Privacy Policy

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is the operator of Stellarch:

Daniel Samer
Am Alefskamp 50
47198 Duisburg
Germany

Email: mail@yixn.io
Phone: +49 15225669203

Data Protection Officer: A Data Protection Officer is not appointed pursuant to Art. 37 GDPR in conjunction with Section 38 BDSG, as the legal requirements are not met.

This Privacy Policy explains what personal data we collect when you use Stellarch, why we collect it, and what we do with it. Personal data is any information that can identify you.

We only collect what we need to operate the game, provide your account, process purchases, keep the Service secure, and measure and improve the Service. All processing is based on the legal bases set out in Art. 6 GDPR.

Important: Stellarch is built on the public Hive blockchain. Some data (such as your Hive account name, wallet addresses, token transactions, and certain match outcomes) is written to a public, immutable ledger. Please read the section "Blockchain Data and the Right to Erasure" carefully.

Hosting:
Our website is hosted on dedicated server infrastructure within the European Union.

A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with our hosting provider.

Server Log Files:
Each time the Service is accessed, information is automatically stored in server log files that your browser transmits:

• IP address (shortened/anonymized after a short retention window)
• Date and time of the request
• The requested page or resource
• HTTP status code and amount of data transferred
• Referrer URL
• Browser, browser version, and operating system

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure, trouble-free operation). Retention: log files are deleted or anonymized after a short period.

Stellarch offers several login methods. Depending on the method you choose, we process:

• Email + one-time code and PIN: your email address, a hashed PIN, and login timestamps.
• Hive Keychain: your public Hive account name and the signature used to verify it. We never receive or store your Hive private keys.
• Google sign-in: the Google account identifier and email address Google provides.
• Wallet login (EVM / EOS / TON / Gala): your public wallet address and the signature used to verify ownership.

We also store a chosen username, account creation time, the IP address at registration, your locale, and a session audit record (login method, IP, user agent, timestamps).

Legal basis: Art. 6 (1) (b) GDPR (performance of the user contract) for providing your account.

When you buy KRED or other paid products by card, payment is processed by Stripe Payments Europe / Stripe, Inc. ("Stripe"). We receive a confirmation of payment, the purchase amount, and an identifier; we do not store your full card number. Stripe processes data in the USA; transfers are based on EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework.

When you pay with crypto (native HIVE or a Hive Engine token), the transaction is settled on the public Hive blockchain and is permanently recorded there.

Legal basis: Art. 6 (1) (b) GDPR (performance of contract) and Art. 6 (1) (f) GDPR (legitimate interest in fraud prevention and accounting).

To run the game we process gameplay data such as your card collection, decks, match history, replays, ranked rating, league, season standings, in-game currency balances, and ledger entries. This data is necessary to provide ranked play, the card market, and the deterministic replay system.

Legal basis: Art. 6 (1) (b) GDPR (performance of contract).

To protect the integrity of Stellarch and its players, we process certain technical information about your device, browser, and connection, such as your IP address, general connection characteristics, and browser and device signals. We use this information to detect and prevent fraud, abuse of promotional offers, and unauthorized account activity, and to secure our authentication systems against automated attacks.

This processing is active whenever you use the Service. It is not an optional feature and cannot be switched off, because abuse detection that a person could decline would protect no one. We do not use this information for advertising and we do not share it with third parties for marketing purposes. It is held in separate records from our product-analytics data and no analytics query reads or joins it. The same durable device identifier is used for both purposes, so the two are technically linkable; each purpose has its own legal basis, its own records and its own retention period, and we do not build a combined profile from them. Our own product analytics is described in the section "Product Analytics (First-Party Measurement)".

Automated checks may flag activity for review. Any decision that significantly affects an account, such as a suspension or a ban, is made with human involvement, and you may contest it by writing to the contact address in this policy.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in operating a fair and secure service and in preventing fraud and abuse of the Service). Retention: raw device, connection, and interaction records are deleted automatically by a scheduled job, within twelve months at the latest. You may object to this processing under Art. 21 GDPR; we will then examine whether your interests override ours in your individual case.

To understand how Stellarch is used and to improve it, we operate our own analytics on our own servers. We record page views, a small set of named product events (for example starting a match, opening the card picker, or completing a purchase step), and a session record that groups those hits together. Each record carries the page or event name, a timestamp, your locale, and the durable device identifier described below. Where you are signed in, your account identifier is stored alongside it. We also process technical request metadata for these records: your IP address, an approximate location derived from it, and a coarse device and browser class taken from your browser's user agent. Where the link you arrived through carries campaign parameters or a referring page, we record those as well.

This measurement is active whenever you use the Service and is not offered as an optional feature. It uses the same durable device identifier we already set for security and fraud prevention (see "Fraud Prevention and Security"), so no second identifier is created for analytics. That identifier is stored in a first-party cookie on your device and expires after two years.

We do not sell this data, we do not share it with advertising networks, and we do not use it to build an advertising profile. It is stored only on our own servers and is not shared with any third party for their own purposes. Within Stellarch, access to it is restricted to administrators, and it is held in separate records from our fraud and security data, which no analytics query reads or joins.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in measuring and improving our own service). Retention: page view and event records are deleted automatically after 395 days at the latest, and session records after 790 days at the latest. You may object to this processing under Art. 21 GDPR by writing to the contact address in this policy; we will then examine whether your interests override ours in your individual case. Our internal assessment of this processing is documented and will be reviewed by qualified legal counsel before public launch.

Stellarch interacts with the public Hive blockchain and Hive Engine. Data written to the blockchain, including your Hive account name, wallet addresses, token transfers (SGC, STEL, HIVE, Hive Engine tokens), and certain on-chain game actions, is public, distributed, and immutable. It cannot be deleted or modified by us.

This means your GDPR right to erasure (Art. 17 GDPR) is technically limited for on-chain data: we can delete the personal data we hold in our own systems, but we cannot remove data that has already been written to the blockchain by you or by the network. By choosing to use blockchain features, you acknowledge this limitation. Where possible, we minimize the personal data we cause to be written on-chain.

We send transactional emails such as login one-time codes, security notices, and important account or purchase information. These are sent via our email/SMTP infrastructure.

Legal basis: Art. 6 (1) (b) GDPR (performance of contract) for transactional messages.

We use technically necessary cookies and local storage to keep you signed in, protect against cross-site request forgery, remember your preferences, and operate the game client. These are required for the Service to function.

Legal basis for technically necessary cookies: Art. 6 (1) (f) GDPR (legitimate interest in secure operation) and Section 25 (2) of the German Telecommunications-Digital-Services Data Protection Act (TDDDG).

Beyond those, we set one durable device identifier, in a first-party cookie, that serves both security and our own product analytics. It is described in the sections "Fraud Prevention and Security" and "Product Analytics (First-Party Measurement)", and it is not offered as an optional category. Google Analytics is optional and is loaded only after you give consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG; you can withdraw that consent at any time. Details are described in our Cookie Policy.

We share personal data only as necessary to operate the Service, with processors bound by data processing agreements. Categories of recipients include:

• Our hosting and infrastructure provider (server operation).
• Stripe (card payment processing).
• Google (Google sign-in, and Google Analytics where you have consented to it).
• Email/SMTP provider (transactional messages).
• The public Hive blockchain and Hive Engine (for blockchain features you use).

We do not sell your personal data.

Your data is primarily processed within the EU/EEA. Some processors (in particular Stripe and Google) may process data in the USA. Such transfers are safeguarded by EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR and/or the EU-US Data Privacy Framework. Blockchain data is, by nature, distributed across nodes worldwide.

We store personal data only as long as necessary for the respective purpose or as required by statutory retention periods:

• Account data: while your account is active; deleted within a reasonable period after account deletion, subject to legal retention duties.
• Server log files: short retention window, then deleted or anonymized.
• Product analytics: page view and event records for at most 395 days, session records for at most 790 days; all three are deleted automatically.
• Payment and accounting records: as required by German commercial and tax law (generally up to 10 years).
• On-chain data: permanent and outside our control (see "Blockchain Data and the Right to Erasure").
• Fraud prevention and security signals: raw device, connection, and interaction records are deleted automatically by a scheduled job, within twelve months at the latest. The summarized outcome of a review, and any moderation decision that resulted from it, are kept longer so that we can answer an appeal and avoid repeating an incorrect decision.

You have the following rights regarding your personal data:

1. Right of access (Art. 15 GDPR).
2. Right to rectification (Art. 16 GDPR).
3. Right to erasure (Art. 17 GDPR), subject to the blockchain limitation described above.
4. Right to restriction of processing (Art. 18 GDPR).
5. Right to data portability (Art. 20 GDPR).
6. Right to object (Art. 21 GDPR) to processing based on legitimate interests.
7. Right to withdraw consent (Art. 7 (3) GDPR) at any time, with effect for the future.
8. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

To exercise your rights, contact us at: mail@yixn.io

The competent supervisory authority for data protection is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestrasse 2-4
40213 Düsseldorf
Germany

Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de

You have the right to lodge a complaint with this authority about our processing of your personal data.

We use technical and organizational measures to protect your data, including TLS encryption for all transfers, hashing of secrets (such as PINs) rather than storing them in plain text, double-key encryption for sensitive key material where applicable, access controls, and regular security updates. No system is completely secure; please notify us immediately if you notice a security issue.

We may update this Privacy Policy from time to time to reflect changes in our processing or legal requirements. The date of the last update is shown at the top of this page. For significant changes, we may inform you separately.

For questions about the processing of your personal data or to exercise your rights, contact:

Daniel Samer
Am Alefskamp 50
47198 Duisburg
Germany

Email: mail@yixn.io
Phone: +49 15225669203

We will respond as soon as possible, and no later than one month in accordance with Art. 12 (3) GDPR.

This Privacy Policy is a working draft for the Stellarch alpha. For binding data-protection questions and before public launch, qualified German/EU legal advice should be obtained.