Privacy policy

Last updated: 25 October 2026

This privacy policy describes how personal data is processed when you use the website www.ares-empire.de, the account server auth.ares-empire.de and the Ares Empire iPhone apps.

1. Controller

The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) is:

2. Hosting and server log files

The website, the account server and the server services of the apps run on a server operated by netcup GmbH, Karlsruhe, in Germany. Each time the website is accessed and each time an app sends a request, the following data is processed:

• the IP address of the requesting device,
• the date and time of the request,
• the address requested (URL) and the status code of the response,
• for the account server also the browser identification (user agent) and the previously visited page (referrer).

This data is stored in log files. The request log of the account server is deleted after 5 days, the server's other log files after 14 days.

The purposes are providing the website and the services, the security of the systems, error analysis and the prevention of misuse, for example by limiting login attempts. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in these purposes.

3. Cookies

After you log in on the website, a cookie (empire_session) containing the login token is set. It is technically necessary to keep you logged in, is valid for 30 days and is deleted when you log out. The legal basis is § 25(2) no. 2 TDDDG and Art. 6(1)(b) GDPR. No other cookies and no analytics or tracking services are used.

4. External content

The login and sign-up pages and the hub load fonts from Google Fonts, a service of Google Ireland Limited, Dublin, Ireland, and the hub also loads program libraries from unpkg.com. In doing so, your device's IP address is transmitted to these providers' servers. The privacy policy, the imprint and the contact form do not load external content.

The purpose is a consistent presentation and the functioning of the website. The legal basis is Art. 6(1)(f) GDPR.

5. Contact form and email

When you use the contact form, your email address, your message, your name (if provided), the language of the page and the time of the message are processed. The message is stored on the account server and forwarded to the controller by email; the email address you provide is used as the reply address. The IP address is used to limit the number of messages per sender (section 2). When you contact the controller by email, the data you send is processed in the same way.

The purpose is handling and answering your enquiry. The legal basis is Art. 6(1)(f) GDPR; where the enquiry concerns a user account or the use of the services, Art. 6(1)(b) GDPR. Messages are deleted 12 months after the enquiry has been closed.

6. User account

A user account is required for access to the Ares Empire services. The following data is processed:

• email address and password (only a hash of the password is stored),
• a name, if provided,
• the status of the account (email address confirmed, account approved), the services enabled and requested, the applications selected in the hub and the language for emails (German or English),
• the times of creation and modification.

An account can be created on the website or in any of the iPhone apps. After you sign up, a confirmation link is sent to the email address you provided. Every account and every request for access to a further service is reviewed and approved by the controller, who receives a notification containing the email address, the requested services and the language of the account for this purpose. Further emails are sent after approval and for resetting the password.

The purpose is providing access to the services and managing access rights. The legal basis is Art. 6(1)(b) GDPR.

Notices of logins from new devices

To protect the account, the account server stores, for each of the last five devices or browsers used to log in, a hash (MD5) of the IP address and the browser identification (user agent), together with the times of first and last use; the IP address itself is not stored. When a login comes from a new device, an email stating the time, IP address and browser of that login is sent to the account's email address. The hashes are deleted when the password is changed and together with the account. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in protection against unauthorised access.

Storage period and deletion

Account data is stored until the account is deleted; accounts that have not been approved are stored until they are approved or rejected. You can delete your account at any time in any of the iPhone apps (Settings → Account), or request its deletion by email to pab@patrikbreeck.de; the account and all associated data are then deleted in every service. You can also end your access to a single app; that app's data is then deleted and the account remains.

7. iPhone apps

Login

The apps use the user account described in section 6. When you log in, your email address and password are sent to the account server. The login token is stored in the iPhone's keychain, shared by the Ares Empire apps on that device, and deleted when you log out. This storage is strictly necessary for using the apps (§ 25(2) no. 2 TDDDG); the legal basis for the processing is Art. 6(1)(b) GDPR.

Contact and support

Messages sent with "Contact & support" are stored on the account server together with the type of message, the text, the app and its version, the iOS version and device type, the language and the user account, and are forwarded to the controller by email; the account's email address is used as the reply address. Purpose and legal basis are as in section 5. Messages are deleted 12 months after the enquiry has been closed, at the latest together with the user account.

Push notifications

If you allow notifications in iOS, the app sends the device token assigned by Apple, together with the user account, the app and its language, to the Ares Empire push service. Notifications are delivered through the Apple Push Notification service; Apple receives the device token and the content of the notification. For error analysis, the last 200 notifications sent (time, user account, title, text, link) are stored.

The legal basis is Art. 6(1)(b) GDPR. Notifications can be switched off at any time in the iPhone's settings. The device token is deleted when you log out, when access is withdrawn, when Apple reports it as invalid, and at the latest 60 days after the app last registered it.

The apps contain no analytics, advertising or tracking functions.

8. Recipients

Personal data is transmitted to, or processed on behalf of the controller by, the following recipients:

• netcup GmbH, Karlsruhe, Germany: operation of the server (processing on behalf under Art. 28 GDPR),
• Resend, Inc., USA: sending emails (confirmation, approval, password, login notices, forwarding of messages),
• IONOS SE, Montabaur, Germany: the controller's email mailbox,
• Apple Distribution International Ltd., Ireland, and Apple Inc., USA: delivery of push notifications,
• Google Ireland Limited, Ireland, and unpkg.com: provision of fonts and program libraries (section 4).

Personal data is not passed on to any other third parties, sold or used for advertising.

9. Transfers to third countries

Resend processes data in the USA. Resend is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). Apple transfers data from the EU to the USA on the basis of standard contractual clauses (Art. 46(2)(c) GDPR). When Google Fonts are loaded, data may be transferred to Google LLC in the USA; Google LLC is also certified under the EU-U.S. Data Privacy Framework. When content is loaded from unpkg.com, processing outside the EU cannot be excluded.

10. Storage period

Personal data is deleted as soon as it is no longer needed for its purpose and no statutory retention obligations apply. The periods for the individual processing operations are stated in sections 2 to 7.

11. Your rights

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR).

Right to object: where processing is based on Art. 6(1)(f) GDPR, you may object to it at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise these rights, an email to pab@patrikbreeck.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for the controller is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

12. Required information and automated decisions

An email address is required to sign up; without it, no account can be created. An email address is also required to answer messages sent with the contact form. No automated decision-making, including profiling (Art. 22 GDPR), takes place.