Privacy Policy

1. Controller

The controller responsible for data processing on this website (overcomingwilderness.com, including its subdomains) and for the Overcoming Wilderness game services is:

2. Website: hosting and server log files

This website is hosted on a virtual private server rented from Hostinger International Ltd. (61 Lordou Vironos Street, 6023 Larnaca, Cyprus), acting as our processor under a data processing agreement (Art. 28 GDPR).

When you visit the site, the web server automatically records technical access data in log files: the requested URL, date and time, transferred data volume, HTTP status, the referring page, your browser and operating system (user agent) and your IP address. This data is technically necessary to deliver the website and is used solely to ensure the stability and security of the service (e.g. detecting attacks and abuse). The legal basis is our legitimate interest in the secure and reliable operation of the site (Art. 6 (1) (f) GDPR). Log files are deleted on a rolling basis, at the latest after 30 days, unless a specific incident requires longer retention as evidence.

3. No cookies, no tracking

This website sets no cookies, uses no analytics or tracking tools, embeds no third-party fonts, scripts or media, and stores nothing in your browser's local storage. That is why you do not see a cookie banner — there is nothing to consent to.

4. Downloads via GitHub

The download buttons link to release files hosted on GitHub (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). When you click a download link, your browser connects directly to GitHub's servers, which transmits your IP address and technical request data to GitHub. This only happens when you actively click a download link; no data flows to GitHub while you merely browse this site. GitHub processes this data under its own privacy statement. Transfers to the USA are safeguarded by GitHub's certification under the EU-U.S. Data Privacy Framework and/or EU standard contractual clauses.

5. Game account and multiplayer (OvercomingWilderness account)

Playing single-player requires no account and transmits no personal data. For online multiplayer you can create an OvercomingWilderness account. In that case we process:

• Email address — for account verification, password resets and important service messages (transactional emails are sent through our processor Brevo, Sendinblue GmbH, Berlin);
• Username — your public in-game identity;
• Password — stored exclusively as a salted cryptographic hash (Argon2id); we never store or see your plain-text password;
• Session and device data — active login sessions with a device label and last-seen time, so you can review and revoke devices in the game;
• IP addresses and technical connection data — processed transiently when you connect, for authentication, abuse prevention (e.g. rate limiting, ban enforcement) and service security;
• Gameplay data on multiplayer servers — your player name, position and world interactions (e.g. placed blocks, inventory) are processed and saved as part of the world you play on.

Legal bases: performance of the contract, i.e. providing the account and multiplayer service you request (Art. 6 (1) (b) GDPR), and our legitimate interest in a secure, cheat-free and abuse-free service (Art. 6 (1) (f) GDPR). All account and multiplayer traffic is encrypted in transit (TLS).

Retention: account data is stored for as long as your account exists. You can request deletion of your account at any time by emailing support@overcomingwilderness.com from the registered address; your data will then be deleted unless and to the extent a legal obligation or the documentation of an enforced ban requires limited further storage.

6. Launcher and in-game update check

The launcher (and the game's update notification) checks for new versions by querying release information hosted on GitHub. This transmits your IP address and a standard HTTP request to GitHub (see section 4). No account data, gameplay data or other personal information is sent with the update check.

7. Recipients of personal data

We share personal data only with the processors necessary to run the service:

Beyond this, data is disclosed only if we are legally required to do so.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• withdraw any consent at any time with effect for the future (Art. 7 (3)).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence or place of the alleged infringement.

9. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Automated anti-abuse measures (e.g. rate limiting) are purely technical protections.

10. Changes to this policy

We will update this privacy policy whenever the service changes — for example when new online features launch. The current version is always available on this page; the date above reflects the last revision.