Privacy Policy

1. Data protection at a glance

NanoSkyline is a browser game. We only process the data needed for your game account, for running the game and – if you buy credits – for payment processing. There are no advertising cookies and no third-party tracking services. Anonymous audience measurement with Umami on our own server only takes place if you agree to it (section 8a). Fonts are served from our own server.

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Web Nano - IT Solutions
Owner: Jozef Nano
Steinbach 8b
84329 Wurmannsquick
Germany
Email: info@web-nano.com

You can find further details in the Legal Notice.

3. Hosting and server log files

The provider of these pages automatically collects and stores information in so-called server log files, which your browser transmits automatically. This includes in particular browser type and version, operating system, referrer URL, host name of the accessing computer, time of the server request and IP address.

The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and stable operation of the website. Log files are deleted after 14 days at the latest unless they are needed to investigate a security incident.

4. Game account

To register for and use the game, we process:

• Email address (sign-in and contact regarding your account)
• Password, stored exclusively as a cryptographic hash
• Country (for your flag and the country leaderboard), language and display mode (light/dark)
• Game data: airlines, fleets, routes, finances, achievements, leaderboard positions, career and medals
• Time of your e-mail confirmation, your invite code and – if you were invited – who invited you
• Credit balance, credit history and your unlocks (e.g. liveries, season pass)

The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement). We store this data for as long as your account exists. You can delete your account yourself in your profile at any time or request deletion by emailing the address above. In your profile you can also download all your data as a file; statutory retention obligations (see section 6) remain unaffected.

4a. Service e-mails

We only send e-mails your account needs: the link to confirm your e-mail address (valid for 3 days), the link to reset your password (valid for 1 hour) and, after a purchase, the order confirmation. There is no newsletter and no advertising e-mail. The links contain random one-time codes that we store only as a hash. The legal basis is Art. 6(1)(b) GDPR.

4b. Inviting friends

Every account has a personal invite link. If someone signs up through it, we store with the new account who invited them. As soon as the new person confirms their e-mail address, we credit both with the bonus credits. The inviter only sees the number of invited and confirmed accounts, not their e-mail addresses. The legal basis is Art. 6(1)(b) GDPR.

4c. Protection against abuse

To protect accounts and the game against automated attacks, we limit sign-in and sign-up attempts per IP address and e-mail address. For this, the IP address is only kept in the server's memory for at most 15 minutes. The sign-up form also contains an invisible check field and a signed timestamp. We do not use third-party captcha services. If we suspend an account for a breach of the terms, we store the time and reason of the suspension. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a safe and fair game.

5. Public game content and chat

Your airline name, code, slogan, livery, your country (as a flag), leaderboard positions and messages in the world chat are visible to the other players in the same world. Your email address is never shown. Chat messages are stored with the world and archived when a round ends. The legal basis is Art. 6(1)(b) GDPR.

6. Purchase of credits and payment processing via Stripe

You can optionally buy credits. Payments are processed by Stripe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. When you pay, you are redirected to a Stripe page. There, Stripe processes your name, email address, billing address, payment details, IP address and the amount and time of the purchase. We do not receive your card details.

For each purchase we store your account ID, the package purchased, the amount, the time, the Stripe payment reference and the time at which you consented to immediate provision.

The legal bases are Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (retention obligations under tax and commercial law). We keep accounting records for the period required by law (up to ten years depending on the document, under § 147 AO (German Fiscal Code) and § 257 HGB (German Commercial Code)).

Stripe may also transfer data to Stripe, Inc. in the USA. Stripe is certified under the EU-US Data Privacy Framework and additionally uses EU standard contractual clauses. More information: https://stripe.com/de/privacy

7. Map display (OpenFreeMap)

To display the maps in the game, your browser loads map tiles, fonts and icons from tiles.openfreemap.org. In doing so, your IP address is transmitted to the operator of OpenFreeMap. No cookies are set in the process. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is displaying a world map, which is essential to the game. Map data © OpenStreetMap contributors.

8. Cookies

We use only technically necessary cookies for sign-in, language, display mode and your cookie choice. No third-party cookies and no tracking or advertising cookies are set. The legal basis is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6(1)(b) and (f) GDPR. You can find an overview on the “Cookies” page.

8a. Audience measurement with Umami (consent only)

If you choose “Allow statistics” in the cookie banner, we use Umami to measure which pages are visited and how often. Umami runs on our own server; no data is passed to third parties. Umami sets no cookies and stores nothing on your device. It records the page visited, referring page, browser, operating system, device type, screen size and approximate country; your IP address is only used briefly to form an anonymous identifier that changes daily and is not stored. If your browser sends “Do Not Track”, no measurement takes place.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via “Cookie settings” at the bottom of every page; measurement then stops immediately. We keep statistics data for at most 24 months.

9. Contact requests

If you contact us by email, the information you provide will be stored in order to process your request. We will not pass this data on without your consent.

10. Your rights

Under the GDPR you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)

To exercise these rights, an informal message to the contact address above is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.