Privacy Policy

1. Controller

The controller responsible for the processing of personal data described in this Privacy Policy is:

Daniel Bechtold

Nikolaus-Fey-Strasse 6

97241 Bergtheim

Germany

Email: mail@playsubversive.com

Website: https://playsubversive.com

Daniel Bechtold operates the Subversive website as a private individual. "Subversive" refers to the game project and related website, waitlist, and communications.

If you have questions about privacy or wish to exercise your rights, you can contact us at mail@playsubversive.com.

2. Scope Of This Privacy Policy

This Privacy Policy applies to the Subversive website, the Subversive waitlist, verification emails, waitlist-related emails, and emails you send to mail@playsubversive.com.

Subversive is a game currently in development and intended for desktop download in the future. The website currently provides information about the project and allows visitors to join the waitlist.

Steam, Discord, or other community profiles may be added later. Where such third-party links are provided, those services will be operated by their respective providers and their own privacy policies will apply.

3. Minimum Age

The waitlist is not intended for children under 16 years of age.

If you are under 16, you must not submit your email address or join the waitlist unless your parent or legal guardian has allowed you to do so, where such consent is required by applicable law.

If we become aware that we have collected personal data from a child under 16 without the required permission, we will delete that data.

4. Local Browser Storage

We do not use cookies, advertising pixels, analytics cookies, cross-site tracking, or profiling technologies.

We may use a temporary first-party sessionStorage entry to remember whether a visitor has already seen a non-essential introductory animation during the current browser session. This prevents the same animation from being shown repeatedly during the same visit.

This information is stored only on your device and is deleted automatically when the browser session ends. It is not used to identify you, track you across websites, create a profile, measure advertising, or share data with third parties.

We do not sell personal data and we do not share personal data for third-party advertising.

When you visit the website, technical request data such as your IP address, browser information, requested URL, date and time of access, and security-related metadata may be processed as necessary to deliver, operate, and secure the website. This processing is technically necessary for making the website available and protecting it against abuse, attacks, and misuse.

5. Website Analytics

For visitors located in the European Union or the European Economic Area, we do not use website analytics tracking.

For visitors outside the European Union and the European Economic Area, we may use Cloudflare Web Analytics to understand aggregate website performance and basic usage. This may include information such as page views, referrers, browser type, device type, country-level location, and performance metrics.

Cloudflare Web Analytics is designed not to use cookies or browser storage and not to identify visitors across websites. Cloudflare may receive technical request data, such as IP addresses, as part of normal network handling and security processing.

The legal basis, where applicable, is our legitimate interest in operating, securing, and improving the website without using invasive tracking technologies, Art. 6(1)(f) GDPR.

6. Waitlist Registration And Double Opt-In

If you enter your email address in the waitlist form, we use that email address to process your waitlist request, send a verification email, confirm your subscription after verification, and send Subversive-related emails.

These emails may include waitlist confirmations, playable build updates, demo access information, playtest invitations, launch alerts, product updates, newsletter content, offers, and related operational messages.

Registration uses double opt-in. This means that submitting the form alone does not place you on the active waitlist. You are added to the active waitlist only after you confirm your email address through the verification link or verification process sent to you.

Before verification, your email address is processed only as necessary to send the verification email, allow resending of the verification email, protect the signup process from abuse, and complete the double opt-in process. It is not used for updates, newsletters, offers, or launch communications unless and until the email address has been verified.

The legal basis for sending waitlist, newsletter, demo, playtest, launch, product update, and offer emails is your consent, Art. 6(1)(a) GDPR.

The legal basis for processing temporary verification records, resend counters, abuse-prevention data, and technical metadata required to operate and document the double opt-in process is our legitimate interest in operating a reliable and abuse-resistant waitlist, Art. 6(1)(f) GDPR.

You can withdraw your consent at any time with effect for the future by using the unsubscribe link provided in our emails or by contacting mail@playsubversive.com. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

7. Data Processed For The Waitlist

When you use the waitlist form, we may process the following data:

• Email address
• Registration timestamp
• Verification status
• Verification timestamp, if verification is completed
• Verification code or token information
• Automatic deletion timestamp for unverified waitlist submissions
• Number of verification email resend attempts
• Technical metadata required to operate, secure, and troubleshoot the signup process
• Unsubscribe status and unsubscribe timestamp, where applicable

Verification links remain usable while the unverified waitlist submission still exists. Unverified waitlist submissions are automatically deleted after 24 hours if verification is not completed.

Unverified waitlist submissions are kept for a maximum of 24 hours and are then deleted if verification is not completed.

Verification emails may be resent. To prevent abuse, we limit resend attempts. If there are more than 10 resend attempts for an email address or signup process, we may stop sending further verification emails.

8. Email Storage In Cloudflare D1

After successful double opt-in verification, we store your email address and related waitlist metadata in Cloudflare D1 for the purpose of maintaining the Subversive waitlist and sending the communications you requested.

Cloudflare D1 is used together with Cloudflare Workers, which process the signup logic, verification flow, unsubscribe flow, and related waitlist functionality.

We do not store your email address in Cloudflare D1 for resale, third-party advertising, or unrelated profiling.

9. Email Delivery Through AWS SES

We use Amazon Simple Email Service, operated by Amazon Web Services, to send verification emails, waitlist emails, newsletters, launch emails, product updates, offers, unsubscribe confirmations, and related operational emails.

AWS SES is currently used in the AWS region us-east-1, North Virginia, United States.

For email delivery, AWS SES processes the email address, message content, and technical delivery data required to send, route, and troubleshoot emails. AWS acts as a service provider or processor for these email delivery activities.

10. Incoming Emails And Cloudflare Email Routing

If you contact us by email at mail@playsubversive.com, we process the personal data contained in your email, such as your email address, name if provided, message content, and technical email metadata.

We use Cloudflare Email Routing for email forwarding. Cloudflare may process email routing data as necessary to forward incoming emails to the destination mailbox.

The legal basis for processing incoming emails is our legitimate interest in receiving, managing, and responding to communications, Art. 6(1)(f) GDPR. If your message relates to a contract or pre-contractual request, the legal basis may also be Art. 6(1)(b) GDPR.

11. Cloudflare Hosting, Workers, D1, And Security Features

We use Cloudflare for hosting-related infrastructure, Cloudflare Workers, Cloudflare D1, email routing, performance, availability, and website security.

Cloudflare may process technical request data such as IP addresses, request headers, browser and device information, requested URLs, timestamps, security event data, and other metadata required to deliver and protect the website.

We use Cloudflare security features, including rate limiting and other abuse-prevention and security mechanisms, to protect the website and waitlist signup process against spam, automated abuse, denial-of-service attacks, and other malicious activity.

The legal basis for this processing is our legitimate interest in providing a secure, reliable, and abuse-resistant website and waitlist, Art. 6(1)(f) GDPR.

12. Service Providers And International Transfers

We use the following service providers for limited operational purposes:

Cloudflare, Inc. and affiliated companies:

• Website delivery and security
• Cloudflare Workers
• Cloudflare D1
• Rate limiting and abuse prevention
• Cloudflare Email Routing
• Cloudflare Web Analytics for non-EU and non-EEA visitors, where enabled

Amazon Web Services, Inc. and affiliated companies:

• Email delivery through Amazon Simple Email Service

These providers may process personal data through affiliated companies and infrastructure in countries outside your country of residence, including countries outside the European Union and the European Economic Area.

Where personal data is transferred internationally, we rely on appropriate safeguards, including data processing agreements, the European Commission's Standard Contractual Clauses, adequacy decisions where applicable, and supplementary measures where required by applicable data protection law.

We do not permit our service providers to use your personal data for their own advertising or unrelated marketing purposes.

13. Retention And Deletion

Unverified waitlist submissions are deleted no later than 24 hours after submission if verification is not completed.

Verification links remain usable while the unverified waitlist submission still exists. If the pending submission has already been deleted, a new verification email must be requested if you still want to complete registration.

Verified waitlist email addresses are kept for as long as you remain subscribed to Subversive communications. After the product launch, we may continue to use the verified email address to send newsletters, product updates, offers, and related Subversive communications, unless you unsubscribe or request deletion.

If you unsubscribe through an email unsubscribe link, you will be asked to confirm the unsubscribe request. After confirmation, your email address will be removed from the active mailing list and you will no longer receive Subversive waitlist, newsletter, launch, product update, or offer emails. We may send a final confirmation email to confirm that the unsubscribe request has been processed.

If you request deletion, we will delete your personal data unless we are legally required or have a legitimate need to keep limited records, for example to document compliance, prevent abuse, or resolve disputes.

14. Your Rights

Depending on your location and subject to applicable law, you may have the following rights:

• Right of access to your personal data
• Right to correction of inaccurate personal data
• Right to deletion of your personal data
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time with effect for the future

You may exercise your rights by contacting mail@playsubversive.com.

If you are located in the European Union or the European Economic Area, you also have the right to lodge a complaint with a competent data protection authority.

15. Security

We use reasonable technical and organizational measures designed to protect personal data processed through the website and waitlist against unauthorized access, loss, misuse, alteration, or disclosure.

These measures include using Cloudflare security features, rate limiting, limited data collection, double opt-in verification, verification code expiry, and resend limits.

No internet service can be guaranteed to be completely secure. We therefore limit the personal data we collect and process it only for the purposes described in this Privacy Policy.

16. Changes To This Privacy Policy

We may update this Privacy Policy if our website, waitlist process, game development process, service providers, technical infrastructure, or legal obligations change.

The version published on this page is the current version. Material changes will be reflected by updating the date above.