Privacy

1. Controller

Responsible for processing personal data on this website is:

Phone

+49 170 8366182

Email

info@moon-labs.io

2. Hosting

The website and the Chronicle API run on a server of STRATO, in an EU data centre as agreed in the contract. STRATO processes the data on our behalf as a processor (Art. 28 GDPR).

Provider

STRATO GmbH

Address

Otto-Ostrowski-Straße 7, 10249 Berlin, Germany

Website

strato.de (opens in a new tab)

Your IP address reaches the server with every request. The API keeps it in memory only, to limit login and password-reset attempts (Art. 6(1)(f) GDPR, protection against abuse); it is not stored permanently.

3. Database

Accounts and game data are stored in MongoDB Atlas, AWS region Frankfurt (eu-central-1). MongoDB processes the data on our behalf as a processor (Art. 28 GDPR).

Provider

MongoDB Limited

Address

Building Two, Number One Ballsbridge, Ballsbridge, Dublin 4, D04 Y3X9, Ireland

Website

mongodb.com (opens in a new tab)

4. Accounts

For an account we process your player name, your email address and your password. The password is stored only as a bcrypt hash, never in readable form. We need this data to provide your account and the game (Art. 6(1)(b) GDPR). We delete your account on request — see “Your rights”.

4a. Discord account linking

For each login we store the device name, the platform, and the time of the first and the last login. This data is deleted when the login expires or is disconnected. See and disconnect your devices

4a. Discord account linking

If you choose to connect Discord, we send you to Discord to authorize the connection. We store your Discord account ID, username, display name and connection date with your Chronicle account until you disconnect it. These details are not shown on your public player profile. We do not store Discord access tokens or read your messages.

We use the identity information to provide the account-linking feature you request (Art. 6(1)(b) GDPR). The integration requests only the identify permission. It does not request your Discord email, message history or server membership. Temporary authorization tokens are used on the API server to retrieve your identity and are not stored in your account. Your link is stored with our database provider described above.

You can remove the stored link from your active Chronicle account using Disconnect Discord under Account → Connections. You can also request correction or deletion of the Discord data by contacting info@moon-labs.io.

When you authorize the connection, you interact directly with Discord. Discord processes data for its own service under its own responsibility. See the Discord privacy policy.

5. Public game data

Your player name, progression, perks and races, match history and match results are public by design: anyone can see them on your profile and on match pages. They are part of playing Chronicle (Art. 6(1)(b) GDPR) and of our legitimate interest in open player profiles and match records (Art. 6(1)(f) GDPR). Your email address is never shown.

6. Password-reset emails

If you ask for a password reset, we send a link that is valid for one hour to your email address (Art. 6(1)(b) GDPR). The email is sent through an SMTP provider:

Provider

STRATO GmbH

Address

Otto-Ostrowski-Straße 7, 10249 Berlin, Germany

Website

strato.de (opens in a new tab)

7. Cookies

This website sets only cookies that are strictly necessary for it to work (§ 25(2) TDDDG). No tracking or advertising cookies are used.

• chronicle_session — keeps you logged in. Strictly necessary; httpOnly, so page scripts cannot read it. Without “Remember me” it ends when you close the browser and the login ends after 1 day without activity; with “Remember me” it is stored for 30 days and the login ends after 30 days without activity (each visit extends it).
• ml_consent — stores your cookie choice. Strictly necessary; 182 days.

You can review your choice at any time:

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), notification of these (Art. 19), data portability (Art. 20) and to object (Art. 21). You can withdraw a consent at any time with effect for the future (Art. 7(3)). You may also lodge a complaint with a supervisory authority (Art. 77 GDPR).

For all privacy questions and requests, including deleting your account, write to info@moon-labs.io