Kolonie 2
Privacy policy
Version of 20 October 2026. Applies to Kolonie 2 at mars.kolonie.app. The closed test world (beta.mars.kolonie.app) has its own policy; for kolonie.app and its wallet, see the kolonie.app privacy policy.
This page says which personal data Kolonie 2 processes, why, on which legal basis, for how long, who else gets it, and what your rights are. In short: we collect what the game needs to run and to stay fair, nothing for advertising, and we sell nothing.
1. Who is responsible
The operator of Kolonie 2 and kolonie.app, named with postal address and email address in the Impressum. Write to that email address for anything about your data.
2. Hosting and server logs
Kolonie 2 runs on a server operated by the person named above; no hosting provider is involved. With every request, the web server records your IP address, date and time, the page or file requested, the answer’s status and size, the referring page and your browser’s user agent. This is needed to deliver the site and to recognise and fend off attacks and misuse (legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure, working site). The logs are deleted automatically after 14 days. The game server itself writes no IP addresses to its logs.
3. Your account
- With email: your email address, your founder name, and your password, which we store only as a salted scrypt hash (we can’t read it).
- With Google or Apple: see section 5. Such an account has no password unless you set one.
- At sign-up we record when you created the account, which version of the terms you accepted and when, and that you confirmed being at least 16.
- Signing in sets a random token in a cookie; the server keeps only its hash, when it was made and last used. It ends 30 days after its last use, when you sign out or delete the account; changing or resetting your password ends your sign-ins on other devices.
- Confirming your email: whether and when you confirmed it.
Legal basis: Art. 6(1)(b) GDPR (the contract under our terms of service); for the record of what you accepted, Art. 6(1)(c) and (f) GDPR (proving consent and acceptance).
4. Emails we send
We send only what your account needs: the link that confirms your email address, the link to reset your password, and, where you buy something, its confirmation. No newsletters, no advertising. The links work once and for a short time; we store only a hash of each. The emails go out through the mail service of our domain’s provider, STRATO (Berlin, Germany), which processes them on our behalf under a data processing agreement (Art. 28 GDPR). Legal basis: Art. 6(1)(b) GDPR.
5. Signing in with Google or Apple
If you choose “Continue with Google” or “Continue with Apple”, your browser goes to Google or Apple, and you sign in there; their privacy policies apply to what happens on their side (in the EU: Google Ireland Limited; Apple Distribution International Ltd., Ireland; both may transfer data to the USA under the EU–US Data Privacy Framework). They tell us only: a stable identifier for you at that provider, your email address (with Apple, possibly a private relay address), and whether it is confirmed. We never see your Google or Apple password, and we don’t ask for or store your name, contacts or anything else. We use these data to sign you in and keep them with your account. Legal basis: Art. 6(1)(b) GDPR. These buttons only load anything from Google or Apple when you click them.
6. Playing
- The game world stores what you do in it, tied to your founder: your company, base, colonists, trades, expeditions and their routes, your moves in encounters, where your founder is over time, and what you received from supply drops. Your founder name can be shown to other players, for example with a discovery you made first.
- Active days: the calendar days (Berlin time) on which you made a game action, with the number of actions. Rewards such as supply drop shares and, in the crypto edition, the airdrop depend on them.
- Misuse protection: your IP address is used in memory to limit how many requests, sign-ups and sign-ins one network can make. So that several accounts of one person or household can’t multiply rewards, the server stores, with your sign-up, sign-ins and the days you play, a salted hash of your IP address (for IPv6, of its /64 network); never the address itself.
Legal basis: Art. 6(1)(b) GDPR (providing the game) and Art. 6(1)(f) GDPR (misuse protection and fair rewards for all players).
7. BTCX features (crypto edition)
If you link a BTCX address, we store it with your account, when you linked it, and that you confirmed being 18 or older. For each airdrop we store the quarter, the amount, whether it was paid and the transaction id. Payouts are transactions on the public BTCX network: the address and the amount can be seen by anyone and can’t be deleted by anyone, us included. We don’t publish which account an address belongs to. Legal basis: Art. 6(1)(b) GDPR; for payout records, Art. 6(1)(c) GDPR (tax and accounting law).
8. Purchases
Where purchases are offered, we store what you bought, when, its price and its payment reference. Payments in euros are processed by the payment provider named at checkout, which receives the payment details you give it there; we never see your card number. Legal basis: Art. 6(1)(b) and (c) GDPR.
9. Stored in your browser
Only cookies that are technically necessary (§ 25(2) TDDDG), so no consent is asked:
__Host-k2s: your sign-in (section 3), HttpOnly, up to 30 days after its last use;__Host-k2f: while a sign-in with Google or Apple is under way, for at most 10 minutes;__Host-k2p: while a new Google or Apple account waits for its founder name, for at most 30 minutes.
There is no advertising, no analytics and no third-party content: the pages, map data and scripts all come from our server.
10. How long we keep your data
- Your account and game data: as long as your account exists.
- When you delete your account (on your account page): your email address, password, Google and Apple logins, sign-ins, network hashes, active days and BTCX link are deleted at once; your founder in the world is renamed “deleted-…”. What tax and commercial law make us keep (records of purchases and payouts) is kept for the time the law sets, up to 10 years, and then deleted.
- Backups of the databases are made every night and before every update. Nightly copies are kept for 14 days; a copy made before an update is kept until 14 newer updates have replaced it. Deleted data leave the backups as these copies are removed.
- Links sent by email expire after 24 hours (confirmation) or 60 minutes (password reset).
11. Who else gets your data
Nobody, except: our email provider for the emails in section 4; Google or Apple if you choose to sign in with them; the payment provider of a purchase; and authorities where the law obliges us. We sell nothing and share nothing for advertising.
12. Your rights
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). Write to the address in section 1 and give your founder name. You may also complain to a data protection supervisory authority, in particular the one where you live, or the one responsible for us: the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
13. Children
Kolonie 2 is for people aged 16 and older. If you learn that a younger child has an account, tell us and we will delete it.
14. Changes
We update this policy when the game or the law changes. The version date at the top says which one you are reading; important changes are announced in the game.