Privacy Policy

The controller for the processing described here is Nikolai Kolodziej. Full contact details are on the Impressum. For any privacy question or request, email [email protected].

This policy covers the zombo.id website. Legal-basis references are to the EU General Data Protection Regulation (GDPR / DSGVO).

The site is served through Cloudflare (a content delivery network and reverse proxy) and hosted on Hetzner in Germany. Delivering a page necessarily processes your IP address, the time of the request, the page requested, and your browser’s user-agent string. These are used to deliver the site, keep it available, and defend against abuse.

Legal basis: our legitimate interest in delivering and securing the site (Art. 6(1)(f) GDPR).

We measure aggregate usage (page views, referrer, rough device and browser type, country) with Umami, which we host ourselves. It is cookieless, does not build a cross-site profile of you, and does not store your full IP address in an identifiable form. No analytics data is shared with a third-party analytics company.

Legal basis: our legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR).

To show “your ping” to a server and to guess your region, we read the approximate country and coarse latitude/longitude that Cloudflare derives from your IP address and passes to us in request headers. This is used within the request to pick the nearest measuring relay. We do not store it against you.

Legal basis: our legitimate interest in providing a locally relevant latency estimate (Art. 6(1)(f) GDPR).

The site sets only these cookies, so there is no consent banner:

• knox-booted (functional, ~24 hours): remembers that you have seen the intro so it is not replayed on every visit.
• Session and login cookies (strictly necessary): set only if you choose to sign in with Steam, to keep you signed in and to protect the login flow. These are removed when you sign out.

There are no advertising or tracking cookies. Under Section 25(2) TTDSG, strictly necessary and functional storage of this kind does not require consent.

Signing in is entirely optional and only needed to claim and manage a server you operate. If you sign in, we use Steam’s OpenID: you authenticate with Valve, and we receive your SteamID64, public Steam display name and avatar. We store this together with an account record and a session so the site recognises you. We never see your Steam password.

Legal basis: performance of a contract, namely providing the account and its features (Art. 6(1)(b) GDPR). You can delete your account at any time (see your rights below).

When you claim a server, we store the link between your account and that server, and a short-lived verification token used to confirm you control it. This lets us show you as the owner and let you manage the listing.

Legal basis: performance of a contract, namely providing the claiming feature (Art. 6(1)(b) GDPR).

We use these providers to run the service. Each processes data only on our behalf:

• Cloudflare (CDN, reverse proxy, approximate geo, Turnstile) under its data processing terms and EU standard contractual clauses.
• Hetzner Online GmbH, Germany (hosting of the servers and database) under a data processing agreement.
• Valve Corporation (Steam), United States, the identity provider, and only if you choose to sign in.

Analytics is self-hosted, so no third-party analytics provider is involved. If we later add confirmation emails, the transactional email provider we use will be added here before any email is sent.

Our hosting is in Germany. Two providers involve a transfer to the United States: Cloudflare (a US parent company, with EU processing and standard contractual clauses in place) and, only if you sign in, Valve/Steam. Where a transfer occurs it is based on the provider’s standard contractual clauses or an equivalent safeguard.

• Delivery and security logs: only briefly, for availability and abuse defence.
• Analytics: kept in aggregate; not tied to an identifiable person.
• Account and claim data: until you delete your account.

Under the GDPR you have the right to:

• access the personal data we hold about you, and get a copy (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict or object to processing (Art. 18, 21);
• receive your data in a portable format (Art. 20);
• withdraw any consent you gave, at any time, without affecting past processing.

To exercise any of these, email [email protected]. You also have the right to complain to a data protection supervisory authority, including the one where you live.

Traffic is encrypted with TLS, hosting is in the EU, and we keep the data we collect to a minimum. The site is not directed at children under 16, and we do not knowingly collect their data.

If we change this policy, we update the date at the top. Material changes to how we use account data will be communicated before they take effect.