PROCESSING
Keep this window open.
Last updated: June 12, 2026
The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is the operator of Stellarch:
Daniel Samer
Am Alefskamp 50
47198 Duisburg
Germany
Email: [email protected]
Phone: +49 15225669203
Data Protection Officer: A Data Protection Officer is not appointed pursuant to Art. 37 GDPR in conjunction with Section 38 BDSG, as the legal requirements are not met.
This Privacy Policy explains what personal data we collect when you use Stellarch, why we collect it, and what we do with it. Personal data is any information that can identify you.
We only collect what we need to operate the game, provide your account, process purchases, and keep the Service secure. All processing is based on the legal bases set out in Art. 6 GDPR.
Important: Stellarch is built on the public Hive blockchain. Some data (such as your Hive account name, wallet addresses, token transactions, and certain match outcomes) is written to a public, immutable ledger. Please read the section "Blockchain Data and the Right to Erasure" carefully.
Hosting:
Our website is hosted on dedicated server infrastructure within the European Union.
A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with our hosting provider.
Server Log Files:
Each time the Service is accessed, information is automatically stored in server log files that your browser transmits:
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure, trouble-free operation). Retention: log files are deleted or anonymized after a short period.
Stellarch offers several login methods. Depending on the method you choose, we process:
We also store a chosen username, account creation time, the IP address at registration, your locale, and a session audit record (login method, IP, user agent, timestamps).
Legal basis: Art. 6 (1) (b) GDPR (performance of the user contract) for providing your account.
When you buy KRED or other paid products by card, payment is processed by Stripe Payments Europe / Stripe, Inc. ("Stripe"). We receive a confirmation of payment, the purchase amount, and an identifier; we do not store your full card number. Stripe processes data in the USA; transfers are based on EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework.
When you pay with crypto (native HIVE or a Hive Engine token), the transaction is settled on the public Hive blockchain and is permanently recorded there.
Legal basis: Art. 6 (1) (b) GDPR (performance of contract) and Art. 6 (1) (f) GDPR (legitimate interest in fraud prevention and accounting).
To run the game we process gameplay data such as your card collection, decks, match history, replays, ranked rating, league, season standings, in-game currency balances, and ledger entries. This data is necessary to provide ranked play, the card market, and the deterministic replay system.
Legal basis: Art. 6 (1) (b) GDPR (performance of contract).
Stellarch interacts with the public Hive blockchain and Hive Engine. Data written to the blockchain, including your Hive account name, wallet addresses, token transfers (SGC, STEL, HIVE, Hive Engine tokens), and certain on-chain game actions, is public, distributed, and immutable. It cannot be deleted or modified by us.
This means your GDPR right to erasure (Art. 17 GDPR) is technically limited for on-chain data: we can delete the personal data we hold in our own systems, but we cannot remove data that has already been written to the blockchain by you or by the network. By choosing to use blockchain features, you acknowledge this limitation. Where possible, we minimize the personal data we cause to be written on-chain.
We send transactional emails such as login one-time codes, security notices, and important account or purchase information. These are sent via our email/SMTP infrastructure.
Legal basis: Art. 6 (1) (b) GDPR (performance of contract) for transactional messages.
We use technically necessary cookies and local storage to keep you signed in, protect against cross-site request forgery, remember your preferences, and operate the game client. These are required for the Service to function.
Legal basis for technically necessary cookies: Art. 6 (1) (f) GDPR (legitimate interest in secure operation) and Section 25 (2) of the German Telecommunications-Digital-Services Data Protection Act (TDDDG).
Where we use any optional analytics in the future, those will only be set with your consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG, and you will be able to withdraw consent. Details are described in our Cookie Policy.
We share personal data only as necessary to operate the Service, with processors bound by data processing agreements. Categories of recipients include:
We do not sell your personal data.
Your data is primarily processed within the EU/EEA. Some processors (in particular Stripe and Google) may process data in the USA. Such transfers are safeguarded by EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR and/or the EU-US Data Privacy Framework. Blockchain data is, by nature, distributed across nodes worldwide.
We store personal data only as long as necessary for the respective purpose or as required by statutory retention periods:
You have the following rights regarding your personal data:
1. Right of access (Art. 15 GDPR).
2. Right to rectification (Art. 16 GDPR).
3. Right to erasure (Art. 17 GDPR), subject to the blockchain limitation described above.
4. Right to restriction of processing (Art. 18 GDPR).
5. Right to data portability (Art. 20 GDPR).
6. Right to object (Art. 21 GDPR) to processing based on legitimate interests.
7. Right to withdraw consent (Art. 7 (3) GDPR) at any time, with effect for the future.
8. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
To exercise your rights, contact us at: [email protected]
The competent supervisory authority for data protection is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestrasse 2-4
40213 Düsseldorf
Germany
Phone: +49 211 38424-0
Email: [email protected]
Website: https://www.ldi.nrw.de
You have the right to lodge a complaint with this authority about our processing of your personal data.
We use technical and organizational measures to protect your data, including TLS encryption for all transfers, hashing of secrets (such as PINs) rather than storing them in plain text, double-key encryption for sensitive key material where applicable, access controls, and regular security updates. No system is completely secure; please notify us immediately if you notice a security issue.
We may update this Privacy Policy from time to time to reflect changes in our processing or legal requirements. The date of the last update is shown at the top of this page. For significant changes, we may inform you separately.
For questions about the processing of your personal data or to exercise your rights, contact:
Daniel Samer
Am Alefskamp 50
47198 Duisburg
Germany
Email: [email protected]
Phone: +49 15225669203
We will respond as soon as possible, and no later than one month in accordance with Art. 12 (3) GDPR.
This Privacy Policy is a working draft for the Stellarch alpha. For binding data-protection questions and before public launch, qualified German/EU legal advice should be obtained.
