Privacy notice, version 0.1
Draft for Season 0, written for the Swiss Federal Act on Data Protection (revFADP) and the GDPR where it applies. A reviewed version replaces this one.
Who
The controller is the operator named in the terms, reachable at privacy@thehackerpages.com.
What we hold and why
| Data | Why | How long |
|---|---|---|
| Handle, email, the time you joined | Your account and page; the confirmation link; account recovery | Until you delete your account |
| An authentication record that is not your password (OPAQUE), your authenticator secret (encrypted) and hashed recovery codes | Signing you in without ever receiving your password | Until you delete your account |
| Session identifiers, IP address and browser string of signed-in devices | Keeping you signed in; letting you sign out everywhere | 30 days per session |
| Consents (terms, privacy notice, age) with the text version and time | Showing what you agreed to | Until you delete your account |
| A security log (sign-ins, failed attempts, authenticator changes) with IP address | Protecting accounts; investigating abuse | 90 days |
| Who may see your page (members, anyone) | Rendering your page to the audience you chose | Until you change it |
| What you put on your page: a name, a one-liner, an about text, a link, a picture and a banner (re-encoded in your browser, no metadata kept) | Your page, shown to the audience you chose | Until you change or remove it, or delete your account |
| Your posts, with their type and audience | The feed and your page | Until you delete the post or your account |
Where
All data is stored in Microsoft Azure, region Switzerland North. Confirmation emails are sent through Azure Communication Services. No analytics, no advertising, no third-party scripts; the only outside request your browser makes is an optional check of your new password against a public list of breached passwords, which sends five characters of a hash and nothing else.
Your rights
Access, correction, export and deletion: in Settings as the features arrive, and by email at any time. Complaints go to the Swiss Federal Data Protection and Information Commissioner or your local authority.
When the game opens
Raid recordings, breach notes and the logs of your app add new rows to this table. They are described in a new version of this notice before the first raid week, and you are asked again before your app can be raided.