Void Tales
← Back to the Station

Privacy Policy

This is a translation for convenience. The legally binding version is the German Datenschutzerklärung.

This policy describes which personal data is processed when you visit portal.voidtales.win and the community gallery gallery.voidtales.win, for what purpose and on which legal basis. Sections 2, 3, 8 and 9 apply to both sites, section 11 to the gallery only. Last updated: November 2026.

1. Controller

Fabian Dettmer
c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen

Phone: 0157 9234 1658
Email: [email protected]

No data protection officer has been appointed; the legal requirements for one are not met.

2. Server logs

This website is served from a self-managed server. On every request the web server logs technical access data: IP address, time, requested resource, status code, amount of data transferred, referrer and browser identification. This data is used only to run the service securely and to find faults, is not combined with other data and is overwritten on a rolling basis. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation).

3. Delivery through Cloudflare

Access to this website runs through the network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare forwards requests to the server, filters attacks and provides TLS encryption, processing the technically necessary connection data including your IP address. Cloudflare acts as a processor; a data processing agreement is in place, and transfers to third countries are covered by EU Standard Contractual Clauses. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and reachable website).

4. YouTube videos

On the home page and in News and Devlog, videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) can be played. Until you click the preview image, no connection to YouTube is made: the image is served from our own server. Only the click loads the player in privacy-enhanced mode (youtube-nocookie.com); your IP address is then sent to YouTube, and further usage data is added while the video plays. In privacy-enhanced mode YouTube sets no cookies for personalised advertising before the video is played. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in presenting the project); you trigger the request yourself. Without JavaScript the click opens the video directly on youtube.com. More information: Google's privacy policy.

The live map of the game world on the home page also loads only after a click. It runs on our own server at dynmap.voidtales.win; no data goes to anyone else.

5. Server status lookup (api.mcstatus.io)

The status display of the Minecraft server (play.voidtales.win) queries the service api.mcstatus.io directly from your browser, which sends your IP address to the operator of that service. No cookies are set and no information about you is transmitted. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in showing the current server status).

6. Storage on your device

The portal sets no cookies. Only your chosen appearance (light or dark) is stored in your browser's localStorage, and in the gallery also the chosen sort order. This never leaves your device and is not analysed; it is strictly necessary for a function you explicitly asked for (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser's site data. For your choice on visit counting see section 9, for the cookies of the gallery login section 11.

7. Search

Search runs entirely in your browser: the search index is loaded like any other file from this server, and your search terms are neither transmitted nor stored.

8. Fonts, images and scripts

Fonts, images, stylesheets and scripts are served from this server. No third-party content delivery network and no external font source is used; the only exception are the Discord profile pictures in the gallery (section 11). No third-party tracking services are used; for visit counting see the next section.

9. Visit counting

To see which pages get read, the software “Umami” is used, but only if you agree. It runs on the operator's own server in Germany; the numbers are not passed to third parties and not combined with other data sources.

Recorded are the page opened, the previous page, browser, operating system, approximate screen size, language and country. Your IP address is used only to determine the country and is not stored. No cookies are set, and there is no recognition across pages or devices.

Because the script reads some of this from your browser (such as screen size and language), it is only loaded after you choose “Yes” on your first visit. The legal basis is your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. Your browser keeps your answer in its localStorage (key zaehlen), separately for portal and gallery, so the question does not come back on every visit; that is necessary for the consent itself (§ 25(2) no. 2 TDDDG). Once you agree, the script is loaded from stats.hzwd.xyz, which also sits behind Cloudflare (see section 3). You can withdraw your consent at any time with effect for the future, here or via “Visit counting” in the footer:

10. Contacting us

If you write an email to the address above, your details are processed only to handle your request and deleted once they are no longer needed. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering enquiries), for contract-related enquiries Art. 6(1)(b) GDPR.

11. Gallery: Discord login, likes and comments

Anyone can view the gallery's images, likes and comments without logging in. To like or comment on images you log in with your Discord account; this is only possible for members of the Void Tales Discord server.

Login. Clicking “Log in” takes you to Discord (responsible for users in the EEA: Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands), where the Discord privacy policy applies. After you approve, Discord sends your Discord ID, your user, display and server name, your avatar and your membership and roles on the Void Tales server. This decides whether you may write and whether you belong to the team. The access token issued by Discord is used for this one request only and not stored. While you are logged in, the gallery checks again about every 10 minutes, through the gallery's Discord bot, whether you are still a member of the server, whether a timeout applies and which roles you have. If the membership ends or a timeout applies, the session ends; team rights follow the roles.

What is stored. Your Discord ID, your name, the address of your avatar and whether you belong to the team (for the duration of the session), plus the images you liked and your comments, each with a timestamp. Comments are shown publicly with name and avatar, likes only as a count. The address of the publicly shown avatar contains your Discord ID. Storage is on a server of the operator in Germany.

Cookies. For the login the gallery sets two technically necessary cookies: __Host-vt_oauth protects the login against forgery and expires after 10 minutes, __Host-vt_sess keeps you logged in and expires after 7 days or when you log out. The server keeps only a checksum of the session cookie. Without logging in, no cookies are set (§ 25(2) no. 2 TDDDG).

Sync with Discord. The gallery's images come from posts in the Void Tales Discord. Reactions with 👍 or ❤️ on such a post count as a like for its images, replies in the post's thread appear as comments (Discord ID, name, avatar, text, time). If a reaction or reply is removed in Discord, it disappears from the gallery by the following day at the latest. In the other direction, every comment from the gallery appears with name, avatar, text and a link to the image in the post's thread in the Void Tales Discord, marked “via Gallery”. If you delete it in the gallery, it is removed there too; if the team removes it in Discord, it disappears from the gallery by the following day at the latest. A bot shows in the same thread how many likes an image got in the gallery, as a number only and without names. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in showing the community's feedback the same way in both places).

Avatars. Avatars are loaded directly from Discord (cdn.discordapp.com) as soon as you view comments or are logged in, which sends your IP address to Discord.

Moderation. Every new comment from the gallery is reported with name, text and a link to the image to an internal team channel in the Void Tales Discord, so that inappropriate posts can be removed quickly. The team can delete any comment.

Retention. Sessions end when you log out, when your membership ends or a timeout applies on the Discord server, and after 7 days at the latest. Likes and comments stay stored until you take them back or delete them, or ask for deletion. Deleted comments are hidden immediately and removed for good 30 days later; until then it remains traceable who deleted them. Daily backups are overwritten on a rolling basis.

The legal basis for login, likes and comments is Art. 6(1)(b) GDPR (providing the function you use), for the report to the team Art. 6(1)(f) GDPR (legitimate interest in a moderated gallery). The report, the thread in Discord and the login through Discord may involve a transfer to the USA; Discord and its US companies state that they take part in the EU-US Data Privacy Framework.

12. Linked services

This website links to external services, among them Discord and Modrinth. As soon as you follow such a link, that provider's privacy policy applies. I have no influence on their data processing.

13. Your rights

You have the right at any time to

  • access the data processed about you (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • object to processing based on legitimate interests (Art. 21 GDPR)
  • withdraw a consent you gave, with effect for the future (Art. 7(3) GDPR)

To do so, write to [email protected]. Independently of this, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

14. Changes to this policy

This policy is updated when the processing described here or the legal requirements change. The version published here applies.

Provider identification: Imprint