Effective: 4 October 2026 · Version 2026-10-04-1

1. Controller

Adrian Piwowarczyk, Barmer Straße 20, 58332 Schwelm, Germany, phone +49 176 41244630, email adrian.piwo@icloud.com.

2. Delivery, hosting and logs

The website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Requests generate technical data including IP address, date and time, requested URL, referrer, browser, operating system, data volume and status code. This is necessary for secure and stable delivery and abuse detection (Art. 6(1)(f) GDPR). Logs are generally retained for no more than seven days; security-related extracts may be kept until an incident is resolved. A processing agreement is in place with STRATO.

3. Device access, cookies and local storage

Rule Guide uses only technically necessary session, security and login cookies and browser storage for chosen settings and offline or synchronisation functions. This may include session ID, CSRF protection, language, appearance, recently opened entries, draft and synchronisation state and push configuration. The legal bases are section 25(2)(2) TDDDG and, for subsequent processing, Art. 6(1)(b) and (f) GDPR. There is no advertising tracking or cross-device profiling. Persistent login cookies are set only when selected and can be removed by logging out or deleting browser data.

4. Account, security and communication

For registration and account use we process email address, username and display name, password hash, language, appearance, avatar assignment, roles and permissions, registration and login times, security and consent records, and tokens for email confirmation, password reset or email change. Purposes are account and contract performance, authentication, abuse prevention and proof of legal requirements (Art. 6(1)(b), (c) and (f) GDPR).

Transactional and security email is sent through the STRATO-hosted mailbox. Delivery information is processed only as necessary for sending, diagnostics and abuse prevention. Marketing email is optional and separate; none is sent without express consent (Art. 6(1)(a) GDPR).

Self-service account deletion is protected by the current password, exact entry of the login name and a time-limited confirmation link sent to the verified email address. Confirmation is generally followed by a 72-hour cooling-off period. If a subscription is active, automatic renewal is stopped first and the account is deleted only after the already paid period ends. Deletion remains blocked while a shared collection administered by the person still has other members or pending invitations. The request can be cancelled in the account until the deletion time. On completion, login, profile and private game content are deleted or anonymised, session and push assignments are revoked, and contributions in surviving shared contexts are anonymised with their content removed. Billing, contract, consent and legal evidence is retained only where statutory retention or legal-defence purposes require it (Art. 6(1)(b), (c) and (f), and Art. 17(3) GDPR).

5. Rules queries and personal game content

For search and rules queries, Rule Guide processes the input, language, mode, assigned rules sources and technical usage or quota data. Responses are generated from Rule Guide's own data; queries are not sent to an external AI provider. Anonymous queries are processed only for the immediate response and technical logging. For signed-in users, quota and activity counters may be stored.

If you use characters, custom entries, notes, collections, files, sharing or campaign chat, we process submitted content, assignments, editing state, roles, share recipients and timestamps under Art. 6(1)(b) GDPR. Shared content is shown to the people selected under the respective roles. Do not enter special-category data or third-party personal data unless necessary and lawful.

6. Subscriptions and Stripe

For paid subscriptions we process member number, email, plan, price, currency, billing interval, two-letter billing-country code, Stripe customer, Checkout, subscription and invoice identifiers, payment and contract status, cancellation and change details, and versions and fingerprints of incorporated legal documents. We do not store a billing address or full payment details. Purposes are subscription formation and performance, access control, accounting, fraud prevention and contract evidence (Art. 6(1)(b), (c) and (f) GDPR).

Payment is handled by Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin D02 H210, Ireland. Stripe receives the data required for Checkout, payment, fraud prevention and legal duties and processes payment data under its own responsibility. Transfers to Stripe entities or processors outside the EEA use the safeguards described by Stripe, particularly adequacy decisions and standard contractual clauses. See the Stripe Privacy Policy.

7. Support, contract, withdrawal, cancellation and content notices

For a cancellation or withdrawal we process contact details, contract reference, the type and, where applicable, reason for the declaration, case status, receipt and confirmation times and the related correspondence. Processing is necessary for contract handling and compliance with the statutory duties for electronic cancellation and withdrawal declarations (Art. 6(1)(b) and (c) GDPR); abuse prevention, proof of receipt and legal defence are based on Art. 6(1)(f) GDPR.

For a support or contact request we process the required reply email address, topic and message and, where provided, name and account, subscription, invoice or error reference. We also store the case reference, language, processing and delivery status, receipt, confirmation and completion times and a SHA-256 derivation of the network address salted with the application key. The request is sent through the STRATO-hosted mailbox to the internal support recipient; the supplied email address is used as the reply address and receives a separate receipt confirmation. Where the request concerns a contract or steps taken before entering into a contract, the legal basis is Art. 6(1)(b) GDPR. Otherwise, processing is based on our legitimate interests in answering requests, proving receipt and preventing misuse (Art. 6(1)(f) GDPR).

For an illegal-content notice we process contact details, the exact content URL, reasons, the good-faith declaration, where applicable the declaration invoking the statutory identity exception, technical security data, case status and correspondence. This serves the statutory notice-and-action procedure under Art. 16 DSA (Art. 6(1)(c) GDPR) and abuse prevention and legal defence (Art. 6(1)(f) GDPR). Notices are disclosed only to reviewers and, where legally required, affected users or authorities. A notifier's identity is not disclosed to the reported user unless legally required.

8. Web push

If browser notifications are enabled, we process the push endpoint, public keys, browser information, account and topic assignment, delivery status and consent time. The bases are consent under Art. 6(1)(a) GDPR and section 25(1) TDDDG. The browser provider's push service receives data needed for delivery. Consent can be withdrawn in Rule Guide or browser settings; the stored assignment is then deleted.

9. Recipients and transfers

Besides STRATO and Stripe, recipients are limited to technically or legally necessary providers, players authorised by a share initiated by you, and authorities or advisers where required by law or legal defence. Personal data is not sold. No third-country transfer is intended except as described for Stripe and, where used, the selected browser push service.

10. Retention

• Account data and personal game content: until account deletion or the purpose ends; confirmed self-service deletions are completed after the 72-hour cooling-off period or, for an active paid subscription, after the paid period ends. Backups are overwritten cyclically.
• Deleted campaign and content data in short-term recovery storage: after a new deletion, only the ten newest open bundles per member remain. Further deletions replace the oldest bundle early; no minimum recovery period is promised. After 72 hours bundles can no longer be restored and are deleted by the hourly cleanup.
• Contract, payment and invoice data: under commercial and tax retention rules, generally up to eight or ten years.
• Contract and consent evidence: for the contract term and until applicable limitation periods expire.
• Support and contact requests and withdrawal, cancellation and content notices: generally three years from the end of the year in which handling ends; longer only for an ongoing proceeding or legal duty.
• Security data: as long as required to investigate and defend against the specific incident.

11. Required data and automated decisions

Required contract data must be supplied: without email there is no account; without plan, country and payment data there is no subscription. Support requests require a reply email address, topic and message; without them the request cannot be handled and confirmed through the form. Cancellation and withdrawal details are required to the extent needed to identify and confirm the declaration. An email address is required for an illegal-content notice unless the statutory identity exception in Art. 16(2)(c) DSA applies. Data-protection consent is not required for these procedures. No decisions producing legal or similarly significant effects are based solely on automated processing within Art. 22 GDPR.

12. Your rights

Subject to legal requirements, you have rights of access, rectification, erasure, restriction, portability and objection. Consent may be withdrawn prospectively at any time. Processing under Art. 6(1)(f) GDPR may be opposed for reasons arising from your particular situation; direct marketing may always be opposed.

Contact adrian.piwo@icloud.com. You may also complain to a supervisory authority. The competent authority is in particular the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, email poststelle@ldi.nrw.de.

13. Security and changes

Safeguards include TLS, access restrictions, secure password storage, CSRF and origin checks, rate limiting, security logging, separation of payment data and regular backups. This notice is updated when law or processing changes. The current version is available on this page.

We are hosting the content of our website at the following provider:

Strato

The provider is Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin (hereinafter referred to as “Strato”). When you visit our website, Strato records various logfiles, including your IP addresses.

For more information, please consult the Strato Data Privacy Policy: https://www.strato.de/datenschutz/.

Strato is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in a depiction of our website that is as reliable as possible. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. This consent can be revoked at any time.

Data processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.

Data protection

The operators of this website and its pages take the protection of your personal data very seriously. Hence, we handle your personal data as confidential information and in compliance with the statutory data protection regulations and this Data Protection Declaration.

Whenever you use this website, a variety of personal information will be collected. Personal data comprises data that can be used to personally identify you. This Data Protection Declaration explains which data we collect as well as the purposes we use this data for. It also explains how, and for which purpose the information is collected.

We herewith advise you that the transmission of data via the Internet (i.e., through e-mail communications) may be prone to security gaps. It is not possible to completely protect data against third-party access.

Information about the responsible party (referred to as the “controller” in the GDPR)

The data processing controller on this website is:

Adrian Piwowarczyk
Barmer Straße 20

Phone: 017641244630
E-mail: adrian.piwo@icloud.com

The controller is the natural person or legal entity that single-handedly or jointly with others makes decisions as to the purposes of and resources for the processing of personal data (e.g., names, e-mail addresses, etc.).

Storage duration

Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for which it was collected no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.

General information on the legal basis for the data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9 (2)(a) GDPR, if special categories of data are processed according to Art. 9 (1) DSGVO. In the case of explicit consent to the transfer of personal data to third countries, the data processing is also based on Art. 49 (1)(a) GDPR. If you have consented to the storage of cookies or to the access to information in your end device (e.g., via device fingerprinting), the data processing is additionally based on § 25 (1) TDDDG. The consent can be revoked at any time. If your data is required for the fulfillment of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, if your data is required for the fulfillment of a legal obligation, we process it on the basis of Art. 6(1)(c) GDPR. Furthermore, the data processing may be carried out on the basis of our legitimate interest according to Art. 6(1)(f) GDPR. Information on the relevant legal basis in each individual case is provided in the following paragraphs of this privacy policy.

Recipients of personal data

In the scope of our business activities, we cooperate with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only disclose personal data to external parties if this is required as part of the fulfillment of a contract, if we are legally obligated to do so (e.g., disclosure of data to tax authorities), if we have a legitimate interest in the disclosure pursuant to Art. 6 (1)(f) GDPR, or if another legal basis permits the disclosure of this data. When using processors, we only disclose personal data of our customers on the basis of a valid contract on data processing. In the case of joint processing, a joint processing agreement is concluded.

Revocation of your consent to the processing of data

A wide range of data processing transactions are possible only subject to your express consent. You can also revoke at any time any consent you have already given us. This shall be without prejudice to the lawfulness of any data collection that occurred prior to your revocation.

Right to object to the collection of data in special cases; right to object to direct advertising (Art. 21 GDPR)

IN THE EVENT THAT DATA ARE PROCESSED ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO AT ANY TIME OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA BASED ON GROUNDS ARISING FROM YOUR UNIQUE SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. TO DETERMINE THE LEGAL BASIS, ON WHICH ANY PROCESSING OF DATA IS BASED, PLEASE CONSULT THIS DATA PROTECTION DECLARATION. IF YOU LOG AN OBJECTION, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA, UNLESS WE ARE IN A POSITION TO PRESENT COMPELLING PROTECTION WORTHY GROUNDS FOR THE PROCESSING OF YOUR DATA, THAT OUTWEIGH YOUR INTERESTS, RIGHTS AND FREEDOMS OR IF THE PURPOSE OF THE PROCESSING IS THE CLAIMING, EXERCISING OR DEFENCE OF LEGAL ENTITLEMENTS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS BEING PROCESSED IN ORDER TO ENGAGE IN DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR AFFECTED PERSONAL DATA FOR THE PURPOSES OF SUCH ADVERTISING AT ANY TIME. THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS AFFILIATED WITH SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT ADVERTISING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to log a complaint with the competent supervisory agency

In the event of violations of the GDPR, data subjects are entitled to log a complaint with a supervisory agency, in particular in the member state where they usually maintain their domicile, place of work or at the place where the alleged violation occurred. The right to log a complaint is in effect regardless of any other administrative or court proceedings available as legal recourses.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you should demand the direct transfer of the data to another controller, this will be done only if it is technically feasible.

Information about, rectification and eradication of data

Within the scope of the applicable statutory provisions, you have the right to demand information about your archived personal data, their source and recipients as well as the purpose of the processing of your data at any time. You may also have a right to have your data rectified or eradicated. If you have questions about this subject matter or any other questions about personal data, please do not hesitate to contact us at any time.

Right to demand processing restrictions

You have the right to demand the imposition of restrictions as far as the processing of your personal data is concerned. To do so, you may contact us at any time. The right to demand restriction of processing applies in the following cases:

• In the event that you should dispute the correctness of your data archived by us, we will usually need some time to verify this claim. During the time that this investigation is ongoing, you have the right to demand that we restrict the processing of your personal data.
• If the processing of your personal data was/is conducted in an unlawful manner, you have the option to demand the restriction of the processing of your data instead of demanding the eradication of this data.
• If we do not need your personal data any longer and you need it to exercise, defend or claim legal entitlements, you have the right to demand the restriction of the processing of your personal data instead of its eradication.
• If you have raised an objection pursuant to Art. 21(1) GDPR, your rights and our rights will have to be weighed against each other. As long as it has not been determined whose interests prevail, you have the right to demand a restriction of the processing of your personal data.

If you have restricted the processing of your personal data, these data – with the exception of their archiving – may be processed only subject to your consent or to claim, exercise or defend legal entitlements or to protect the rights of other natural persons or legal entities or for important public interest reasons cited by the European Union or a member state of the EU.

SSL and/or TLS encryption

For security reasons and to protect the transmission of confidential content, such as purchase orders or inquiries you submit to us as the website operator, this website uses either an SSL or a TLS encryption program. You can recognize an encrypted connection by checking whether the address line of the browser switches from “http://” to “https://” and also by the appearance of the lock icon in the browser line.

If the SSL or TLS encryption is activated, data you transmit to us cannot be read by third parties.

Encrypted payment transactions on this website

If you are under an obligation to share your payment information (e.g. account number if you give us the authority to debit your bank account) with us after you have entered into a fee-based contract with us, this information is required to process payments.

Payment transactions using common modes of paying (Visa/MasterCard, debit to your bank account) are processed exclusively via encrypted SSL or TLS connections. You can recognize an encrypted connection by checking whether the address line of the browser switches from “http://” to “https://” and also by the appearance of the lock icon in the browser line.

If the communication with us is encrypted, third parties will not be able to read the payment information you share with us.

Cookies

Our websites and pages use what the industry refers to as “cookies.” Cookies are small data packages that do not cause any damage to your device. They are either stored temporarily for the duration of a session (session cookies) or they are permanently archived on your device (permanent cookies). Session cookies are automatically deleted once you terminate your visit. Permanent cookies remain archived on your device until you actively delete them, or they are automatically eradicated by your web browser.

Cookies can be issued by us (first-party cookies) or by third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services of third-party companies into websites (e.g., cookies for handling payment services).

Cookies have a variety of functions. Many cookies are technically essential since certain website functions would not work in the absence of these cookies (e.g., the shopping cart function or the display of videos). Other cookies may be used to analyze user behavior or for promotional purposes.

Cookies, which are required for the performance of electronic communication transactions, for the provision of certain functions you want to use (e.g., for the shopping cart function) or those that are necessary for the optimization (required cookies) of the website (e.g., cookies that provide measurable insights into the web audience), shall be stored on the basis of Art. 6(1)(f) GDPR, unless a different legal basis is cited. The operator of the website has a legitimate interest in the storage of required cookies to ensure the technically error-free and optimized provision of the operator’s services. If your consent to the storage of the cookies and similar recognition technologies has been requested, the processing occurs exclusively on the basis of the consent obtained (Art. 6(1)(a) GDPR and § 25 (1) TDDDG); this consent may be revoked at any time.

You have the option to set up your browser in such a manner that you will be notified any time cookies are placed and to permit the acceptance of cookies only in specific cases. You may also exclude the acceptance of cookies in certain cases or in general or activate the delete-function for the automatic eradication of cookies when the browser closes. If cookies are deactivated, the functions of this website may be limited.

If other cookies and services are used on this website, you can find this information in this privacy policy.

Server log files

The provider of this website and its pages automatically collects and stores information in so-called server log files, which your browser communicates to us automatically. The information comprises:

• The type and version of browser used
• The used operating system
• Referrer URL
• The hostname of the accessing computer
• The time of the server inquiry
• The IP address

This data is not merged with other data sources.

This data is recorded on the basis of Art. 6(1)(f) GDPR. The operator of the website has a legitimate interest in the technically error free depiction and the optimization of the operator’s website. In order to achieve this, server log files must be recorded.

Request by e-mail, telephone, or fax

If you contact us by e-mail, telephone or fax, your request, including all resulting personal data (name, request) will be stored and processed by us for the purpose of processing your request. We do not pass these data on without your consent.

These data are processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the fulfillment of a contract or is required for the performance of pre-contractual measures. In all other cases, the data are processed on the basis of our legitimate interest in the effective handling of inquiries submitted to us (Art. 6(1)(f) GDPR) or on the basis of your consent (Art. 6(1)(a) GDPR) if it has been obtained; the consent can be revoked at any time.

The data sent by you to us via contact requests remain with us until you request us to delete, revoke your consent to the storage or the purpose for the data storage lapses (e.g. after completion of your request). Mandatory statutory provisions - in particular statutory retention periods - remain unaffected.

Newsletter data

If you would like to subscribe to the newsletter offered on this website, we will need from you an e-mail address as well as information that allow us to verify that you are the owner of the e-mail address provided and consent to the receipt of the newsletter. No further data shall be collected or shall be collected only on a voluntary basis. We shall use such data only for the sending of the requested information and shall not share such data with any third parties.

The processing of the information entered into the newsletter subscription form shall occur exclusively on the basis of your consent (Art. 6(1)(a) GDPR). You may revoke the consent you have given to the archiving of data, the e-mail address, and the use of this information for the sending of the newsletter at any time, for instance by clicking on the “Unsubscribe” link in the newsletter. This shall be without prejudice to the lawfulness of any data processing transactions that have taken place to date.

The data deposited with us for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter or the newsletter service provider and deleted from the newsletter distribution list after you unsubscribe from the newsletter or after the purpose has ceased to apply. We reserve the right to delete or block e-mail addresses from our newsletter distribution list at our own discretion within the scope of our legitimate interest in accordance with Art. 6(1)(f) GDPR.

Data stored for other purposes with us remain unaffected.

After you unsubscribe from the newsletter distribution list, your e-mail address may be stored by us or the newsletter service provider in a blacklist, if such action is necessary to prevent future mailings. The data from the blacklist is used only for this purpose and not merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). The storage in the blacklist is indefinite. You may object to the storage if your interests outweigh our legitimate interest.

Processing of Customer and Contract Data

We collect, process, and use personal customer and contract data for the establishment, content arrangement and modification of our contractual relationships. Data with personal references to the use of this website (usage data) will be collected, processed, and used only if this is necessary to enable the user to use our services or required for billing purposes. The legal basis for these processes is Art. 6(1)(b) GDPR.

The collected customer data shall be deleted upon completion of the order or termination of the business relationship and upon expiration of any existing statutory archiving periods. This shall be without prejudice to any statutory archiving periods.

Data transfer upon closing of contracts for services and digital content

We share personal data with third parties only if this is necessary in conjunction with the handling of the contract; for instance, with the financial institution tasked with the processing of payments.

Any further transfer of data shall not occur or shall only occur if you have expressly consented to the transfer. Any sharing of your data with third parties in the absence of your express consent, for instance for advertising purposes, shall not occur.

The basis for the processing of data is Art. 6(1)(b) GDPR, which permits the processing of data for the fulfilment of a contract or for pre-contractual actions.

Payment services

We integrate payment services of third-party companies on our website. When you make a purchase from us, your payment data (e.g. name, payment amount, bank account details, credit card number) are processed by the payment service provider for the purpose of payment processing. For these transactions, the respective contractual and data protection provisions of the respective providers apply. The use of the payment service providers is based on Art. 6(1)(b) GDPR (contract processing) and in the interest of a smooth, convenient, and secure payment transaction (Art. 6(1)(f) GDPR). Insofar as your consent is requested for certain actions, Art. 6(1)(a) GDPR is the legal basis for data processing; consent may be revoked at any time for the future.

We use the following payment services / payment service providers within the scope of this website:

Stripe

The provider for customers within the EU is Stripe Payments Europe, Ltd,1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (hereinafter “Stripe”).

Data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://stripe.com/de/privacy and https://stripe.com/de/guides/general-data-protection-regulation.

Details can be found in Stripe’s Privacy Policy at the following link: https://stripe.com/de/privacy.