War of the Ring

Draft for review · last updated 3 November 2026

Privacy notice

War of the Ring at wotr.behindmedia.com is a free, non-commercial fan project. It is run by Werner Altewischer, a private person in the Netherlands, who is responsible for your data (the "controller"). Questions and requests: werner@behindmedia.com.

In short: we keep what the site needs to run your account and your games, nothing for advertising, and no tracking. Your email address is never shown to other players.

What we keep, and why

• Your account: your username (other members see it), your email address (to log in, for the mails about your account, the notification mails you turn on, and answers to your reports and feedback), your password as a one-way hash (never the password itself), when you signed up, verified your email, last logged in and were last seen, the invite code you used and the IP address you signed up from. Why: to give you the account you asked for.
• Your logins: for each device you log in on, the kind (browser or app), the device as your browser or the app describes it, the IP address at login, and when it was made and last used. Why: to keep you logged in and to let you (and the admin) end a session.
• Your games: every move with its time, the clocks, the result, the chat messages you write, your ratings and their history, statistics computed from the games, and reviews of finished games uploaded by a player. Why: to play, and to show history, ratings, replays and statistics, which are part of the service.
• The lobby: your open challenges, invitations, quick-match waits, your notification settings, the side you last played, and which notification mails were sent to you (to send no more than a few). Why: matching and notifications. Notification mails are off until you turn them on, and each one has a link to turn it off.
• Fair play: the players you block, reports you file or that are filed about you (with the game and its recent chat when the report comes from a game), and the admin's actions on your account (a muted chat, a warning, a blocked account). Why: to keep the games fair and friendly.
• Games against the bot: Games you play against the bot while logged in are kept to improve the bot. At the end of such a game the app sends it here: the bot's level, your side, the result and the turn, every move, whether the game was loaded from a saved game, at which moves you asked for a suggestion, and the app's version and platform. They are part of your data download and are deleted with your account. Why: to train and test the bot on real play (our legitimate interest).
• Bug reports: what you write, the app's version and platform (for a browser, its user agent), and the game you attach. Why: to fix the game.
• Feedback: what you write under Send feedback, the feeling you pick (if any), whether we may answer you by mail, the app's version, platform and the screen you were on, the game if you tick "include the current game", and our answers to you. It stays on our server and is not sent to GitHub. Why: to learn what you like and what to improve (our legitimate interest), and to answer you if you allow it.
• Errors and usage figures, made by the site itself (no outside analytics service, no extra cookie): when the app hits an error it sends a report (the cleaned error message and where in the code it happened, the app's version, the platform, the browser's name and major version, which screen, whether a game was on, and your account if you are logged in); errors are grouped by kind, without accounts. The app also counts a few things the server can't see (a game against the bot started or finished, with its level, side, result and turns; the tutorial; a game review run), without your account. The server notes which accounts were active each day, only to count them. From all this it keeps daily totals (counts only), and it notes its own starts and stops. Not collected by the app: page views, clicks, your IP address (only held in memory for rate limits), your full browser identification, game content. Why: to find and fix errors and to see how the site is used (our legitimate interest).
• Invite requests: if you ask for an invite on the site, your name, your email address, your message (if you write one), when you asked and confirmed, what the admin decided (and the invite sent), and a keyed hash (a fingerprint) of your IP address, not the address itself, to limit and count requests from one address. Your request reaches the admin only once you confirm your email with the link we send. Why: to review your request and send you an invite.
• Invites to friends: the invite links you make for friends (when, until when, whether one was used and by which username, revoked or mailed), and, for an account made with such a link, who invited it. If you ask us to mail a link to a friend, we use the friend's address for that one mail only: it is not stored, and our logs don't name it. The mail says who sent the invite. Why: to send the invitations you ask for, and to keep them from being misused (our legitimate interest).
• The bot referee: if you make matches between computer opponents (/referee), each match (its name, its rules, when it was made, started and ended, who made it), the names and versions the two bots give themselves, each game's result, statistics and record, and our referee's log of what the bots and the referee said to each other (kept 14 days; only the match's maker can download it); the seat tokens and your API keys only as one-way hashes, with each key's name and when it was made, last used and revoked. Members see the matches that are running or over, with your username as their maker. If you run a bot that connects to the referee, we see the address it connects from (held in memory to limit wrong tokens, and in the technical logs below). Why: to run the matches you ask for and show their results to members.
• Bots you can play: a bot tester may make bot accounts that play people online through the referee. A bot account is yours: its name, description and greeting (its one chat message, at the start of a game; the admin may clear it), when it was made, approved or suspended, the name and version it gives itself, and its key only as a one-way hash. Members see a bot as "Name (bot)" with you as its owner. When you play a bot, the game is an ordinary game (never rated): the bot receives only its own side's view of it and the moves, never your cards, your chat or your email; its owner may download the bot's own log of the game (kept 14 days). Deleting your account deletes your bots. Why: to let people play computer opponents online, and to keep them honest (our legitimate interest).
• The admin's log: what the admin does (for example renaming an account or ending its sessions), with the admin's IP address. Why: accountability.
• Technical logs: the web server logs each request of every visitor, member or not, including visitors of pages we share privately (your IP address, the time, the address asked for, the answer, your browser and the page that linked here), and the game server logs events (such as a login by username, or a mail sent to an email address). The admin views access statistics made from the web server's log: daily counts (visitors, pages, the sites that linked here, browsers, countries, people and bots), without IP addresses; and, for a few kinds of requests (the login, sign-up and invite-request pages, pages we share privately, admin logins, and errors), the request itself with its IP address. From your IP address the server derives an approximate location (country and city) using a database on our own server, without sending your address anywhere. These requests with their IP addresses and locations are kept 30 days. Failed logins and similar are counted per IP address in memory for 15 minutes to stop abuse. Why: security, finding faults, and seeing how the site is found and used (our legitimate interest).

Our legal grounds (GDPR article 6): the account, games, lobby and account mails are what you sign up for (performing our agreement with you); security, logs, fair play, bug fixing, error reports and usage figures are our legitimate interest in a safe, working site; notification mails are your choice (consent), which you can withdraw at any time. An invite request is handled on your consent and as a step you ask for before signing up; withdraw it by writing to us and it is deleted.

Who sees what

Other members see your username, your online status (in the lobby or playing), your ratings, profile, statistics and finished games (anyone logged in can replay them), your open challenges, and your badges (small icons after your name: those the admin gives, such as the site's creator's or Founding tester; Bot tester, if the admin lets you test the computer opponents; and Recruiter, which you earn when someone you invited has played five games online). The chat of a game is seen by its two players and by members watching it; finished games' chat only by their players. Games may be watched by other members unless you turn that off when you create the game. If you signed up with a member's invite link, that member sees your username next to the link. Nobody but you and the admin sees your email address. You can block a player: neither of you can then challenge the other, and their chat is hidden from you.

Who helps us run the site

• Hetzner Online GmbH (Germany) hosts the server, its database and its backups. A copy of the nightly backups is kept on a computer of BehindMedia's own, on a disk only we can reach.
• Strato AG (Germany) sends the site's mails.
• GitHub, Inc. (USA) holds the bug reports as issues in a private repository, with your username only, never your email address.
• The app may download a font from Google (fonts.gstatic.com) to show a character its own fonts lack; Google then sees your IP address. No other outside service is used, and nothing is sold or shared for advertising.

How long we keep it

• Your account, until you delete it.
• Logins: until you log out, or 180 days after last use. Sign-ups not confirmed: 48 hours. Password-reset links: 1 hour; links to confirm a new email: 48 hours.
• Games, chat, ratings and statistics: as long as the site runs, since they are also your opponents' history. When you delete your account they stay, but anonymised (see below).
• Invite requests: not confirmed, 48 hours; approved or declined, 90 days after the decision. After that only a count remains (how many requests, by month and outcome). If you sign up with the same email, your request is part of your data download and is deleted with your account.
• Technical logs: up to 30 days; so are the requests with their IP address and approximate location in the access statistics. The daily access counts (no IP addresses): kept.
• Error reports (with your account): 90 days. Error groups (no account): until the error is fixed, then 90 days. Usage counts sent by the app (no account): 30 days. Who was active on a day: two days, then only the number. Daily totals (counts only): kept. The server's starts and stops: 90 days.
• Backups: the server is backed up every night, and backups (also their copy on our own computer) are deleted after 14 days. Data you delete can therefore remain in a backup for up to 14 days, after which it is gone.
• Bug reports, player reports and the admin's records: as long as they are needed for the game and for fair play. A bug report's GitHub issue keeps the username you had when you sent it.
• Feedback and our answers to it: until we have dealt with it and delete it, at the latest when you delete your account.

Cookies and your browser

Only cookies the site needs: wotr_session keeps you logged in (it lasts up to 400 days in your browser; the server ends sessions unused for 180 days); the admin's pages use wotr_admin and wotr_admin_login, for the admin only. No tracking, no outside analytics (only the site's own counts above), no advertising, no third-party cookies. The app keeps your settings, saved games and reviews of games against the bot in your browser's own storage; they stay on your device unless you attach a game to a bug report or to feedback.

Your rights

• See and download your data: Account, then Download my data gives you everything about your account as a JSON file.
• Correct it: change your email or password on the Account page; for your username, write to us.
• Delete it: Account, then Delete my account. Your email address, password, logins, settings, blocks, challenges and invitations are removed; games in progress are resigned (or cancelled if nobody had joined); your account becomes "Deleted player" so your opponents' games, ratings and replays stay whole; your chat messages read "(deleted)"; invite links you made that were not used yet stop working; your API keys for the bot referee are deleted, and matches you made stay with their maker shown as "(deleted)"; your bot accounts are deleted too. We mail a confirmation to your address first. Your feedback is deleted. Bug reports keep their text without your email.
• Object, restrict or take your data elsewhere: write to us; the download above is in a common format.
• Complain: to us first, or to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

The site is not meant for children under 16. We answer requests within a month.