Privacy in Exitus

1. Who is responsible

Responsible for the processing of data in the game “Exitus” (Android, package name net.silvra.exitus) and on its server exitus.silvra.net is:

Silvra
Email: exitus@silvra.net

Silvra is a non-commercial project, see the legal notice. Exitus is a hobby project within it. The website silvra.net has its own privacy policy.

2. The essentials

• You need neither an email address nor a name. On first launch the game creates an account that is tied only to a random identifier.
• Your progress is stored on our own server in Germany.
• For playing in groups, Exitus uses Epic Online Services by Epic Games.
• No ads, no tracking, no analytics or crash reporting services, no sale of data.
• You can delete your account at any time in the game, without the game by email.

3. Account and sign-in

On first launch the game creates a random identifier. It is not a hardware ID and belongs to the installation, not to your device: clearing the app data creates a new one. Our server stores it only as a hash, never in plain text.

The account also has an account ID, whose beginning the game shows as your player ID, a display name (until you choose one, an automatic name such as “Spieler 1a2b”), the times of creation and of the last sign-in, and your sign-in sessions, also only as hashes.

The legal basis is the contract for using the game (Art. 6(1)(b) GDPR).

4. Game progress

To keep your progress and to stop cheating, your game state is stored on the server: stash, backpack, gear and clothing, in-game money and bunker upgrades, excursions with group, loot and events such as death or return, values such as food, water and health, quick slots and statistics such as kills and deaths.

We log every booking of an item so that we can help with errors and fraud. A booking holds only the item, quantity, container, reason, time and, where relevant, the excursion: no IP address, no device identifier, no name and no free text.

Legal basis: Art. 6(1)(b) GDPR, for the log our legitimate interest in a fair game (Art. 6(1)(f) GDPR).

5. Playing in groups

Groups of up to four players and the connection between devices run on Epic Online Services (EOS) by Epic Games. Epic processes an EOS user ID; for sign-in, an ID token from our server (with account ID and display name) or, only when that is not possible, an EOS device ID (created with the device’s make and model); group data such as the join code, the members’ names and readiness and the excursion type; and the IP addresses of the devices involved.

Under the contract for the EOS services, Epic uses this data only to provide the services for the game. Epic may also process it in the USA. See the Epic Games privacy policy for details.

When devices connect directly, your fellow players learn your IP address. When the connection runs through an Epic relay server, they don’t. Fellow players also see your display name. Legal basis: Art. 6(1)(b) GDPR.

6. Logs and security

Against overload, our server limits requests per IP address. It keeps the address for this only in memory.

Our server logs requests with account ID, path, status and duration, without IP address and without content. We delete these entries after five weeks. In front of the server is a reverse proxy. It logs requests with IP address, time, path and status so that we can detect attacks and block suspicious addresses for a while. We delete this log after 14 days and the list of blocks after five weeks. Rare error messages of the reverse proxy, for example when the server does not answer, also contain the IP address and the address requested. They are in the server log and disappear with it after five weeks.

Legal basis: our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

7. What we don’t do

Exitus shows no ads, uses no advertising ID and includes no analytics, tracking or crash reporting services. We don’t sell data and we don’t build profiles.

8. On your device and on Google Play

On your device the game stores your settings, the random identifier and your sign-in session. This data leaves the device only as described above.

When you download Exitus from Google Play, Google processes data under its own privacy policy. If users allowed it in Android, Google gives us aggregated crash and performance statistics that don’t identify individual players.

9. Who receives data

• Fellow players see your display name and, with direct connections, your IP address (section 5).
• Our server is in Germany and we run it ourselves. No hosting provider is involved.
• Epic Games runs the services for playing in groups (section 5).
• Name resolution (DNS) for exitus.silvra.net runs through Cloudflare. The game’s traffic does not pass through Cloudflare.
• Authorities receive data only where a law obliges us to.

10. How long we keep data

Account and game progress

until you delete the account

Item bookings

after the account is deleted, without any link to you (section 11)

Sign-in sessions

at most 60 days

Protection against duplicate requests

24 hours

Server log

five weeks

Reverse proxy log with IP addresses

14 days

List of blocked IP addresses

five weeks

Backups

nightly, kept for 14 days

Group data at Epic

as long as the group exists

EOS user ID at Epic

stays at Epic, without an account behind it once yours is deleted

11. Deleting your account

You can delete your account at any time in the game under Settings → ACCOUNT → DELETE ACCOUNT, without the game by email. The item bookings then stay for statistics and against fraud, but without any link to you. What is deleted and what remains is described on the page Delete your account.

12. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on our legitimate interest (Art. 21). Write to exitus@silvra.net and include your player ID from the settings, as we know no name or email address for any account.

You may also lodge a complaint with a data protection authority, for example in the country where you live.

13. Children and young people

Exitus is meant for people aged 16 and over.

14. Security

The game talks to our server only over encrypted connections (TLS). The connections between the devices of a group are encrypted as well. Identifiers and sign-in sessions are stored on the server only as hashes. The server can only be reached through the reverse proxy, limits requests and blocks suspicious addresses.

15. Changes

If the game changes so that this policy is no longer accurate, we update it. The version on this page applies; the date is at the top.