Privacy Policy

1. Controller

E-mail: dev@folgmannstudios.de, phone: +49 40 696328495 (management line, Mon to Fri 9:00 to 17:00 CET).

We have not appointed a data protection officer because we are not required to under Art. 37 GDPR. Send any privacy request to the e-mail address above.

2. Who this policy is for

IslePilot has two kinds of users, and we process different data for each.

Server operators and their staff sign in to the dashboard and manage a game server. Players use the public server pages and the overlay, and appear in the data that a game server sends us.

If you are a player, the operator of the server you play on decides which features are switched on and what happens with the data from their server. For that data the operator is the controller and we act as their processor. This policy describes what we do as a provider; your server operator may have their own rules on top.

3. Signing in with Discord (operators and staff)

When you sign in we receive from Discord your Discord user ID, your username, your avatar and, if you granted it, your e-mail address. We store this to create your account, to show who is in a server team and to send you notifications through our Discord bot.

Legal basis: Art. 6 (1) (b) GDPR, performance of the contract you enter into by using the service.

4. Signing in with Steam (players)

The public server pages and the overlay let you sign in through Steam OpenID. We receive your SteamID64 and your public Steam profile name and avatar. We use it to link you to your in game character, to show your own data back to you and to keep you signed in through a cookie named islepilot_player.

Legal basis: Art. 6 (1) (b) GDPR. We never receive your Steam password.

5. Data from game servers

A server running our plugin sends us data about what happens on it. Depending on the features the operator switched on, this includes:

• your SteamID64 and the name you play under
• your current character: species, growth, health, hunger, thirst, stamina, nutrients, mutations and position in the game world
• events such as joining, leaving, kills, deaths, nesting and similar in game actions
• data belonging to optional features: currency balances, quests, battle pass progress, garage slots, shop purchases, bets, tickets you open, warnings and bans an operator issues

Legal basis: Art. 6 (1) (b) GDPR towards the operator, and Art. 6 (1) (f) GDPR, our legitimate interest in providing a working management tool. Position and character data is what makes the live map, the overlay and the proximity features work at all.

6. Voice and proximity features

Where an operator uses our proximity features together with IsleVOIP, we pass your SteamID64 and your position to that service so it can decide who can hear whom. Voice audio itself does not run through IslePilot and is not recorded by us.

7. Server logs and security

Our web server records each request with the IP address, the time, the requested address, the response status, the amount of data sent and the user agent. We use this to run the service, to find faults and to defend against attacks and abuse.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in a secure and functioning service. Logs are rotated and removed on a rolling basis.

8. Cookies

We set only what the service needs to work. There is no advertising and no tracking across other websites.

• a session cookie for the dashboard, set when you sign in with Discord
• islepilot_player for the player login through Steam
• cookies our infrastructure provider sets to route and protect traffic

These are strictly necessary, so we rely on § 25 (2) TDDDG and do not ask for consent.

9. Who receives your data

We do not sell your data. We use the following providers, each bound by a data processing agreement or by their own controller responsibility:

• dataforest GmbH, Frankfurt am Main, Germany, for hosting our servers and databases
• Cloudflare, Inc. for protecting and delivering our websites
• Discord, Inc. for the login and for messages our bot sends into a server team's Discord
• Valve Corporation for the Steam login, when you choose to use it

Discord, Cloudflare and Valve are based in the United States. Where data reaches them, transfers are covered by the EU standard contractual clauses or by the EU-US Data Privacy Framework. Your game server operator can see the data from their own server in the dashboard.

10. How long we keep data

Account data stays while your account exists. Data about a game server and its players stays while the operator uses the service, because that is what the operator manages their community with. Server logs are kept for a short period for security and fault finding.

When an account is deleted we remove or anonymise the associated data within a reasonable period, unless we have to keep it longer by law.

11. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15)
• have inaccurate data corrected (Art. 16)
• have data erased (Art. 17)
• have processing restricted (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interest (Art. 21)
• withdraw a consent you gave, with effect for the future

Write to dev@folgmannstudios.de. If your request concerns data from a specific game server, we may have to pass it to the operator of that server, because they decide about it.

You can also complain to a supervisory authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information, or the authority where you live.

12. Children

The service is not directed at children under 16. If you are under 16, ask the person with parental responsibility before you sign in.

13. Changes

We update this policy when the service changes. The date at the top tells you which version you are reading.