Privacy & cookies

Who is responsible?

Bruhtel is operated by M. Westerlund, the controller of personal data processed for this game. Contact: admin@bruhtel.com. The website is hosted by Hosting.com on servers in Amsterdam, Netherlands.

Account and game information

Registered accounts store a username, password hash, account status and an email address only if you choose to provide one. Email is optional at registration, including when saving a guest account. You can add or remove it in Account settings. Guest accounts use a guest identifier and access token instead of requiring an email address or password. Converting a guest account adds registration details to the existing account.

The game stores your operators, progress, transactions, activity and relevant account or moderation records so it can run consistently, prevent duplicate rewards and investigate errors or abuse. Operator names and Rep can appear in the in-game Highscore.

Purposes and legal bases

Where the GDPR applies, account access and gameplay information are processed to provide the game service you request (performance of a contract). Necessary security, abuse prevention and support processing rely on legitimate interests in protecting the service and its users, subject to your rights. Records required by applicable law are processed to meet that obligation. A gameplay preference or optional email verification is not blanket consent to unrelated uses of personal data.

Cookies and browser storage

A session cookie keeps you signed in. Guest play uses an additional access cookie to resume the guest account in the same browser. Blocking or clearing these cookies can sign you out or remove access to a guest account.

Browser session storage remembers recent HUD values for visual transitions. Account-linked display preferences, such as hiding the activity bar, are stored with the account. These features support the game interface.

Security and technical information

Technical information may be recorded while providing and securing the service. For example, guest creation uses a hash derived from the connection's IP address to limit repeated guest starts. Hosting infrastructure may keep access and error logs containing connection details.

Service providers and external links

We never sell your personal data or share it with advertisers. Your email is used for Bruhtel-related communication, such as requested verification codes and account support, not unrelated advertising.

Optional game reminders require a separate opt-in, including at registration. You can unsubscribe using the link in each reminder without signing in, or turn reminders off in Account settings. These reminders are separate from requested verification codes and essential account-security messages. Verification rewards do not depend on subscribing. Changing your email address turns reminders off until you choose to subscribe again.

Account email is sent through SendGrid. The interface loads Bootstrap resources from jsDelivr; requesting those resources shares normal connection information with that provider. Discord links open an external service, which handles your information under its own policies. The Discord symbol in our footer is hosted on Bruhtel itself.

Email delivery and CDN infrastructure can involve processing outside the EU/EEA even though the game server is in the Netherlands. Contact the controller for details of the applicable providers, processing locations and transfer safeguards. Joining Discord is optional.

Account details are used to operate and secure the game and handle account communication. Do not include passwords, verification codes or private access links in support messages.

Game reminder activity and measurement

We store the time of your latest authenticated game activity per account and operator to avoid sending reminders while you play. Automatic timer updates do not count as play, and this does not require recording a detailed click history. Optional reminders can start after three hours away and are limited to two per rolling 24 hours and five per rolling seven days.

For subscribed reminders we record the consent version, time and source, delivery status, estimated opens (using SendGrid's tracking image), content-link clicks and subsequent authenticated game activity. These records help us measure and improve the reminders. Email applications and security scanners may generate automatic opens or clicks. An email link does not sign you in. We process optional reminder sending and engagement measurement on the basis of your consent; withdrawal stops future reminders.

Detailed delivery-event records and stored message bodies expire after 90 days through the notification worker. Minimal subscription evidence, delivery counters and suppression records remain for preference enforcement, reporting and abuse prevention, subject to applicable erasure and retention requirements. No raw webhook payloads or full clickstream are retained. Contact us to exercise applicable rights over these records.

Keeping and managing information

Launch notifications and beta access

You may separately request an email when Bruhtel officially launches. We store your email address, confirmation and consent timestamps, consent wording version, and hashed confirmation and unsubscribe tokens. This launch-only subscription is optional, based on your consent, and separate from accounts and gameplay reminders. Confirming your address does not create an account. Each email provides a cancellation or unsubscribe link; you can also contact admin@bruhtel.com. We disable open and click tracking for launch confirmation emails and do not sell this list or share it with advertisers. Email is delivered through SendGrid.

Pending confirmation links expire after 24 hours. Unconfirmed requests become eligible for removal after seven days; cancelled records have their email removed immediately, with minimal hashed evidence eligible for removal after 30 days. Cleanup runs when the launch form or admin list is used; administrators can also run the documented cleanup command. Confirmed addresses are kept for the launch announcement unless you unsubscribe or request erasure. The list will be reviewed and removed after the launch announcement rather than reused for unrelated messages.

Beta invitation codes are stored as hashes for access checks and as encrypted copies so authorized administrators can retrieve and distribute them. Records include their label, expiry, use time and account association. We record the age confirmation attached to a redeemed beta code, without requesting a date of birth or identity document. Public signup and beta-access forms use hourly buckets derived from a hashed IP address to limit abuse. Expired buckets are cleared during subsequent form use. This security processing is based on legitimate interests in protecting the service.

Account and gameplay records are kept as needed to operate the game, maintain its history and investigate security or abuse issues. Browser-cookie expiry does not by itself mean that the related account or game records have been deleted.

Removing an email address clears it from the sign-in/contact record and cancels pending verification requests. Minimal one-time reward evidence, including a hash of an address that claimed a bonus, remains to prevent repeated claims. This hash is not treated as anonymous data. Address removal is separate from a request to erase personal data.

You can change your username, email address and password in account settings. Expiring a cookie, suspending an account or deleting gameplay access does not mean that every backup, security or support record has also been erased. Any continued retention needs a specific lawful purpose and must not last longer than necessary. Contact us for the retention and backup arrangements relevant to your request.

Your rights where GDPR applies

Depending on the processing and its legal basis, you may request access and a copy, rectification, erasure, restriction, or portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may complain to your competent data-protection authority and seek a judicial remedy. See the European Commission's guidance on your rights.

How to make a request

In Account settings, use Your data & privacy to download an account overview or submit a verified request. The overview is not a complete copy of every gameplay or technical record; choose Access / complete copy or Data portability when that is what you need. Requests for erasure or restriction are reviewed and are not automatically carried out when submitted.

You may also email admin@bruhtel.com, including as a guest, after a ban or without account access. Registration or optional email verification is not a condition for exercising applicable rights. We may ask for proportionate ownership verification; do not send identity documents unless specifically needed and requested through an appropriate channel.

Requests are normally handled free of charge, without undue delay and within one calendar month. If a lawful extension is needed, we will explain it within the initial month. If we cannot fulfil a request, we will explain the grounds and complaint options. Game-rule enforcement does not cancel these rights.