Privacy notice
1. Controller and scope
Marvin Pascal Vohrer c/o SourceArt · VM-00003509 Fritz-Thiele-Straße 3 28279 Bremen-Obervieland Germany Email: service@avatarfight.online
This notice covers the homepage, browser game, wiki, community statistics and associated APIs at https://avatarfight.online/. It also covers technical requests when earlier project addresses redirect to this website. Updated: 22 October 2026.
This notice also applies to the Android app that displays this game in Android System WebView. It connects to the same game and authentication services. The app stores included and downloaded game assets, package metadata and WebView site data on your device. External sign-in and payment pages may open in your browser. Clearing app data or uninstalling removes local app data but does not close your server account or erase payment records.
2. Website, hosting and recipients
Our server receives your IP address and technical request data to deliver content, manage connections and detect errors or attacks. The basis is Article 6(1)(f) GDPR: our legitimate interest in a secure, available service.
We use Hostinger for hosting. The game server is in Düsseldorf, Germany. Recipients can include the operator, hosting provider and its subprocessors involved in operation, maintenance and security. We use Hostinger Email for contact messages; the game server location does not guarantee the location of all email storage or support access.
Hostinger operates internationally. Its published data processing addendum covers processing on customers' behalf, subprocessors and possible transfers outside the European Economic Area, including EU Standard Contractual Clauses as safeguards. The terms and safeguards are available at https://www.hostinger.com/legal/dpa; further provider information: https://www.hostinger.com/legal/privacy-policy. You can ask the operator for information about recipients used for your data and a copy of applicable safeguards. The server location alone does not exclude access from other countries.
Data is not sold. Further disclosure occurs where necessary to meet legal obligations (Article 6(1)(c) GDPR) or pursue or defend specific legal claims (Article 6(1)(f) GDPR).
3. Logs and abuse prevention
Access logs contain IP address, time, request method, URL path, protocol version, status, response size and browser identifier. Query parameters, cookies and referrers are excluded from this access-log format. Error and operational logs may contain technical connection data and information about failed operations.
Technical access, error and operational logs support delivery, troubleshooting and protection against attacks. Retention is bounded by the relevant rotation and size limits; these limits do not guarantee deletion after a fixed number of calendar days. Extracts needed for a specific security incident may be retained separately until it is resolved.
To prevent overload and sign-in attacks, we process IP addresses, account references, timestamps and counters. Depending on the service, rate-limit records are held in memory or in the authentication database. The end of a rate-limit window does not necessarily delete a database record. The basis is Article 6(1)(f) GDPR: our legitimate interest in protecting the service and accounts.
4. Accounts and game features
Password registration processes a login name, email address and password hash. We send emails for address verification, password recovery and security notifications. Verification links are valid for one hour; password-reset links for 15 minutes. Session management uses session identifiers, expiry times, IP addresses and browser identifiers. Game characters are linked to the account, together with progress, equipment, virtual currencies, battles, trades, guilds and other game actions. Optional profile information such as country or player sayings can be omitted.
We use this data to provide the account and game functions you request under Article 6(1)(b) GDPR. Without the data needed for a particular account or feature, we cannot provide it. Information pages require no game account. Optional details can be omitted.
Depending on the feature, other players can see player names, characters, public profile details, rankings, guild information and trade or battle results. World-channel posts are visible to its users; friends, wall and guild features show content to their respective audience. If you share a public battle replay, people with the link can view its player names, characters and battle data and forward the link. Private messages are intended for their participants. Do not publish confidential data. The operator can access stored content for technical delivery and specific support or abuse cases. There is no end-to-end encryption.
You can optionally link Discord, Twitch or X as a sign-in provider. The provider is contacted for this purpose when you start the corresponding sign-in or linking flow. We process the provider identifier, external account identifier, supplied profile information and email address where available, and access tokens to associate accounts and enable sign-in. OAuth tokens are stored encrypted in the authentication database. We do not receive your password for the provider. Our provision of the requested sign-in uses Article 6(1)(b) GDPR. Providers also process the request under their own terms; transfers to the USA and other countries are possible. Information about recipients, transfers, retention and rights: https://discord.com/privacy, https://www.twitch.tv/p/en/legal/privacy-notice/ and https://x.com/en/privacy. Manage links in account settings; unlinking does not delete your account with the provider.
5. Retention and deletion requests
Accounts, progress and related records are stored for continued game access. Accounts are not deleted automatically solely because of inactivity. In Accounts, Account, Delete Account you can request permanent deletion of the entire account and all active and archived profiles. After the warning, we send a single-use link to your verified account email. Within one hour, open the link and explicitly confirm deletion there. Only then is access blocked and deletion started. Interrupted processing is retried automatically. The process also works without installing the app at https://avatarfight.online/account-deletion/. For access problems contact service@avatarfight.online. Never send passwords or confirmation links.
Removing a message in the game may only hide it and does not necessarily erase all stored content. You can also submit a privacy deletion request for messages. Deletion must consider other participants' rights and necessary evidence in specific disputes or abuse cases. Where further retention is legally necessary, it is limited to the relevant purpose and duration and explained to you.
Backups support service recovery. Deletion requests also take existing backups and technically necessary retention into account; deletion from the running system does not mean immediate removal from every backup. Where data remains necessary for legal obligations or specific legal claims, its use is restricted to that purpose. Technical logs have separate retention limits.
6. Cookies, preferences and app storage
Sign-in uses protected session cookies (HttpOnly, SameSite=Lax, Secure under HTTPS) lasting up to 30 days to access the signed-in account. The locally stored account list contains account context, identifier, name, character, level, last use and sign-in status. It does not store account passwords.
Other local storage holds your language, sound preference and last selected account context. It has no automatic expiry and remains until replaced or site data is cleared. Session storage holds the tab's account context and pending game operations; its lifetime follows the browser session, including possible browser session restoration.
The installable web app stores program files, game graphics and package metadata in the browser cache and IndexedDB. It may request persistent browser storage for the app functionality you request; your browser determines availability. This supports reloading and displaying stored content, but not a complete offline game: accounts and progress remain on the server and game actions require a connection. The service worker does not cache game or sign-in API responses. App updates, the browser or clearing site data may remove local files. Privacy & storage explains local storage and how to request account erasure. Clearing local site data does not delete your server-side account.
Storage strictly necessary for the sign-in, preference and app functions you expressly request is based on section 25(2) no. 2 TDDDG. Subsequent personal data processing for these functions is based on Article 6(1)(b) GDPR.
Session storage also holds a technical connection identity or token for the direct game-database connection and the selected game context. These associate the connection with your game access, rather than advertising. Their lifetime follows the browser session, including possible browser session restoration.
Our own site functions use no advertising or analytics cookies. Optional X, YouTube, Facebook and RageZone embeds may access device storage after your consent. Our embedding relies on Article 6(1)(a) GDPR and section 25(1) TDDDG. You can disable each embed on the homepage; your choice applies only to that page visit.
Optional media on the homepage load only after your consent; use the disable control beside each embed to withdraw it. Stripe opens only when you request an enabled purchase. Clearing browser/app data may sign you out and remove downloaded assets and settings; it does not delete your server account, game progress or payment records. Contact service@avatarfight.online to request account erasure.
Public wiki: connection and storage
The public wiki at /wiki/ is part of the same website and hosting service as the game. No game account is required. Requests for articles, images and the live connection involve the technical request data and logs described above, on the same legal basis for secure delivery. Reading the wiki does not count as a game action in the community activity statistics.
The wiki receives public game catalog and reward information over a live connection to our game server. It does not publish private account data. The wiki does not retain connection identity tokens. Search terms and filters are processed in the current page, without sending them to a search or analytics service; opening an article makes a normal page request.
The language in the wiki URL is saved under avatar-fight-hd.locale in localStorage and shared with the game and legal pages. It remains until changed or website data is cleared; if storage is blocked, the current page still works. The wiki adds no advertising cookies or visitor analytics. Existing cookies for this website may accompany browser requests. Images and other public files may be held in browser caches, including caches from a previously installed game app. Clearing website data also affects shared game settings and downloaded files, but does not erase a server account.
Wiki articles are publicly accessible and may be indexed and copied by search engines. Source links open external websites only when followed; the wiki does not embed their media players. Currency purchase pages explain available offers; viewing them does not start a payment or contact Stripe.
7. Aggregate community statistics
Game profiles are grouped by their last successful game action: green for less than 20 minutes, orange-red from 20 minutes to under 12 hours, and grey for 12 hours or more. Profiles without a recorded action are included in the grey group. The groups do not overlap. Activity is counted separately for each profile, even when several profiles belong to the same login account. Page views, sign-in and automatic refreshes do not count as game activity. These are game profiles, not login accounts, individual people or continuously connected visitors.
The game database stores the latest successful action time against an internal game profile reference. This value survives server restarts and is replaced by the next successful action. Only aggregate counts are published on the website; the in-game friends list uses the activity status of the listed players. There are no visitor identifiers, statistics cookies or browser presence beacons.
The basis is Article 6(1)(f) GDPR, with our interest in a brief overview of community size and recent play. No visitor identifiers, device fingerprints, statistics cookies or browser presence beacons are used. General request logs remain separate. Details: /statistik/.
8. Contact messages
When you contact us, we process your sender address, message, any name and attachments, and technical email data to handle the request. Account support uses Article 6(1)(b) GDPR, privacy requests point (c), and other requests our legitimate interest in communication under point (f).
Retention follows the handling of the request and necessary follow-up. Evidence needed afterwards for legal obligations or specific legal claims is retained for that purpose and duration. No automatic mailbox deletion period is currently configured. Send only information needed for your request, never passwords or unsolicited identity-document copies.
9. External links and automated decisions
External links, including Discord, YouTube, Facebook and RageZone, lead to independent services. Opening a link sends technical request data to that provider, which processes it under its own privacy notice. Displaying a locally served link does not activate an embed. The optional embeds below require separate consent.
Optional YouTube video: The homepage loads the player from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, only after your explicit consent. Before that, the preview image and controls load exclusively from our server. Once enabled, Google receives IP address, browser/device information, referring website and video interactions; cookies and other device storage may be used. This provides video playback; Google also processes data for security, analytics and service improvement under its privacy notice. Data may be associated with your account depending on your settings. Our embedding and consent-based device access rely on Article 6(1)(a) GDPR and section 25(1) TDDDG. The rest of the website works without consent. Disable video / withdraw consent removes the player for the future, without affecting the lawfulness of earlier processing. We do not persist your choice; a new page visit requires consent again. Removing the player does not delete data already sent to Google or storage it has set. Recipients may include Google LLC and other Google companies; processing in the USA and other countries is possible. Transfer safeguards, retention, deletion and rights: https://policies.google.com/privacy and https://policies.google.com/privacy/frameworks . YouTube notice added 16 September 2026.
Our own site functions do not use visitor analytics or personalised advertising. Optional purchases are described in the Stripe section. Game rules calculate results automatically; they are not intended as decisions with legal or similarly significant effects under Article 22 GDPR.
Optional X posts: X content stays blocked until you select the consent control on the homepage. Loading sends IP address, browser/device information and interactions to X and may allow cookies or other device storage and processing outside the EEA, including the USA. Our embedding and consent-based device access rely on Article 6(1)(a) GDPR and section 25(1) TDDDG. Use Disable post / withdraw consent to remove the embed for the future. Your choice lasts for this page visit only; withdrawal does not erase information already received or cookies already set by X. You can use the rest of the website without loading the post. Recipient, transfer, retention and rights information: https://x.com/en/privacy.
10. Your rights
Subject to legal conditions, you can request access, correction, erasure, restriction and data portability. Contact service@avatarfight.online. Where there are reasonable doubts about identity, proportionate additional information may be needed to avoid disclosure to an unauthorised person.
Objection: You can object at any time to processing under Article 6(1)(f) GDPR on grounds related to your particular situation. We then assess whether compelling legitimate grounds or necessary legal claims justify continued processing. Where processing is based on consent, you can withdraw it for the future at any time without affecting earlier lawful processing.
We normally inform you about action on a rights request within one month. Any legally permitted extension and its reasons will be communicated within that period.
You can complain to a data protection authority, particularly where you live, work or believe an infringement occurred. The authority responsible for the operator is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany; postal address: Postfach 10 29 32, 70025 Stuttgart, Germany; email: poststelle@lfdi.bwl.de. Contact and complaints: https://www.baden-wuerttemberg.datenschutz.de/kontakt-aufnehmen/.
11. Younger players and updates
Use a player name and do not publish your private address or sensitive information. If you are a minor and do not understand this notice, discuss it with your parent or guardian. They can also contact the operator about your data. No advertising profiling of children is used.
This notice is updated when actual features or processing change. The date above identifies the information's current version.
Stripe payments for digital game content
Stripe Checkout is provided for optional purchases when payments are enabled. Visiting our homepage or opening the game does not load Stripe scripts or transmit data to Stripe for payment. Starting a purchase creates an order and opens a separate Stripe-hosted checkout page. Test or beta simulations without a real payment are identified as such.
We process account and character references, the selected offer, price, currency, order time, order and Stripe customer/session/payment identifiers, payment status, delivery, refunds and disputes. Purchase history and allocation of purchased virtual currency to game actions support delivery, reconciliation and support. This is account-related transaction processing, not anonymous visitor statistics.
Stripe receives the order amount, currency, product description and technical order/customer identifiers. You enter payment and any requested contact or billing details directly into Stripe Checkout. Stripe also processes device and connection information for payment security. Our game does not receive or store full card numbers or card security codes. Stripe and, where applicable, payment and selling partners involved in the selected sales route process the data required for the purchase. Available payment methods and the seller are shown before purchase completion. Managed Payments may involve a different arrangement from a direct sale by the game operator.
Processing necessary to perform your purchase is based on Article 6(1)(b) GDPR. Legally required records are based on Article 6(1)(c); fraud prevention, reconciliation and specific legal claims rely on Article 6(1)(f), with the legitimate interest of protecting accounts and reliably fulfilling purchases. Optional consent-based functions require separate consent where applicable.
For users in the EEA, Stripe Payments Europe, Limited, Ireland, and other Stripe entities and payment partners may receive data. Stripe acts as processor or independent controller depending on the purpose, including its own regulatory and fraud-prevention obligations. Processing outside the EEA is possible. Details of recipients, retention, rights and applicable transfer safeguards: https://stripe.com/privacy, https://stripe.com/legal/dpa and https://stripe.com/de/legal/dta.
Transaction records remain available while needed for fulfillment, support, refunds and applicable statutory recordkeeping or specific legal claims. Gameplay resets do not erase payment records. A privacy erasure request is assessed separately; records that must be retained are restricted to their required purposes. Contact service@avatarfight.online for an account-specific retention explanation.
Closed beta through Google Groups
You can join Avatar Fight HD Beta at https://groups.google.com/g/avatar-fight-hd-beta yourself. Use the same Google account as in Google Play, then opt in through the Play test link. No individual invitation is needed. Google processes your account information, membership and technical access data. As group owner we can see your membership email address, display name and membership status. Other participants cannot view the member list or your email address. The group manages test eligibility and is not used for advertising.
Our administration of necessary membership data provides the testing access you request under Article 6(1)(b) GDPR. Membership lasts until you leave or test eligibility is no longer needed. We remove unnecessary memberships after the test ends and do not keep an additional exported address list. Google processes data under its own terms and retention rules, including possible processing outside the EEA. Recipients, transfers and rights: https://policies.google.com/privacy and https://policies.google.com/privacy/frameworks.
Leave through Google Groups or email avatar-fight-hd-beta+unsubscribe@googlegroups.com from your membership address. Disabling group emails alone does not end membership. Leave the Play test through its test link. Deleting your game account does not automatically end this separate Google membership. For questions or removal by us, contact service@avatarfight.online.
Google Play purchases
In the Google Play version of the Android app, enabled digital purchases use Google Play. Google displays the available item and localized price before confirmation. We process product, order and purchase identifiers, purchase status and opaque account and profile bindings to verify purchases, deliver content, handle refunds and prevent duplicate credits. Purchase receipts are verified with Google on the server. Our game does not receive full card numbers or card security codes. Google processes payments and associated data under its own notices: https://policies.google.com/privacy. Browser purchases may continue to use Stripe.
Community and account deletion
Community rules must be accepted before creating a profile and before further community writes. We store the accepted version and time. Reports contain selected content, a reason, optional details and the account and content references needed for review. Access is restricted to authorized moderators. Reports do not automatically ban anyone. Moderators can remove content and mute messaging for 24 hours. Report evidence and related review records are deleted after 90 days.
Account deletion removes login credentials, linked sign-in methods, owned game profiles and personal game data. Shared game histories are retained without the original account references. A guild remains and passes to an eligible member or a guild bot. Reduced payment receipts remain without original account and profile links for reconciliation and required evidence. Specific content already reported remains private until its original 90-day deadline. Account deletion does not extend that deadline. This process does not delete accounts with Google, Stripe or an external sign-in provider.
Profile archive and server migration
For the public launch, no more than five profiles per account remain active: the existing main profile and the four oldest other profiles, or the five oldest profiles when no main profile is set. Additional profiles are stored in the archive. The exchange period ends 30 days after the actual public opening. Archived profiles concerned are then removed through the deletion process; the account and its active profiles are unaffected. Legally required payment evidence is handled separately. This processing provides and administers the agreed game functions under Article 6(1)(b) GDPR.
During server migration, additional backups and a frozen data copy remain on the previous server. These copies are used only for recovery and migration checks, not for a second active game service. Deletion in the current system does not immediately remove data from every copy. Later deletions must be respected before restoring a copy, and copies no longer needed must be removed.
Purchase confirmations and withdrawal
For purchases I record the declaration of being at least 18, the accepted wording and time, and separate statements about immediate provision and possible loss of the withdrawal right. This is a self-declaration, not an identity-document age check. Contract information is stored with the order and confirmed by email. Electronic withdrawal processing uses name, email, contract reference, receipt time and handling status to receive the declaration and acknowledge it. Legal bases are GDPR Article 6(1)(b) and (c), and (f) where necessary for specific legal claims. Retention and access depend on fulfilment, legal duties and concrete legal claims.
Browser security reports
To detect unsafe scripts and security-policy compatibility problems, your browser may send technical Content Security Policy (CSP) reports to our own server. Reports can contain page and resource URLs, browser information and, during transmission, your IP address. We do not request code samples. The collector discards these details and keeps only counts by violation category, without account identifiers or user profiles. Cookies and identifying request headers are not forwarded to the collector; its access and error logging is disabled.
These aggregate counts remain only in server memory for up to 24 hours and disappear on restart. Reports are not sent to an external analytics service and this feature sets no additional cookies or tracking identifiers. Processing serves our legitimate interest in protecting the service and accounts under Article 6(1)(f) GDPR. The hosting recipients and your rights described elsewhere in this notice also apply. Added: 3 October 2026.
Optional Facebook post
The homepage can display a Facebook post provided by Meta Platforms Ireland Limited. We load the iframe only after you select Load Facebook and consent. Until then, this embed makes no requests to Facebook; its placeholder and controls are served locally. Using the rest of this website does not require consent.
Once activated, Meta receives your IP address, browser/device information and interactions with the post. Facebook may read or set cookies and other device storage and associate information with your Facebook account. Processing may include delivery, security, analytics and advertising under Meta's policies, including processing in the USA and other countries. Our embedding and consent-based device access rely on Article 6(1)(a) GDPR and section 25(1) TDDDG.
Disable post / withdraw consent removes the iframe and stops further loading through this embed. Withdrawal does not affect the lawfulness of earlier processing or delete data already sent to Meta or cookies it has set. We do not persist this consent; a new page visit requires a new choice. Meta controls its retention and further processing. Information about recipients, transfers, retention, cookies and your rights: https://www.facebook.com/privacy/policy/ and https://www.facebook.com/policies/cookies/ . Facebook notice added 18 September 2026.
Optional RageZone thread
The homepage offers an optional embedded RageZone forum thread. No RageZone connection is made through this embed before you click Load RageZone and consent. Loading sends your IP address, browser information and interactions to the forum provider; the provider may store or read cookies and other device information. The embed loads the thread directly from forum.ragezone.com in a separate frame.
Your choice lasts only for the current page visit. Disable thread / withdraw consent removes the frame and its scripts. This does not undo data transfers or delete cookies already set by the provider. You can instead use the direct link, which opens RageZone as a separate website. Provider privacy information: https://forum.ragezone.com/help/privacy-policy/
Loading displays the selected forum thread. Our embedding and consent-based device access rely on Article 6(1)(a) GDPR and section 25(1) TDDDG. The rest of the website remains usable without consent. Further processing, recipients, retention and possible transfers outside the European Economic Area are governed by the forum provider’s notice; we do not promise storage exclusively within the EU.