Privacy
Privacy notice
Version: 2026-06-23
1. Controller and privacy contact
The operator named in the legal notice is responsible for processing personal data. Privacy requests may be sent to info@bravostory.online.
2. Data processed
The portal processes account and contact data, login and security events, session data, game attempts, times, moves, results, rankings, rewards, transactions, feedback, technical diagnostics, and game proofs required for abuse and fraud prevention.
3. Purposes
Data is processed to provide the portal, manage accounts, verify email addresses, recover passwords, conduct and validate minigames, rankings and rewards, protect IT security, analyse errors, provide support, process feedback, and improve the service.
4. Legal bases
Depending on the processing, it may be based on contract performance or pre-contractual steps, legitimate interests in secure and fair operation, compliance with legal obligations, or consent. The exact legal bases must be reviewed before production and adapted to the actual operating model.
5. Hosting
The portal is hosted by Martin Weber at Deutschland. Technically necessary server and log data is processed there.
6. Feedback and GitHub synchronisation
Feedback reports may be transferred to a configured GitHub project together with their title, content, status, comments and technical diagnostic context. GitHub may process data outside the European Union depending on its infrastructure. Credentials, passwords and security tokens are not transferred as diagnostic context.
7. Game validation and abuse prevention
To ensure fair results, start and end times, game moves, seeds, server validation results, abort and reset events, and technical metadata are stored and evaluated automatically. Authorised administrators may review suspicious attempts.
8. Retention and deletion
Security events are generally retained for up to 365 days, automation logs for up to 90 days, closed feedback for up to 730 days, and detailed attempts for up to 730 days. Rewards, transactions and related integrity evidence may be retained longer where necessary for traceability, fraud prevention or legal obligations. Deletion periods begin only when no conflicting retention or evidence requirements apply.
9. Recipients
Access is limited to authorised persons and technically necessary service providers. Data is not intended to be disclosed for advertising. Processor agreements and international transfers must be reviewed for the providers actually used before production.
10. Data subject rights
Within the scope of applicable law, data subjects may request access, rectification, erasure, restriction, portability and objection, and may withdraw consent for the future. They may also complain to a data protection supervisory authority.
11. Security
The portal uses encrypted transmission, secure sessions, access restrictions, two-factor authentication for privileged accounts, server-side game validation, security logs and regular backups.
12. Changes
Material changes receive a new version number. Signed-in users must accept the current version before continuing to use the portal.