to lodge a complaint with a supervisory authority.

Note on Data Transmission

Please note that data transmission over the Internet may have security vulnerabilities. Complete protection of data from access by third parties is not possible.