LEGAL
Privacy policy
Last updated: 17 October 2026
1. Controller
The controller responsible for data processing on this website is:
Kevin Bethge, Mittelweg 1A, 38268 Lengede, Germany
Email: kontakt@home-it.site
2. Summary
This website does not set cookies – with one exception: in the beta area (rifthaul.home-it.site/beta/) we set a technically necessary sign-in cookie after you sign in (section 5). The music player on the home page remembers your setting without a cookie: as soon as you pause the music or change the volume, the page stores only this setting in your browser's storage (localStorage), that is, whether the music is paused and how loud it plays. This way the music does not start unexpectedly on your next visit and plays at the volume you chose. This information contains no identifier, is not sent to us and remains stored until you delete the site data in your browser. This storage is strictly necessary for the setting you requested (Section 25(2) no. 2 TDDDG). We do not use analytics or tracking tools and do not load content from third-party servers; fonts are also hosted on our own server. We only process personal data where this is technically necessary to deliver the website (server log files), when you send us an email or when you take part in the beta test of the app.
3. Hosting and server log files
This website runs on the controller’s own server in Germany; no external hosting provider is involved.
Each time you access the website, the web server automatically stores the following data in log files:
- IP address of the requesting device,
- date and time of access,
- requested page or file, request method, status code and amount of data transferred,
- the previously visited page (referrer), if transmitted by your browser,
- browser type and operating system (user agent).
The purpose is to deliver the website and to keep it secure and stable, in particular to detect and prevent attacks and abuse and to troubleshoot errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website. Log files are deleted automatically after 7 days. If an entry is needed to investigate a specific security incident, we keep it until the investigation is complete. We do not combine this data with other data or use it to create user profiles.
4. Contact by email
If you send us an email, we process your email address, your name (if provided) and the content of your message in order to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual steps, and otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). We delete the data once your request has been dealt with, unless statutory retention obligations apply.
Emails are stored by our email provider STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which processes them on our behalf (Art. 28 GDPR).
5. Beta test of the app
Before release on Google Play and the App Store, the app “RIFT HAUL: Salvage Protocol” for Android and iPhone can be tested as a beta version. Participation is free of charge. For Android, you request participation via our form. For iPhone, you can do the same or join the test directly via our public TestFlight link without a request (section 5.8). For requests via the form, participation is open from age 16 and places are limited to 20. Requests, selection, the tester area and the beta emails run on our own server in Germany (section 3); we do not use any external form, database, analytics or tracking services for this. You receive the test version itself via a closed test on Google Play for Android, or via Apple's TestFlight programme for iPhone (section 5.8).
5.1 Request and selection. When you request access via the form at rifthaul.home-it.site/en/beta/, we process:
- required details: your name or nickname, your email address, your platform (Android or iPhone), for Android the email address of the Google account on your phone, and your confirmation that you are at least 16 years old,
- optional details: your phone model, for Android your Android version and whether you want to be told about new versions by email, as well as how you found the game and your message to us,
- the language of your request, the time of your request and confirmation, and the version of this privacy policy in force at that time.
We use the required details to decide on your participation, give you access to the test version for your platform and stay in touch with you during the test. We need your Google account address to match your membership in our test group at Google to your request here (section 5.8); we do not pass it on to Google. The legal basis is Art. 6(1)(b) GDPR (carrying out the participation you requested). You cannot take part without the required details. The optional details help us select testers with different devices and reproduce bugs. The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest is a meaningful test. Section 5.6 applies to emails about new versions.
We decide on every request personally; no automated decision-making takes place. If all places are taken, your request stays on the waiting list.
5.2 Confirming your email address. After your request we send you a confirmation link (double opt-in). We only process your request once you have confirmed it. This prevents anyone from entering someone else's address. Unconfirmed requests are deleted automatically after 48 hours.
Personal invitation. Instead of using the form, we may also invite you personally. We only do this for people we know personally who have told us they would like to take part in the test; your email address then comes from our personal contact with you. In that case we initially store only your email address, your name (if known), the language and the time of the invitation, and send you an invitation with a personal link. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to invite people who have shown interest in the test. You may object to this at any time without giving reasons, by choosing “No thanks” on the invitation page or by emailing beta@home-it.site; we will then delete your details promptly. You only take part once you accept the invitation via the link, confirm your name, choose your platform (with your Google account address for Android) and state that you are at least 16 years old; from then on everything else in this section applies as after approval. If you do not accept, we delete your details automatically 14 days after the last invitation.
5.3 Abuse protection. To protect the form and sign-in against automated access, the beta service counts requests per IP address for no longer than one hour, in memory only. The beta service does not store IP addresses in its database. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protection against spam and attacks. This does not affect the server log files described in section 3.
5.4 Tester area and cookies. Once approved, you receive a personal link to your tester area by email. When you sign in with it, we set the cookie “rh_beta”. It only contains a random identifier of your sign-in, applies only under rifthaul.home-it.site/beta/ and is stored for no more than 365 days. We delete it when you sign out or leave the beta. For each sign-in we store when it was created and last used. The administration area, which only the publisher uses, has its own sign-in cookie lasting no more than 12 hours; testers and visitors never receive it. Both cookies are strictly necessary to provide the protected area with your test links and the download that you expressly wish to use (Section 25(2) no. 2 TDDDG). The related processing is based on Art. 6(1)(b) GDPR. We do not use any other cookies, analytics or tracking tools here either.
5.5 Downloads and feedback. If you download the Android version from our server in the tester area, we store which beta version you downloaded and when. We also store when you last used the tester area, so we can see who has already updated. Feedback you send in the tester area is stored with its category, app version and phone model, plus a screenshot if you add one. We remove metadata from screenshots, such as location or camera data. Please make sure a screenshot does not show private content, for example notifications on screen. Feedback you send us via Google Play or TestFlight reaches us through the respective service. We use all feedback solely to improve the game and evaluate it without your name or email address. The legal basis is Art. 6(1)(b) GDPR.
5.6 Emails. We send you the emails the test requires: confirmation of your address, acknowledgement of your request, our decision with your personal access link and the links to the test version (section 5.8), sign-in links you request and notices about your access. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for a personal invitation (see “Personal invitation” under 5.2). We only send notices about new beta versions to Android testers who selected this in the form or in the tester area (consent, Art. 6(1)(a) GDPR); on iPhone, TestFlight announces new versions itself. You can unsubscribe at any time in the tester area under “Settings”. Sending and the mailbox (beta@home-it.site) are provided by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, acting on our behalf (Art. 28 GDPR). Section 4 applies to your replies to this address.
5.7 Update check in the beta app. Each time it starts, the Android version you download from our server in the tester area fetches the file rifthaul.home-it.site/beta/latest.json once to tell you about new beta versions. The same happens when you choose “Check for updates” in the app settings. No sign-in is needed for this. The app itself does not transmit any identifiers, save data or usage data. As with any request, our server records the data listed in section 3, including IP address, time and user agent, and deletes it after 7 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is reliably informing testers about fixes and new versions. The versions from Google Play and TestFlight do not contain this check.
5.8 Test version via Google Play and TestFlight. You receive the test version through Google's and Apple's testing programmes. We do not pass any of your data on to Google or Apple for this: you join yourself with your own account.
- Android: Once approved, we email you the link to our test group on Google Groups and the link to the closed test on Google Play. You join the group with your Google account. As the group's managers, we see the name and email address of your Google account and match them to your request. Google stores your membership in the group and you can install the test version from Google Play. Only we as managers can see the member list, not the other members; we do not send any messages through the group. The legal basis for matching and managing the group is Art. 6(1)(b) GDPR. In addition, you can download the Android version in the tester area for as long as we offer this (sections 5.5 and 5.7).
- iPhone: Our test in Apple's TestFlight app has a public link (testflight.apple.com/join/4pbQvrp6). You will find it on our home page and, after approval via the form, also in our email. You install TestFlight and join yourself with your Apple Account; no request to us is needed. If you join via this link, Apple does not tell us your name or email address; you appear to us as “anonymous”. The information Apple provides to us from TestFlight is described in section 13 of the app privacy policy (rifthaul.home-it.site/en/app-privacy/).
- Providers: Google Groups and Google Play are operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and TestFlight by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Both process your data there under their own responsibility and in accordance with their own terms and privacy policies (policies.google.com/privacy, apple.com/legal/privacy). Data may be transferred to the USA in this process. Google LLC is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR).
- Ending: You can leave the group or the test in TestFlight yourself at any time; your access to the test version then ends. If you leave the beta or we revoke your access, we remove you from the Google group; please also end your participation in the TestFlight app. What the test version itself processes is governed by the app privacy policy.
5.9 Retention.
- Unconfirmed requests: 48 hours after the request.
- Invitations not accepted: 14 days after the last invitation.
- Declined requests and revoked access: 30 days after our decision.
- Requests on the waiting list: until we decide, at the latest until the end of the beta test.
- Participating testers: until you leave the beta, at the latest 3 months after the beta test ends.
- Membership in the Google group: until you leave the group or the beta or we revoke your access, at the latest until the end of the beta test; we then remove you from the group.
- TestFlight: as described in section 13 of the app privacy policy.
- “Leave beta” in the tester area (or a short email to us) immediately deletes your details, sign-ins, downloads, feedback and screenshots; we remove you from the Google group promptly. You receive a final confirmation by email.
- Administration log: we log actions such as approval, decline, revocation or deletion for 12 months so that we can document our administration and investigate abuse (Art. 6(1)(f) GDPR). In this log you appear only as an internal number, not by name or email address.
- Backups: our server backs up its data daily, including an encrypted off-site copy at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, stored in the EU. Hetzner acts on our behalf (Art. 28 GDPR). Deleted data disappears from these backups within 5 weeks at the latest.
5.10 Recipients and your rights. Your data is stored on our own server in Germany. It is only passed on to STRATO GmbH for sending emails (section 5.6) and to Hetzner Online GmbH for encrypted backups (section 5.9), both as processors. We do not pass any data on to Google or Apple; you sign up for the test there yourself, and Google stores your membership in our test group (section 5.8). We do not sell data or pass it on for advertising. Your rights under section 8 apply here as well. The easiest way is to reply to one of our emails or write to kontakt@home-it.site.
6. Links to app stores and TestFlight
This website contains a simple link to our public test in Apple's TestFlight (testflight.apple.com). Once the game is available, simple links to Google Play and the App Store will be added. No data is transferred to these providers when you visit our pages. Only when you click such a link do you leave our website; the respective provider is responsible for any data processing there. Section 5.8 applies to taking part in the test via TestFlight.
7. Privacy in the app
A separate privacy policy applies to the game “RIFT HAUL: Salvage Protocol”: App privacy policy.
For the Android version you download in the beta tester area, section 5.7 (update check) also applies. Section 5.8 applies to taking part in the test via Google Play and TestFlight.
8. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). Simply contact us at the email address above.
Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us: Der Landesbeauftragte für den Datenschutz Niedersachsen (Data Protection Commissioner of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany.
9. Further information
You are not legally or contractually obliged to provide us with personal data. However, the website cannot be delivered without processing your IP address. No automated decision-making, including profiling, takes place.