Privacy policy

This English version is a convenience translation. In case of doubt, the German version applies.

Details to follow. The operator's name, address and contact details will be added shortly; missing details are marked until then.

Controller

E-mail: to be added

In short

This site loads no third-party content, uses no analytics or advertising services and sets only the technically necessary sign-in cookie. We store only what the account, the game, security and troubleshooting need, and delete it after fixed periods.

Visiting the website

Opening the start page, downloads, sign-ins and game joins create an entry in the security log: time, IP address, user name where applicable, type of event, result and a short technical detail (e.g. a file name). The log is deleted after 30 days (and limited to the latest 100,000 entries). Purpose: protection against abuse (e.g. too many sign-in attempts) and troubleshooting. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

The web server in front of the service (nginx) additionally keeps access and error logs (IP address, time, page, browser identification). They are rotated daily and deleted after 7 days. Purpose and legal basis as above (Art. 6(1)(f) GDPR).

Account

For an account we store the user name, display name, e-mail address, language, a salted password hash (PBKDF2-SHA256, never the password itself), time of registration and last sign-in, and the account status (confirmed, approved, locked, admin). If an account is locked, we store the reason and the end of the lock; both are deleted when the lock expires or is lifted. The security log only notes the lock (with its duration), its lifting and its expiry, not the reason. The legal basis for locks is our legitimate interest in fair and secure play (Art. 6(1)(f) GDPR). Moderators appointed by the administration see user and display names, account status, time of registration and last sign-in, reports and chat bans, but no e-mail addresses; they may lock and unlock player accounts. The e-mail address is required for the account: we use it only for account confirmation, password reset, approval and security messages – no newsletter, no disclosure. Legal basis: Art. 6(1)(b) GDPR (using the game with an account). The account is kept until you ask for its deletion or the administration deletes it. Registrations that are never confirmed are deleted automatically after 7 days. Before every update of the website and the master server we back up their databases on the server; these backups also contain account and game data. For each service at most the last 5 backups are kept and none older than 30 days; only the most recent one stays until the next backup, so that a restore remains possible. Until they are deleted, deleted or changed details may still be contained in them.

If the server has no e-mail delivery set up, the address given at registration is stored without confirmation and marked as unconfirmed; the account then waits for approval by the administrators. Such registrations are deleted after 30 days unless approved. If the administrators create an account for you, they store the same details; the e-mail address is then optional and marked as unconfirmed until confirmed. One-time links for setting a password (created by the administrators) are stored only as a checksum; they are valid for 72 hours and only once.

Display name and account ID

Every account gets a random, unchangeable account ID (32 hex characters). Game servers receive it together with the display name when you join, to give your hero back to you after a lost connection within the rejoin window. For matchmaking the master server also receives the account ID and display name and keeps your rating under them (see "Matchmaking and leaderboard"). Only these game servers and the master server receive the account ID; it is never shown to other players and does not appear in the leaderboard.

The display name is mandatory and public. You choose it when you register and can change it under My account; accounts that do not have one yet choose it after their next sign-in on the website. The other players of a match see it in lobby, game and result; after a rated match it appears with your rating in the public leaderboard. It must be unique. Choose a name that does not reveal more about you than you want. While an older account has no display name yet, the other players of a match see its user name instead; when it searches for a rated match for the first time, that user name becomes its display name (if it meets the rules and is free) and then also appears in the leaderboard. Changes are noted in the security log. Legal basis: Art. 6(1)(b) GDPR. Account ID and display name are deleted together with the account; game servers keep them only for the running match, the master server until the account is deleted.

Sign-in and cookie

After signing in, the site sets the cookie realm_session (HttpOnly, Secure, SameSite=Strict, valid for 8 hours). The server keeps only a checksum of the session with the user name and expiry; expired sessions are deleted. Game joins use single-use tickets that expire after 30 seconds. The cookie is strictly necessary (Section 25(2) no. 2 TDDDG); legal basis of the processing: Art. 6(1)(b) GDPR.

If you switch the language at the top of the page (DE | EN), your browser remembers the choice in the cookie realm_lang (only "de" or "en", valid for one year, SameSite=Lax) and in the page's local storage. It contains no identifier, is set only by your choice and serves solely the display you asked for (Section 25(2) no. 2 TDDDG). Without a choice the page follows the language of your browser. For an account we store the language in which you receive e-mails; you change it under My account.

With "Angemeldet bleiben" (stay signed in) in the launcher (on by default, can be unticked) the launcher receives a random sign-in key and stores it in its own data folder on your computer – never the password. The server keeps only a checksum of the key, the user name, the operating system (e.g. "windows"), time of creation and last use, and the expiry; at most 10 devices per account. The key is renewed on every use and deleted after 30 days without use, on sign-out in the launcher, on a password change or reset, a lock, "end sessions" and account deletion. Legal basis: Art. 6(1)(b) GDPR; storing it on your computer happens at your request (Section 25(2) no. 2 TDDDG).

For "Im Browser anmelden" (sign in with the browser) in the launcher we keep, until you confirm it on the website and for at most 10 minutes: checksums of the two single-use keys, the code shown, the operating system, the port on which the launcher on your computer receives the browser's answer and, once confirmed, your user name. The entry is deleted afterwards.

Optionally you can also sign in with Google or Discord. We forward you to the provider; it learns that you sign in to Realm of Realms and sends us a fixed identifier of your account there, your e-mail address with its verification status and, for Discord, the name. We store the identifier, the e-mail address, the name shown and the time of linking and of the last sign-in until you unlink it under My account or the account is deleted; we never store access keys of the provider. An account is linked only by you: under My account, or at the first sign-in at your choice when the e-mail address is verified here and at the provider and both match. If your account at the provider has no account here yet, you can create one: it gets the e-mail address the provider verified (none if an account here already uses it), you choose user and display name, no password is needed. Until you send the form (at most 15 minutes) we keep the identifier, e-mail address and name from the provider for it. For the sign-in (at most 15 minutes) the site sets the cookie realm_oauth (HttpOnly, Secure, SameSite=Lax). The provider's privacy notice applies to its processing (Google Ireland Ltd., Discord Netherlands B.V.). Legal basis: Art. 6(1)(b) GDPR at your request.

A sign-in in the launcher is valid for playing only (joining games, downloads, reports); the administration and account changes require a sign-in on the website.

Two-factor sign-in

For signing in on the website you can switch on two-factor sign-in with an authenticator app; for admins it is on by default. For this we store the app's secret key – encrypted with a key only the server can read –, the time it was set up, the number of the last used time step (so a code never works twice) and the 10 recovery codes as checksums only. During setup a new key waits unconfirmed for at most 15 minutes, a started sign-in step for at most 5 minutes. The data is deleted when you switch two-factor sign-in off, the administration resets it (e.g. after losing the device) or the account is deleted; a password reset does not change it. Setup, code checks and switching off appear in the security log (30 days). You choose the app yourself; we send no data to its provider. Legal basis: Art. 6(1)(b) GDPR, for admins also Art. 6(1)(f) (protecting the administration).

E-mails

Links in our e-mails are single-use and time-limited: confirmation 48 hours, password reset 1 hour, new e-mail address 48 hours; only a checksum of the link is stored. A mail stays in the queue until it is delivered or expires. Afterwards only its type, time and a checksum of the address are kept for 2 days (to limit how many mails go to one address). Sent via the mail provider: to be added. Legal basis: Art. 6(1)(b) GDPR, for the limit Art. 6(1)(f).

Error and match reports

After an unexpected exit the game sends an error report on its next start, and after matches a match report. They contain the game version, operating system, computer and graphics data, game state, runtime and network measurements and error locations – no chat, no keystrokes, no complete game logs of your computer. Reports are linked to the account or the game server, visible only to the administration and deleted after 30 days (at most 2,000 reports each, match reports at most 128 MiB in total). With Report a problem (main menu → More, game menu, result) you send a report yourself: category, your text (addresses, paths and links are removed) and – unless you untick it – a downscaled picture of the game screen, which can show display names and chat; only the newest 300 reports keep their picture. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working game). Error reports can be switched off in the game under Options → Send error reports automatically, match reports under Options → Send match reports; you can also object under Art. 21 GDPR.

Matches on game servers

Dedicated game servers send their own server log and one record per match to the master server so that matches can be analysed, errors found and the balance improved. The record contains start, duration, mode, map, result and game server and, per player, the internal account id, the display name, team, origin, chosen skills, upgrades and passives, damage, healing and objective figures, disconnects and ping measurements. The server log contains the technical messages of the game server; IP addresses, e-mail addresses, credentials and session identifiers are removed before sending and again on receipt. Chat and keystrokes are not recorded. The game servers also send technical performance measurements (computing times, counters, machine load, connection quality per player slot without names or account id); they contain no personal data and are deleted after 90 days. Server logs are deleted after 14 days. Match records keep the account id and display name for 12 months; after that they are anonymised: account id and names are removed (the name is replaced by "Spieler 1" to "Spieler 4"), leaving only gameplay figures without any personal reference for statistics and balance. If your account is deleted earlier, we remove the account id and name from your match records immediately. The data is visible only to the administration and every access is logged. The game shows you your own matches – result, mode, duration, origin, the other players' display names and the figures of the result screen – under "My profile" (match history); other players do not see them, and account ids and connection data are never sent. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working, balanced game); you can object under Art. 21 GDPR.

During a match on a game server, the positions of heroes, troops and bosses and the health of both bases are recorded about twice a second and stored with the match record on the master server. The positions contain no names or account IDs; heroes are numbered by their seat in the match. The replay is visible only to the match's participants (in their profile) and to the administration. The recording is kept and deleted like the match record; after 12 months the record loses names and account IDs.

Playing online

Creating a game registers the lobby with the master server; the creating computer's address and port are shown to other players so they can connect, for as long as the lobby exists. The master server keeps lobbies in memory only. For the "online" number the game sends a random number while the main menu is open; it is drawn anew at every game start and is not linked to an account or device. The master server keeps it in memory until 30 seconds after the last request and does not log it. During a match the game server or the creating computer sees the other players' IP addresses. Dedicated game servers are run by the administration or by operators it admits. Legal basis: Art. 6(1)(b) GDPR.

Matchmaking and leaderboard

For rated matches found through matchmaking the master server stores, per account ID, your display name, the rating (Elo) per mode (1v1, 2v2), the number of your wins, losses and draws, and one result row per rated match: match ID, mode, team, result, rating before and after, and the time. To search, the game requests a short-lived token through your signed-in account (valid for 10 minutes, kept in memory only). Queue data – the search ticket and the response times (pings) to the game servers measured by your computer – is kept by the master server in memory only and only while you are searching. Legal basis: Art. 6(1)(b) GDPR (rated matches against suitable opponents).

Publicly visible: once you have played at least one rated match, your display name appears with rating, tier and the number of wins, losses and draws in the leaderboard – on this website without signing in, and in the game. Signed-in players see the same figures per mode (plus your rank) in your profile in the game, which they open from the leaderboard, a lobby, the result screen or the friends list; friends also see your most played origins there. In addition, this website shows the same figures per mode (rank, rating, tier, wins, losses, draws) without signing in on a profile page per player, which can be opened by your display name and is linked from the leaderboard. Only you see your match history and Elo history. Account ID, user name and e-mail address are never shown there. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a transparent comparison of players); you can object under Art. 21 GDPR. Quick play, private lobbies and open games stay unrated and create no leaderboard entry. Rating, result rows and leaderboard name are deleted together with the account.

From the match records of the game servers the master server derives an account level and earned achievements for each account (one entry per counted match with its result and the experience awarded); the level and earned achievements are visible to other players like the leaderboard values, the entries are detached from the match after 12 months and deleted together with the account.

When you use "Quick play", the master server notes for at most one day which game server the game chose for your account and when, so that only this match counts for account level and achievements.

The leaderboard runs in seasons of about three months. At the end of a season the master server stores, per season and mode, your final standing (rank, rating, highest rating reached, wins, losses, draws) under your account ID. Past leaderboards and the season badges derived from them are public like the current leaderboard and show your current display name. The data are deleted together with your account. Legal basis: Art. 6(1)(b) GDPR.

Friends, chat and party

For the in-game friends list the master server stores, per account ID: your friend code (display name and four digits, for example "Name#1234"), your friendships, open friend requests, the players you blocked or muted and your settings (from whom you accept requests, "appear offline", "do not disturb" in rated matches, your consent to the chat rules). Whether you are online, in a lobby, searching or in a match is not stored; it is derived from the running connections and shown to your friends only – with "appear offline" they see you offline. Other players see your display name and friend code, never the account ID, user name or e-mail address. "Recently played" and the result screen list the team-mates and opponents of your last online matches, rated or not; this is derived from the match data that is stored anyway (for unrated matches from the game server's match record with the accounts it checked through the launcher). Legal basis: Art. 6(1)(b) GDPR.

Chat messages are not stored. Whispers (between confirmed friends only) and the party chat are merely relayed by the master server while sender and recipient are online. For this they stay in memory for a few seconds at most, until the recipient's game has fetched them, and are written neither to a database nor to a log – not on the website or the game servers either. There is no history: if your friend is offline or does not want to be disturbed, the message is refused, and after closing the game the conversation is gone. The administration therefore cannot read chats. Party invitations and the party itself are kept in memory only as well.

Reports: the single exception is a report. When you report a player, your game sends the reason, your note and – only when you report from within a conversation – the last 20 lines at most of that conversation that are still on your screen. The master server stores this report with the friend codes of both sides until the administration has closed it; closing deletes the chat excerpt, and the rest of the report (reason, decision, time) is deleted 90 days later. Reports left unhandled for 180 days are closed without their excerpt. Only administrators and the moderators they appoint see reports; every view and every decision is logged. Possible consequences of a report are a warning or a temporary chat ban, which is stored with your account; during the ban chat is switched off for that account. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting players from insults and harassment); you can object under Art. 21 GDPR.

Deletion: when your account is deleted, the friend code, friendships, requests, blocks, settings and any chat ban are deleted. Reports about you are closed without the chat excerpt and anonymised; your name is removed from reports you filed.

Recipients and hosting

We do not sell data or pass it on for advertising. The servers are hosted by: to be added. Hosting and mail providers process data only on our behalf (Art. 28 GDPR).

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to the address above or reply to one of our e-mails; you can also change your password and e-mail address yourself under "Konto". You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or the place of the alleged infringement.

There is no automated decision with legal or similarly significant effect (Art. 22 GDPR). Matchmaking automatically calculates a rating (Elo) from the results of your rated matches and uses it to put together opponents of similar strength; this rating is public in the leaderboard together with your display name. There is no profiling beyond that – for example for advertising or about your behaviour outside rated matches.

Last updated: 14 October 2026