Deutsche Fassung

Privacy Policy

This privacy policy explains which personal data are processed when you visit laharthrum.com or our profiles on social networks, for what purpose and on which legal basis.

1. Controller

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Summary

• This website sets no cookies and uses neither local storage nor similar techniques.
• There are no analytics, tracking or advertising tools.
• Fonts, images and all other content are loaded only from laharthrum.com. No third-party content (for example from Google, YouTube or Steam) is loaded when you open a page.
• On this website, personal data are only processed when pages are delivered and when you contact us. For our profiles on social networks, see section 7.2.

3. Hosting

The website is delivered via Cloudflare: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare processes the data as a processor under a data processing agreement pursuant to Art. 28 GDPR.

When a page is requested, Cloudflare processes technically necessary data: your IP address, date and time of the request, the requested address, the amount of data transferred, the previously visited page (referrer), information about your browser and operating system, and security-relevant characteristics of the request.

Purpose: delivering the website, keeping it stable and secure, in particular defending against attacks and overload. We only evaluate these data in aggregated form (such as the number of page views and countries of origin). Security events, for example blocked attacks, can be shown individually with their IP address in Cloudflare's dashboard; we do not export or store them.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and fast delivery of the website.

Retention: We have no access to raw logs and do not store these data ourselves. Cloudflare stores them according to its own criteria, only as long as necessary for these purposes.

Transfer to the USA: Cloudflare, Inc. is certified under the EU-US Data Privacy Framework. The transfer is based on the European Commission's adequacy decision (Implementing Decision (EU) 2023/1795). In addition, the data processing agreement contains the European Commission's standard contractual clauses.

4. Contact form

When you use the contact form, we process your e-mail address, the selected topic, your message and, if provided, your name. E-mail address and message are required; without them we cannot reply.

The data are received via Cloudflare (see section 3) and forwarded as an e-mail to our mailbox. To prevent abuse, your IP address is used briefly to limit the number of messages per minute. It is not stored with your message. The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest is protecting the form against abuse.

Purpose and legal basis: handling and answering your enquiry. If your enquiry relates to entering into or performing a contract, the legal basis is Art. 6(1)(b) GDPR; otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).

Recipients: Cloudflare as processor (section 3) and our e-mail provider mailbox.org (Heinlein Hosting GmbH, Schwedter Str. 9a, 10119 Berlin, Germany), which also acts as our processor under Art. 28 GDPR and stores the data in Germany.

Retention: We delete your enquiry once it has been dealt with, unless statutory retention obligations apply (for example six years for commercial and business letters under section 147 of the German Fiscal Code, Abgabenordnung, AO).

5. Contact by e-mail

When you write to us by e-mail, we process your e-mail address, the content of your message and the technical details of the e-mail. E-mails to addresses at laharthrum.com are received by Cloudflare (section 3) and forwarded to our mailbox at mailbox.org. Purpose, legal basis, recipients and retention are as in section 4.

6. No cookies

This website sets no cookies and uses neither local storage nor similar techniques. Your browser only caches files of the website; this is technically necessary to deliver the pages (section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). This is why there is no consent banner.

7. Links to other providers and our profiles on social networks

7.1 Links

The website contains plain links, for example to Steam. Only when you click such a link do you leave laharthrum.com. The provider of the linked page is responsible for data processing there.

7.2 Our profiles on social networks

We run profiles on the platforms listed below to tell people about LAHARTHRUM STUDIOS and our games and to stay in touch with those interested.

What we process: when you follow our profiles, like, comment on or share our posts, tag us or send us a message, we see your profile name, your profile picture and the content you share with us. On some platforms we also see who has viewed our stories. We use this information to answer you and to look after our profiles, including moderating posts (for example removing unlawful comments). We only copy it into our own systems where necessary, for example when we answer an enquiry by e-mail or when a platform notifies us of new comments and messages by e-mail. If your message contains an enquiry, section 4 applies accordingly.

Statistics: some platforms give us statistics on the use of our profiles and posts, such as reach, number of views and interactions and, depending on the platform, aggregated information on visitors' countries, age groups and gender groups. We receive them only in aggregated form; we have no access to the data from which they are created.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to present our studio and our games where players look for information, to communicate with them, and to use the statistics to understand which posts reach and interest them. If your message relates to entering into or performing a contract, the legal basis is Art. 6(1)(b) GDPR.

Retention: comments on our posts and messages to us remain stored on the platform until you delete them, we remove them or our profile is deleted. We delete messages containing enquiries once the enquiry has been dealt with (section 4). How long the operators store data is set out in their privacy policies.

Processing by the platforms: the operators process your data on every visit under their own privacy policies, even if you have no account there. Unless a joint controllership is named below, they alone are responsible for this. They may use cookies and similar technologies, analyse your behaviour for advertising and transfer data to countries outside the European Economic Area, for example to the USA. We have no influence on this processing. The operators' privacy policies explain how you can object to it (list below).

Joint controllership for statistics:

For the processing from which Meta creates the statistics for our Facebook Page ("Page Insights"), we are joint controllers with Meta Platforms Ireland Limited (Art. 26 GDPR). Under the agreement with Meta, Meta takes on compliance with the GDPR obligations for this processing, in particular providing the information under Art. 13 GDPR and fulfilling your rights. Meta makes the essence of the agreement available at facebook.com/legal/terms/page_controller_addendum.

Meta currently provides no agreement under Art. 26 GDPR that expressly names Instagram. Insofar as we are joint controllers with Meta Platforms Ireland Limited for the processing from which Meta creates the statistics for our Instagram profile, you can also exercise your rights against Meta.

For the processing from which TikTok creates the statistics for our TikTok account ("TikTok Analytics"), we are joint controllers with TikTok Technology Limited and TikTok Information Technologies UK Limited (Art. 26 GDPR). Under the agreement with TikTok, TikTok provides information about this processing and enables you to exercise your rights. TikTok makes the essence of the agreement available at tiktok.com/legal/page/global/information-about-tiktok-analytics/en and the agreement itself at tiktok.com/legal/page/global/tiktok-analytics-joint-controller-addendum/en.

We forward requests about this processing that reach us to Meta or TikTok without delay, at the latest within seven calendar days.

Your rights: you can exercise your rights under sections 9 to 11, including the right to object under section 10, against us and, where there is joint controllership, also against Meta or TikTok (Art. 26(3) GDPR). Only the operators have access to the usage and device data the platforms collect, so they can fulfil access and erasure requests about these data fastest. We will help you with this.

The platforms, the controllers for users in the European Economic Area and their privacy policies:

• YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – policies.google.com/privacy
• X: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland – x.com/en/privacy
• Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland – privacycenter.instagram.com/policy
• TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, jointly with TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, EC1A 9HP, United Kingdom – tiktok.com/legal/page/eea/privacy-policy/en
• Facebook: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland – facebook.com/privacy/policy

8. The game WRECKHOLM

This section applies when you play WRECKHOLM. Once the game is released, the same notice is also available in the game itself. The controller is named in section 1. If you write to us, sections 3 to 5 apply.

8.1 Summary

• WRECKHOLM is played online through Steam. We run no servers of our own. One player opens the session (the host), even when playing alone.
• Other players see your Steam name and hear you in voice chat. The default setting is “Push to Talk”.
• Lobbies, connections, invitations and purchases run through Steam. Valve is itself responsible for the processing within Steam; we decide which information the game hands to Steam.
• The game sends no data to us. It shows no third-party or personalised advertising, does not analyse how you play and sends no crash reports.
• Settings and crash data stay on your PC unless you pass them on yourself.

8.2 Online play through Steam

Data: your Steam name, your Steam ID (a number that identifies your Steam account), the quality of your connection (ping) and what you do in the game: which survivor you choose, whether you are ready, where your character moves, what it does, what state it is in (for example down or dead), which gesture it shows, what your rifle looks like and which map markers you place.

Source: the game reads your Steam name and Steam ID from your Steam client. It receives the other players' data through Steam and through the connection to the host.

Recipients: all players in the same session. Your Steam name appears in the lobby, in the player list, above your character, on your map markers and with your chat messages. The game does not display the Steam ID; it uses it to tell players apart.

The host: the host is another player or you yourself, not a server of ours. All session data pass through the host's game. It remembers the Steam IDs of the players it has admitted or invited and the survivor each player has chosen.

Connection and IP address: the game connects players through Steam's network and addresses them by their Steam ID, not by their IP address. Already at start, the game registers with Valve's relay network and measures the ping times to its servers; Valve receives your IP address in the process. WRECKHOLM always routes the traffic through Valve's relay servers; other players therefore do not learn your IP address.

Purpose and legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to provide you and the other players with the online co-op game that you start.

Retention: the participants' games keep these data in memory only, at most until the game in question is closed. We ourselves neither receive nor store them.

8.3 Lobbies and text chat

Opening a lobby: when you open a lobby, Steam makes it visible to WRECKHOLM's lobby search, even if you set a password. Anyone who searches receives the lobby name you enter (at most 24 characters), your Steam name and Steam ID, the number of players, whether the lobby has a password and whether a game is already running there. A lobby with a password appears in the list of private lobbies with the lobby name, your Steam name and the number of players, as long as no game is running there yet and a place is free. The password itself is not published.

Joining: anyone can join a public lobby, including through quick join, which picks a lobby automatically. There you play with strangers. When you join a lobby with a password, your game sends the password you entered to the host's game, which checks it.

Removal: the host can remove players from the lobby before the game starts; the removed player receives a message. That player's game remembers this lobby until it is closed, so that quick join does not pick it again. There is no banning, blocking or reporting in the game. You can report a player to Valve through their Steam profile.

Text chat: in the lobby you can write messages of up to 160 characters. All players in the lobby see them with your Steam name, including players who join later (the last 30 messages). There is no word filter. The game keeps the messages in memory only.

Purpose and legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is that you can find other players, coordinate with them and manage your lobby yourself.

Retention: Steam shows a lobby as long as it exists. The games keep lobby data and chat in memory only, at most until the game in question is closed.

8.4 Voice chat

How it works: the game records your voice through the Windows default recording device and sends it over the game connection to the host's game, which forwards it to the other players. All players in the session hear you, in the lobby and on the island, wherever the characters are.

Default setting “Push to Talk”: the game transmits your voice only while you hold down the push-to-talk key (default key: T). Under SETTINGS › AUDIO › “Voice Mode” you can choose “Open Mic” or “Mute” instead. With “Open Mic”, as soon as you are in a lobby, the game transmits everything your microphone picks up, including sounds in your room, without you pressing a key; this also applies in public lobbies with strangers. The other players can see whether you have chosen “Mute”.

Other players: you cannot mute individual players. You set the overall voice chat volume under SETTINGS › AUDIO.

No recording: the game does not record or store voice chat.

Only on your PC: the level meter in the settings and listening to your own microphone run only on your PC; listening is off by default. The microphone you choose in the settings applies only to these two functions.

Purpose and legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is that you can talk to the other players while playing together.

Retention: none. Your voice is only transmitted.

8.5 Steam friends and invitations

Friends list: when you open the friends list in the lobby, the game reads your Steam friends from the Steam client: names, whether someone is online or playing WRECKHOLM, and profile pictures. This includes friends who do not play WRECKHOLM. The list is shown only on your PC; the game passes nothing from it on, except the Steam ID of a friend you invite.

Inviting: when you invite a friend, Steam sends the invitation. In addition, the host's game receives the invited friend's Steam ID so that the friend can join without a password. You can also use Steam's invitation window.

Joining through Steam: your Steam friends can see in Steam that you are playing WRECKHOLM and can join your lobby through Steam's friends list (“Join Game”), even without an invitation. They can join a lobby with a password this way only if they enter the password or were invited by you.

Being invited: when someone invites you, the game shows their Steam name, and you decide whether to accept.

Purpose and legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is that you can play with your friends.

Retention: in memory only, at most until the game in question is closed.

8.6 Cosmetic items for purchase

In the game you can buy a cosmetic item through Steam: the rifle skin “SUNKEN GOLD”.

Purchase: when you click this item in the main menu, Steam opens the checkout. Valve handles the purchase and the payment; we receive no payment data. Your game learns from Steam only the status of the purchase and an order number and a transaction number.

Check: every time your character enters play on the island, your game asks Steam which of your WRECKHOLM items you own. If you own a purchasable item, your game requests a Valve-signed extract of your Steam inventory for WRECKHOLM from Steam and sends it to the host's game. The host's game checks, with the help of Steam, whether the extract belongs to your Steam ID and unlocks purchased items. The host's game thereby learns only whether you own the purchasable item, and no other items of your Steam account. If you have bought nothing, nothing is sent to the host. All other players see which item your character wears; they can infer from this that you bought it.

Purpose and legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to unlock purchased items and to prevent them from being used without a purchase.

Retention: the host's game keeps the extract in memory only for the check and then remembers, until the session ends, which purchased items you own. Valve manages your Steam inventory.

8.7 What stays on your PC

Settings: the game stores your settings in a file in a “Saved” folder on your PC: graphics, resolution and screen (with its Windows identifier), the window position, volumes, music on or off, sound while the game is in the background, voice mode, push-to-talk key, microphone gain, the chosen microphone and the chosen speakers (with Windows identifier and name), mouse sensitivity and inverted mouse, the language, the survivor shown in the main menu, and which version of the EULA you accepted. On first start the game measures the performance of your processor and graphics card once to set up the graphics, and stores the result in the same file. The file stays until you delete it. There are no saved games.

At start the game also reads the language you have set in Steam for WRECKHOLM, the list of your audio devices and the resolution of your screen. This information stays on your PC.

Log files: the game writes no log files. Shader cache: the game engine stores the graphics shaders it has prepared for your graphics card in a file in the “Saved” folder, so that the game runs more smoothly next time; the file contains no information about you.

Crash data: if the game crashes, the game engine may store a crash report with a snapshot of the memory in the “Crashes” subfolder of the “Saved” folder. It may contain anything the game had in memory at that moment, for example Steam names of other players. The game does not send it; it stays there until you delete it. Please send us a crash report only if we ask you to, because it may contain data of other players. For crash reports, the game engine also creates a small folder with settings at each start; it contains no information about you, and the engine deletes it after two days.

Storing and reading on your PC: storing and reading the settings file and the shader cache, measuring the performance of your processor and graphics card once on first start, and reading the information named in this notice from the Steam client, from your audio devices and from your screen is strictly necessary so that we can provide the game you have expressly requested (section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). The same applies to the technical information on Windows, graphics card and drivers that the game engine reads in order to display the game. No consent is required for this. Beyond this, the game stores information on your PC only for crash reports (see “Crash data”).

Purpose and legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is that the game runs with your settings and that you can send us a report after a crash so that we can find the error.

8.8 Valve (Steam) and transfer to the USA

Valve Corporation, P.O. Box 1688, Bellevue, WA 98009, USA, operates Steam: your Steam account, the friends list, the lobbies, the network through which game data and voice chat run, the invitations, the Steam overlay, purchases and the Steam inventory. Valve processes these data as a controller in its own right under its privacy policy: store.steampowered.com/privacy_agreement. According to that policy, anyone can retrieve at least your Steam name and profile picture through your Steam ID. You manage the data of your Steam account at Valve at help.steampowered.com.

What Valve makes available to us: developers can access certain information about the players of their games through Steam: at least whether someone owns the game and, depending on the game, also matchmaking information and in-game items. We use this only when you write to us about a purchase or an error; the source is then Valve, the legal basis Art. 6(1)(f) GDPR, our legitimate interest is to resolve your enquiry; we delete the information together with your enquiry.

Transfer to the USA: Valve is based in the USA and receives these data directly from your Steam client. For companies certified under the EU-US Data Privacy Framework, an adequacy decision of the European Commission applies (Implementing Decision (EU) 2023/1795). When we checked on 29 September 2026, Valve Corporation was actively certified under it (dataprivacyframework.gov).

Other players in other countries: other players and the host can be anywhere in the world, including in countries outside the EU for which there is no adequacy decision. Your data reach them directly from your game, without appropriate safeguards under Art. 46 GDPR; equivalent protection and enforceable rights may be lacking there. The game does not show in which country another player is. If you want to avoid this, play only with people you know, in lobbies with a password or through invitations.

8.9 Obligation to provide data, automated decisions, age

You are under no statutory or contractual obligation to provide data to us. For online play, however, you need a Steam account and an internet connection; there is no offline mode. Without a microphone you can play, but not speak. No automated decision-making, including profiling (Art. 22 GDPR), takes place. The game does not ask for your age. According to Valve's privacy policy, a Steam account requires a minimum age of 13; where a country sets a higher age for the collection of personal data, Valve requires parental consent before the account is created. In public lobbies, minors too meet strangers who can hear them in voice chat and exchange messages with them in the lobby. We recommend that parents keep the voice mode at “Push to Talk” or set it to “Mute” and use only lobbies with a password or an invitation.

8.10 Your rights when playing

Sections 9 to 11 set out your rights, your right to object and your right to lodge a complaint.

We ourselves store no data about you through the game. If you ask for access, we confirm this to you and explain which data are on your PC and how you delete them. Valve manages the data of your Steam account.

Where we rely on legitimate interests (Art. 6(1)(f) GDPR), you can obtain information on our balancing of interests on request.

Processing in the game takes place on the players' PCs, not with us. We respond to an objection against it by showing you how to switch it off; it ends completely only when you stop playing WRECKHOLM online. You can switch off part of it yourself at any time: set the voice mode to “Mute”, do not write chat messages, do not open the friends list and do not join public lobbies.

9. Your rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR, see section 10)

To exercise them, write to contact@laharthrum.com or to the address in section 1. No automated decision-making, including profiling (Art. 22 GDPR), takes place.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

12. Version and languages

Version: November 2026. This privacy policy is also available in German. In case of differences, the German version prevails.