Privacy notice
1. Controller and scope
Marvin Vohrer Wilhelmstraße 60 72805 Lichtenstein Germany Email: support@avatarfight.cloud
This notice covers the homepage, browser game, wiki pages and associated APIs on avatarfight.cloud and the additional access through gg.exposed. Updated: 6 September 2026.
2. Website, hosting and recipients
Our server receives your IP address and technical request data to deliver content, manage connections and detect errors or attacks. The basis is Article 6(1)(f) GDPR: our legitimate interest in a secure, available service.
We use Hostinger for hosting. The game server is in Frankfurt am Main, Germany. Recipients can include the operator, hosting provider and its subprocessors involved in operation, maintenance and security. We use Hostinger Email for contact messages; the game server location does not guarantee the location of all email storage or support access.
Hostinger operates internationally. Its published data processing addendum covers processing on customers' behalf, subprocessors and possible transfers outside the European Economic Area, including EU Standard Contractual Clauses as safeguards. The terms and safeguards are available at https://www.hostinger.com/legal/dpa; further provider information: https://www.hostinger.com/legal/privacy-policy. You can ask the operator for information about recipients used for your data and a copy of applicable safeguards. The server location alone does not exclude access from other countries.
Data is not sold. Further disclosure occurs where necessary to meet legal obligations (Article 6(1)(c) GDPR) or pursue or defend specific legal claims (Article 6(1)(f) GDPR).
3. Logs and abuse prevention
Access logs contain IP address, time, request method, URL path, protocol version, status, response size and browser identifier. Query parameters, cookies and referrers are excluded from this access-log format. Error and operational logs may contain technical connection data and information about failed operations.
Non-empty access and error logs rotate daily, retaining the current file and up to 14 rotated files. Empty files do not rotate, so this does not guarantee deletion after 14 calendar days. Container logs are overwritten at size limits; the game adapter retains up to three files of 10 MB each. Actual retention depends on log volume. There is currently no additional calendar-based deletion for these technical logs.
Requests are temporarily limited using IP address, account reference or session to counter overload and sign-in attacks. These counters remain in memory and are cleaned after their respective rate-limit windows. Server administration also has protection against repeated failed sign-ins. The basis is Article 6(1)(f) GDPR, with the legitimate interest of protecting the service and game accounts.
4. Accounts and game features
For registration we process the chosen account name, authentication data and character. Use creates account identifiers, progress, equipment, virtual currencies, battles, trades, guild membership and other actions you initiate. Email is not required for registration. Optional profile details may include email, country and player sayings.
We use this data to provide the account and game functions you request under Article 6(1)(b) GDPR. Without the data needed for a particular account or feature, we cannot provide it. Information pages require no game account. Optional details can be omitted.
Player names, characters, publicly intended profile details, rankings, guild information and game trade or battle results may be shown to other players. Do not publish confidential data there. Private messages are intended for their participants, and guild or discussion posts for the relevant audience. The operator can access stored content for technical provision and specific support or abuse cases. There is no end-to-end encryption.
5. Retention and deletion requests
Accounts, progress and related records are stored for continued game access. Accounts are not currently deleted automatically solely because of inactivity. To close an account and request deletion, write to support@avatarfight.cloud with the account name, but no password. Requests are handled after checking account ownership and legal conditions; no button provides automatic complete account erasure.
Removing a message in the game may only hide it and does not necessarily erase all stored content. You can also submit a privacy deletion request for messages. Deletion must consider other participants' rights and necessary evidence in specific disputes or abuse cases. Where further retention is legally necessary, it is limited to the relevant purpose and duration and explained to you.
The separate log limits above apply. Administratively created backups support recovery from failed changes. Retention depends on whether a copy is still needed to validate or roll back the relevant change, or as evidence for a specific unresolved incident. Once the change is successfully checked and that specific need ends, copies containing personal data must be deleted. This review and deletion is manual; there is currently no uniform automated deletion cycle. Existing backup copies therefore also need consideration when handling deletion; removal from the running system does not guarantee immediate removal from every backup. Regular complete database backups with a tested recovery procedure are not yet configured.
6. Cookies, preferences and app storage
Sign-in uses protected session cookies (HttpOnly, SameSite=Lax, Secure under HTTPS) lasting up to 30 days to access the signed-in account. The locally stored account list contains account context, identifier, name, character, level, last use and sign-in status. It does not store account passwords.
Other local storage holds your language, sound preference and last selected account context. It has no automatic expiry and remains until replaced or site data is cleared. Session storage holds the tab's account context and pending game operations; its lifetime follows the browser session, including possible browser session restoration.
The installable web app caches program files and game graphics for loading and offline display. The service worker does not cache game or sign-in API responses. Files are removed by app updates, the browser or clearing site data. Clearing browser data can sign you out and remove preferences, but does not delete your server-side account.
Storage strictly necessary for the sign-in, preference and app functions you expressly request is based on section 25(2) no. 2 TDDDG. Subsequent personal data processing for these functions is based on Article 6(1)(b) GDPR. No advertising or analytics cookies are used.
7. Aggregate community statistics
Public figures show registered accounts and distinct accounts with a successful game action in the last five minutes. Accounts do not count individual people. Page views, sign-in and automatic refreshes are not game actions.
The activity counter stores only in memory an account reference pseudonymised with a secret key and the last action time. Entries expire after five minutes and are cleaned every 30 seconds, so retention is at most approximately five minutes and 30 seconds. A restart clears the counter. Only totals are public; internal pseudonymisation does not make account data anonymous.
The basis is Article 6(1)(f) GDPR, with our interest in a brief overview of community size and recent play. No visitor identifiers, device fingerprints, statistics cookies or browser presence beacons are used. General request logs remain separate. Details: /statistik/.
8. Contact messages
When you contact us, we process your sender address, message, any name and attachments, and technical email data to handle the request. Account support uses Article 6(1)(b) GDPR, privacy requests point (c), and other requests our legitimate interest in communication under point (f).
Retention follows the handling of the request and necessary follow-up. Evidence needed afterwards for legal obligations or specific legal claims is retained for that purpose and duration. No automatic mailbox deletion period is currently configured. Send only information needed for your request, never passwords or unsolicited identity-document copies.
9. External links and automated decisions
Normal website and browser-game images, fonts and programs load from our own server. Discord, YouTube and Internet Archive are links; opening one connects to that provider, whose privacy notice then applies. The technical APK reference using CheerpJ is blocked from public access and is not part of the publicly offered game.
The project uses no visitor analytics, personalised advertising or real payment features. Game rules calculate results automatically; this is not intended to make solely automated decisions with legal or similarly significant effects under Article 22 GDPR.
10. Your rights
Subject to legal conditions, you can request access, correction, erasure, restriction and data portability. Contact support@avatarfight.cloud or the postal address above. Where there are reasonable doubts about identity, proportionate additional information may be needed to avoid disclosure to an unauthorised person.
Objection: You can object at any time to processing under Article 6(1)(f) GDPR on grounds related to your particular situation. We then assess whether compelling legitimate grounds or necessary legal claims justify continued processing. Where processing is based on consent, you can withdraw it for the future at any time without affecting earlier lawful processing.
We normally inform you about action on a rights request within one month. Any legally permitted extension and its reasons will be communicated within that period.
You can complain to a data protection authority, particularly where you live, work or believe an infringement occurred. The authority responsible for the operator is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany; postal address: Postfach 10 29 32, 70025 Stuttgart, Germany; email: poststelle@lfdi.bwl.de. Contact and complaints: https://www.baden-wuerttemberg.datenschutz.de/kontakt-aufnehmen/.
11. Younger players and updates
Use a player name and do not publish your private address or sensitive information. If you are a minor and do not understand this notice, discuss it with your parent or guardian. They can also contact the operator about your data. No advertising profiling of children is used.
This notice is updated when actual features or processing change. The date above identifies the information's current version.