Situation room
InfectUs on Discord InfectUs on X

Data Protection · GDPR / DSGVO

Privacy Policy

How we handle personal data on infectus.io. Compliant with the EU General Data Protection Regulation (GDPR/DSGVO) and the Austrian Data Protection Act (DSG). Last updated: 16 October 2026.

1. Controller

The controller responsible for personal data processed on this website within the meaning of Art. 4 No. 7 GDPR is:

ODY Technologies e.U.

Oliver Greil, sole proprietor

c/o RA Matutis

Fürstenstraße 5

5400 Hallein

Austria, European Union

contact@odytechnologies.com

Full legal disclosure: Imprint.

2. Scope

This policy applies to infectus.io. The website is a pre-launch teaser for the game InfectUs. There are no user accounts, forms, comments, or analytics on this site. The only personal data processed is the technical request data that is automatically generated by visiting any website on the public internet.

The game is in a test phase. Sections 6 to 11 describe its chat, mottos, reports, moderation, rankings and swarms, how we keep the game fair, what happens to guest players, purchases in the shop, and the services the game uses (hosting, map, search, bot check, emails). Before the game opens to the public, we will extend this policy to cover the rest of it (accounts, game data, push notifications).

3. Hosting & Server Logs

This website is hosted on Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you load any page, Cloudflare's edge servers automatically receive standard web request data:

  • your IP address (used to route the response and detect abuse);
  • the URL you requested and the HTTP referrer (if any);
  • your browser's User-Agent string;
  • the date and time of the request.

Live numbers. The start page loads the figures of its world map (infestation per place) about once a minute from the server of the game (play.infectus.io, Section 11), which receives the same request data, without cookies. If you select a place or a country on the map, it also loads the top of its rankings (Section 6).

Purpose. To deliver the website, protect against DDoS and abuse, and maintain technical operations.

Legal basis. Legitimate interest in operating a secure and reliable website (Art. 6 (1) (f) GDPR).

Retention. Cloudflare typically retains edge access logs for a short rolling window (days, not months) for security and operational purposes. See Cloudflare's privacy policy for the current schedule.

International transfer. Cloudflare is a US-based provider with servers worldwide, including in the EU. Transfers to the United States are covered by the EU-U.S. Data Privacy Framework (Cloudflare is certified) and supplementary Standard Contractual Clauses where applicable.

4. No Third-Party Content

All fonts, images, and scripts on this website are served from our own host. We do not embed Google Fonts, content delivery networks, social media plugins, videos, or maps from other providers, so visiting this website does not make your browser contact any third party.

5. Cookies & Tracking

This website does not set any cookies and uses no tracking, analytics, or advertising pixels. If you switch the language manually, we store your choice in your browser's localStorage under infectus.lang, so the language persists across pages. This value never leaves your browser, and you can delete it at any time in your browser settings. It is strictly necessary to provide the language setting you requested (§ 165 (3) TKG 2021).

6. The Game: Chat, Moderation & Rankings

  • Chat messages (text, reactions, the cell of your hotspot, time) are stored for 30 days and shown to the players of the channel. A message you delete disappears for everyone at once; we keep its text for 7 more days so that reports about it can still be checked.
  • Channels follow your hotspot: we derive its town, region and country from the position of your hotspot (place data from OpenStreetMap via Overture Maps and from GeoNames), never from the location of your device.
  • Mottos are shown to everyone above your hotspots for as long as you keep them.
  • Mentions: if someone mentions you while you are not in the game, we send you a push notification, provided you have switched notifications on.
  • Reports: we store who reported what, the reason and the optional note. Reported content is kept until we have decided and then for 6 months as evidence.
  • Moderation: measures (warnings, mutes, chat blocks, game suspensions) with rule, reason and duration, the notices we send you, and a log of all moderation actions are kept as the record of our decisions (Art. 17 DSA), also after an account is deleted. They refer only to the player number.
  • Block list: if a suspended player deletes their account, we keep a one-way hash of their email address and linked logins (Google, Steam) for as long as the suspension would have lasted, so that the same ways in cannot be used to come straight back. We do not keep the address itself.
  • Rankings are public: your player name and your infestation per place and season. Past seasons are kept as an archive. The world map on infectus.io shows the top of each place's rankings, viruses and swarms, with name, color and infestation.

Legal basis. Providing the game you signed up for (Art. 6 (1) (b) GDPR); for reports, moderation, evidence and the block list, our legal obligations under the Digital Services Act and our legitimate interest in a safe game (Art. 6 (1) (c) and (f) GDPR).

Deleting your account deletes your messages, reactions, read markers, mute lists, mottos, reports and notices, except messages with open reports, which stay until we have decided.

7. The Game: Swarms

  • Membership: we store that you are a member, since when and who brought you in. Everyone can see a swarm's pinboard: its name and motto, its members with their names, viruses, territory and game statistics, who brought whom in, and the swarm's rankings.
  • Only members see who is online or still a guest, who supplies whom, invitations, help calls and the swarm chat (Section 6 applies to it); new help calls reach them as push notifications if they have switched notifications on.
  • Invitations and requests are kept for at most 7 days. Whoever opens your invite link sees your name, your virus and your swarm; if someone new joins the game through it, we store that you invited them.

Legal basis. Providing the game you signed up for (Art. 6 (1) (b) GDPR).

Leaving the swarm or deleting your account takes you off the pinboard; deleting your account also deletes your invitations, invite code, help calls and the record of who invited whom.

8. The Game: Fair Play and Security

To protect the game against cheating and abuse, in particular with several accounts, we process the following data:

  • Security cookie: a random identifier in a cookie of its own (one year).
  • Network: the IP address of your connection.
  • Usage data: the kind and number of your game actions (never their content) and the viruses your hotspots produce and send to other players.

If these data point to a breach of our Terms, a person reviews it and decides on any measure. Measures reach you as a notice with rule and reason (Section 6).

Purpose and legal basis. Security and a fair game for all players, our legitimate interest (Art. 6 (1) (f) GDPR). We consider the security cookie strictly necessary to provide a secure game (§ 165 (3) TKG 2021).

Retention. 30 days, and at once when you delete your account. Reviews of suspected breaches are kept until they are decided and then for 6 months as evidence; they refer only to player numbers. If you delete your account, we also delete the cases you were part of.

Game events. Our server notes what happens in the game, with the time, the cells concerned and the player numbers involved: hotspots placed and lost, veins built and cut, cells taken, cards played and found, purchases credited. We use this record only to trace errors, suspected breaches and complaints, our legitimate interest (Art. 6 (1) (f) GDPR), and delete it after 30 days, and at once when you delete your account.

Server logs. When something goes wrong in the game, our server records what happened: the time, the kind of error and where in our code it occurred, the address requested within the game and the player number concerned, never email addresses. We use these records only to run the game and fix errors, our legitimate interest (Art. 6 (1) (f) GDPR), and delete warnings and errors after 30 days. The server's running output is overwritten continuously once it reaches a fixed size.

9. The Game: Guests and Breaks

You can start playing as a guest, without an account, for as long as you like; your player is then tied to this browser. If you do not open the game for 7 days, your territory withers under the normal game rules and we then delete your guest player together with all data belonging to it, as when an account is deleted. A day and an hour before, we remind you by push notification if you have switched notifications on. A guest who never placed a hotspot is deleted after 3 hours without a visit. Once you secure your virus with an account (a confirmed email address, Google or Steam), the rules for breaks below apply instead.

Breaks. We store when you last opened the game, for as long as your player exists. If you do not open it for 21 days, your territory on the map withers under the normal game rules; your account and everything else remain. 3 days and 1 day before, we remind you by push notification if you have switched notifications on, and by email to the address of your account or of your Google account.

Legal basis. Providing the game you signed up for (Art. 6(1)(b) GDPR).

10. The Game: Purchases and Payments (Stripe)

If you buy Spores in the game, the payment is processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). The payment form comes from Stripe and is shown inside the game. Stripe receives the data it needs to take the payment and to meet its own legal obligations:

  • your payment details (card, PayPal, Klarna, EPS, Apple Pay, Google Pay or Link);
  • your name and billing address, as far as the payment method requires them;
  • your email address for the receipt;
  • your IP address and device and browser data, which Stripe uses to prevent fraud;
  • the amount, the currency and our order reference.

We never see or store your payment details. They are entered directly into fields hosted by Stripe and never reach our servers. We keep an order record: your player number, the pack, the Spores and the price, when you ordered and paid, Stripe's references for the checkout and the payment, the email address for your purchase confirmation, your request for immediate delivery with the acknowledgement that you lose your right of withdrawal (time, language and version of the wording), and a log of what happened to the order (paid, credited, refunds, chargebacks). Spores you buy and spend are recorded on your account like the ones you earn.

Purchase confirmation. We email you a confirmation with the order details and your waiver of the right of withdrawal, to the address entered at checkout or that of your account.

Purpose. To process your purchase, credit your Spores and confirm it to you, to handle refunds and chargebacks, to prevent fraud, and to meet accounting and tax obligations.

Legal basis. Performance of a contract (Art. 6 (1) (b) GDPR) for the purchase and its confirmation; legal obligation (Art. 6 (1) (c) GDPR) for keeping accounting records; legitimate interest (Art. 6 (1) (f) GDPR) for fraud prevention and handling chargebacks.

Stripe's role. Stripe acts as our processor for handling the payment and as an independent controller for fraud prevention and its own regulatory duties, described in the Stripe Privacy Policy. If you pay with Link, Stripe's service for saving payment details, your Link account is held directly with Stripe, which is the controller for it.

International transfers. Stripe Payments Europe is based in Ireland; data may be transferred to Stripe, Inc. in the United States under the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses.

Retention. Order records are kept for the statutory retention period under Austrian tax law (currently seven years, § 132 BAO), also after an account is deleted. Stripe applies its own retention periods to the payment data it holds.

11. The Game: Hosting, Map, Search, Bot Check and Emails

To run the game, we and your browser use the following services. Each receives only what it needs for its task.

  • Hosting: the game runs on our own server at Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in a data center in the EU; our backups are kept at Hetzner as well. Requests reach the server through Cloudflare's network (Cloudflare Tunnel, Cloudflare, Inc., Section 3), which receives the same request data as for this website. Our web server notes each request with your IP address, the time, the address requested within the game without its parameters, and the status, size and duration of the answer, in a log of fixed size that is overwritten continuously.
  • Map and search: the map (map tiles, fonts and symbols) and the search for places come from our own server. The map data is from OpenStreetMap (prepared by OpenFreeMap), place names also from Overture Maps and GeoNames; no other provider learns which part of the map you look at. When you type into the search, your browser sends the search text, the language of the game and the approximate centre of the map to our server, which answers from its own index and does not keep the search.
  • Bot check: when you create your player, when we send a code to your email address (securing your virus, adding or changing an address, resetting a password) and after several wrong attempts at signing in or entering a transfer code, the game asks Cloudflare Turnstile (Cloudflare, Inc.) whether a person or a program is at work. Turnstile receives your IP address, your browser's User-Agent string and technical characteristics of your connection (Turnstile Privacy Addendum). Cloudflare acts as our processor for the check and as an independent controller for improving its bot detection.
  • Emails from the game (codes, reminders, purchase confirmations) are sent via SMTP2GO (Sand Dune Mail Ltd, 96-106 Manchester Street, Christchurch 8011, New Zealand), which receives your email address and the message and keeps its headers for 35 days. SMTP2GO stores personal data of users in the EEA within the EEA.

Purpose and legal basis. Providing the game you signed up for (Art. 6 (1) (b) GDPR) and our legitimate interest in a secure and reliable game that is protected against automated abuse (Art. 6 (1) (f) GDPR).

Roles. Hetzner, Cloudflare and SMTP2GO process the data on our behalf.

International transfers. For Cloudflare, Section 3 applies. For New Zealand, where SMTP2GO is based, the European Commission has issued an adequacy decision.

Retention. Our access log as described above; the services apply their own retention periods.

12. Your Rights

Under the GDPR you have the following rights regarding your personal data:

  • Right of access (Art. 15): confirmation of whether we process your data and a copy of it.
  • Right to rectification (Art. 16): correction of inaccurate data.
  • Right to erasure (Art. 17): deletion of your data, also known as the "right to be forgotten".
  • Right to restriction (Art. 18): pause processing in disputed cases.
  • Right to data portability (Art. 20): receive your data in a machine-readable format.
  • Right to object (Art. 21): object to processing based on legitimate interest.
  • Right to withdraw consent (Art. 7 (3)): without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email contact@odytechnologies.com. We will respond within one month.

13. Right to Lodge a Complaint

If you believe our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. The competent authority for us is the Austrian Data Protection Authority (Datenschutzbehörde):

Österreichische Datenschutzbehörde

Barichgasse 40-42

1030 Wien, Österreich

www.dsb.gv.at

14. Automated Decision-Making

We do not make decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR. Automated checks for fair play (Section 8) only point out possible breaches; a person reviews them and decides on any measure.

15. Children

The upcoming game is intended for users aged 16 and over. This website does not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will delete it.

16. Changes to This Policy

We will update this policy as the game evolves and new processing comes online (game client, accounts, game data). Material changes will be announced on this website before they take effect.

BUILD 2026-10 ALPHA V0.8.1190 · #e524fb86