Wishlist nowWishlist

Privacy policy

What data we process, why, and what your rights are.

1. Controller

Huber&Bach Onlinehandel UG (haftungsbeschränkt)
Hafenstraße 1a
25980 Sylt
Germany
Represented by: Fynn Sinhuber, Elias Bach
Email: official.cayosland@gmail.com
Phone: +49 178 2722680

This policy covers the C4YOS Land website, including the browser demo, community chat, newsletter and shop preview.

2. The short version

  • No advertising or tracking cookies, no analytics tools, no ad networks.
  • Fonts, images and videos are served from our own server. Visiting the site sends no data to Google Fonts, YouTube or social networks.
  • You only need an account for the community chat and the leaderboard. The demo works without one.
  • Your email address is never shown publicly.

3. Hosting and server logs (Cloudflare)

The website is delivered through Cloudflare Workers (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you open a page, Cloudflare processes technically necessary data: IP address, date and time, requested address, referrer, and browser and device details. This is needed to deliver the pages and protect them from attacks.

The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). We have a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; data may also be processed in the USA. More: Cloudflare privacy policy.

4. Accounts and community chat (Supabase)

Accounts, chat, leaderboard and the newsletter list run on Supabase (Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992). The database is located in the EU (Ireland). We have a data processing agreement with Supabase; where data is processed outside the EU, this is based on the EU Standard Contractual Clauses. More: Supabase privacy policy.

What we store when you create an account: email address, password (only as an encrypted hash), player name, chosen avatar, role (e.g. moderator), time of sign-up. If you use the chat: your messages with timestamps. If you play demo runs while signed in: difficulty, monsters defeated, rounds, win or loss, and time.

What is public: player name, avatar, role, sign-up date, your chat messages and your best demo results on the leaderboard. The chat can be read by every visitor, even without an account.

Moderation: when a message is reported, we store the report with a copy of the content. Moderation decisions are logged so that breaches of the chat rules stay traceable.

Legal basis: providing the account and chat you ask for when you sign up (Art. 6(1)(b) GDPR) and our legitimate interest in a safe chat without abuse (Art. 6(1)(f) GDPR).

Minimum age: you may create an account from the age of 16.

Deletion: you can delete your account at any time in your profile on the community page. This deletes your account, player name, all your messages, your demo results and your credit. Entries in the moderation log remain without any link to your account.

5. Emails about your account (Resend)

We send confirmation and password-reset emails through the email service Resend (Resend, Inc., USA). This processes your email address, the content of the email and technical delivery data (time, delivery status). The emails contain no open or click tracking. The legal basis is Art. 6(1)(b) GDPR, as the emails are needed for your account. We have a data processing agreement with Resend; transfers to third countries are based on the EU Standard Contractual Clauses. More: Resend privacy policy.

6. Welcome credit

New accounts receive shop credit. For this we store credit entries (amount, type, time) with your account. So that the credit is granted only once per email address, we also store an irreversible hash of your email address; it is kept after an account is deleted for as long as the credit offer runs. Legal basis: Art. 6(1)(b) and (f) GDPR.

7. Bot protection (Cloudflare Turnstile)

When you sign in or sign up, Cloudflare Turnstile checks that a person is using the form. Cloudflare processes your IP address and browser and device details for this. It protects the community from automatically created spam accounts (legitimate interest, Art. 6(1)(f) GDPR). Turnstile is only loaded in that sign-in dialog. More: Turnstile privacy notice.

8. Newsletter and launch reminder

When you sign up for the newsletter or the Kickstarter launch reminder, we store your email address, language, the page you signed up on and the time. As proof of your consent we also store a hash of your address, the version of the consent text and the time. To prevent abuse we count sign-up attempts using hashed IP addresses; these counters are deleted after two days at the latest.

We don't send any newsletter yet. Before we write to you for the first time, you'll get one email asking you to confirm (double opt-in). Without confirmation we send nothing further.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, for example with the unsubscribe link in every email or by email to official.cayosland@gmail.com. We keep your address until you unsubscribe; we then keep the proof of consent for as long as we need it to defend against possible claims (usually three years).

9. Browser storage

We don't set cookies. Some settings are kept in your browser's local storage (Local Storage / Session Storage). They stay on your device and are not sent to us:

  • your chosen language
  • demo settings and best run (sound, difficulty, rules display, tutorial seen, best run)
  • the contents of the cart in the shop preview
  • whether you've already seen the welcome screen in this session
  • when you're signed in: your sign-in session (from Supabase), so you stay signed in

This storage is strictly necessary for the features you use (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

10. Links to other sites

We link to sites such as Kickstarter. Only when you click such a link do you go to the other site; its own privacy policy applies there.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).

You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany, datenschutzzentrum.de.

12. No automated decisions

We make no automated decisions and create no profiles within the meaning of Art. 22 GDPR.

Last updated: 25 September 2026