Privacy policy

This policy explains which personal data skin-rng (skin-rng.com) processes, why, and which rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

Valentin Wagner, Valentin Wagner IT-Engineering, Otto-Franke-Straße 40, 06485 Quedlinburg, Germany
E-mail: [email protected], phone: 039485651740 (see the legal notice)

2. Hosting

The website, its database and its cache run on a server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Every request and the data described below are processed on this server. We have a data processing agreement with IONOS under Art. 28 GDPR. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, reliable operation of the website).

3. Cloudflare

All traffic passes through Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which protects the site against attacks and bots, terminates the encrypted connection and delivers the skin images from its storage (Cloudflare R2). Cloudflare processes your IP address, the requested URL, your browser's technical data and the time of the request. Data may be transferred to the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework, and we have concluded Cloudflare's data processing agreement including the EU standard contractual clauses. Legal basis: Art. 6(1)(f) GDPR (security and availability of the website).

4. Server log files

When you open a page, the web server records your IP address, the date and time, the requested page, the status code, the referring page and your browser's user agent. We use these logs only to operate the site, find errors and defend against attacks, and delete them after 14 days. Legal basis: Art. 6(1)(f) GDPR.

5. Your account

To play you create an account. We store:

• your e-mail address, your username and your password (only as a secure hash, never in plain text);
• your confirmation that you are at least 16 years old, with its time and the wording you confirmed;
• the time of sign-up and, if you arrived through a link carrying one, its campaign source (the ref and utm parameters of the link);
• for protection against multiple accounts and abuse: the country and network (ASN) of your connection and a keyed hash of your IP address, from which the IP address cannot be read back.

Legal basis: Art. 6(1)(b) GDPR (performing the user agreement, see our terms) for the account data, Art. 6(1)(f) GDPR (preventing abuse and measuring where our players come from) for the rest. We keep the account data until you delete your account; write to us and we delete it.

6. Game data

While you play we store your rolls, your inventory, your crafting materials, charms and Credits, your rank and your leaderboard results. For every day you play we store a daily activity record (number of rolls, the country and network of your connection and the keyed hash of your IP address) to detect bots and to count how many players return. Legal basis: Art. 6(1)(b) GDPR for the game itself, Art. 6(1)(f) GDPR for abuse detection and the statistics. The data is deleted together with your account.

7. Public leaderboard

The leaderboard is public: anyone can see the username of the players ranked there together with their results (rarest roll, number of rolls). Choose a username that does not reveal your real name if you do not want it shown. Legal basis: Art. 6(1)(b) GDPR (the leaderboard is part of the game).

8. Cookies and local storage

We set a single cookie: the session cookie that keeps you signed in. Together with it the server stores the session with your IP address and your browser's user agent; the session ends when you sign out or when it expires. In your browser's local storage the game remembers two display settings (the number of leaderboard rows you chose and which inventory items you have already seen). All of this is strictly necessary for the service you request, so no consent is needed (§ 25(2) no. 2 TDDDG, Art. 6(1)(b) GDPR). We use no analytics, advertising or tracking cookies.

9. Rate limits

To stop automated requests, the server counts requests per IP address and per account in a short-lived cache. These counters expire automatically after minutes and are never stored permanently. Legal basis: Art. 6(1)(f) GDPR.

10. Fonts and external content

The fonts are hosted on our own server; your browser does not contact Google or any other font provider. Apart from Cloudflare (section 3) the website loads no third-party content.

11. Minimum age

skin-rng is for people aged 16 or older. We do not knowingly process data of younger children; if you learn that a child under 16 has an account, tell us and we delete it.

12. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR);
• have incorrect data corrected (Art. 16 GDPR);
• have your data deleted (Art. 17 GDPR) or its processing restricted (Art. 18 GDPR);
• receive your data in a common machine-readable format (Art. 20 GDPR);
• object at any time to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR);
• lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Landesbeauftragter für den Datenschutz Sachsen-Anhalt, Leiterstraße 9, 39104 Magdeburg, Germany.

To use your rights, write to [email protected] from the e-mail address of your account.

13. No automated decisions

We make no decisions about you based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

14. Changes

We update this policy when the website or the law changes. The current version is always on this page.

As of 29 September 2026