PRIVACY POLICY

Information pursuant to Art. 13 GDPR

1. Controller

The controller responsible for data processing on this website is:
Richard Rutsatz
Dr.-Otto-Meyer-Str. 42 1/2, 86169 Augsburg, Germany
E-mail: contact@novasiege.de
Further details in the Imprint.

2. Overview — what data and when

Nova Siege is a browser tower-defense game. It can be played entirely without an account and without providing personal data. We only process personal data if you voluntarily register to take part in the global leaderboard, or if you use the online multiplayer mode.

3. User account (registration & login)

When you create an account, we process:

• E-mail address — for login and to uniquely identify the account.
• Username — shown publicly on the leaderboard.
• Password — stored only as a cryptographic hash (bcrypt), never in plain text.
• Registration time.

Legal basis: Art. 6(1)(b) GDPR (providing the account/leaderboard function you requested).

4. Leaderboard

When daily challenges are completed, your username, score, wave and timestamp are transmitted to the server and stored in order to display the leaderboard. The username is publicly visible. Legal basis: Art. 6(1)(b) GDPR.

5. Online multiplayer mode

For co-op/versus, a real-time connection (WebSocket) to the server is established. Game state (e.g. towers, enemies, waves) is relayed between the two players. This game data is processed only transiently in memory and is not stored permanently. Legal basis: Art. 6(1)(b) GDPR.

6. Contacting us by e-mail

If you contact us by e-mail (e.g. at contact@novasiege.de), we process your e-mail address and the content of your message solely in order to handle your request. The legal basis is Art. 6(1)(b) GDPR (for usage-/contract-related requests) or Art. 6(1)(f) GDPR (legitimate interest in answering your enquiry). The data is deleted once your request has been dealt with and no statutory retention obligations apply.

7. Server log files

When the server is accessed, our hosting provider processes technically necessary connection data (incl. IP address, time, requested resource) in order to ensure operation and security. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable, secure service).

8. Storage in the browser (localStorage)

Settings, local high scores, achievements, tutorial progress and — after login — your login token are stored in your browser (localStorage). This storage is technically necessary for the functions you use (§ 25(2)(2) TDDDG) and therefore does not require separate consent. We do not run any advertising; audience measurement with Google Analytics happens only with your consent (see section 9).

9. Google Analytics (only with your consent)

On this website we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics is loaded only after you consent via the cookie banner (Google Consent Mode v2 — without consent, no cookies are set and no data is transmitted to Google).

• Purpose: anonymous statistics about how the game is used (e.g. page views, approximate region, browser used).
• Cookies: Google Analytics sets cookies (incl. _ga, _ga_*) with a lifetime of up to 2 years.
• IP anonymization: In Google Analytics 4, IP addresses are not logged or stored by default; evaluation is truncated/anonymized.
• Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent).
• Third-country transfer: A transfer to Google LLC (USA) cannot be ruled out. Google is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses (Art. 46 GDPR) apply in addition.
• Withdrawal: You can withdraw your consent at any time with effect for the future — in the game menu under "🍪 Cookie settings". Analytics cookies that were already set are deleted in the process.

More information: Google Privacy Policy.

10. Recipients / processors

• Hosting of the server and game files: Render, Inc., San Francisco, USA — operated in the Frankfurt region (EU). A data processing agreement (Art. 28 GDPR) is in place. As this is a US company, the transfer is based on the EU Standard Contractual Clauses (Art. 46 GDPR).
• Domain management and e-mail hosting: STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The domain novasiege.de and the contact mailbox (contact@novasiege.de) run via STRATO.

We do not sell or share your data for advertising purposes.

11. Retention period

• Account data is stored until you delete your account (see section 13).
• Leaderboard entries remain until the account is deleted.
• Server logs are retained by the host only for a short period.

12. Your rights

Under the GDPR you have the following rights:

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection (Art. 21)
• Complaint to a supervisory authority (Art. 77).

To exercise them, a simple e-mail to contact@novasiege.de is sufficient.

13. Deleting your account and data

You can delete your account and all associated scores at any time, irreversibly: in the game under Daily Challenge → (logged in) → "DELETE ACCOUNT". Alternatively, send us an e-mail and we will delete your account manually.

14. CrazyGames version (only relevant there)

If the game is played via the CrazyGames platform, their SDK may display ads and collect analytics/gameplay data controlled by CrazyGames; logging in there uses your CrazyGames account. The CrazyGames Privacy Policy then applies. This does not occur on the self-hosted website described here.

Last updated: July 2026