Privacy Policy

Who is responsible

The controller for the data described below is Solar Flare, operating this site from Germany.

Email: service@solarflarecl.de

Write to that address about anything concerning your data — access, corrections, deletion, or just a question.

What happens when you just open the site

The web server keeps a log of every request: IP address, time, the address requested, the amount of data transferred, your browser identification and the page you came from. This is needed to serve the site and to spot attacks. The legal basis is Art. 6 (1) (f) GDPR, the legitimate interest in running the site safely. Entries are deleted after 30 days.

There are no analytics, no tracking and no advertising.

Cookies

Only cookies that are strictly necessary to run the site are set. Those need no consent (Section 25 (2) no. 2 TDDDG), which is why there is no cookie banner.

• gdl_player – keeps you logged in as a player. Encrypted, valid for 30 days.
• gdl_staff – keeps a staff member logged in. Encrypted, valid for 12 hours.
• gdl_oauth_state and gdl_staff_oauth – protect the login while you are being redirected to Discord. Valid for 10 minutes.

Logging out removes them immediately.

Logging in with Discord

Logging in runs through Discord. When you press the login button you are sent to Discord, where you decide whether to allow access. Discord then passes on your user ID, your display name, your avatar and which servers you are a member of. For staff it also passes on which roles you hold on those servers.

Of that, only three things are stored: your Discord user ID, your display name and the identifier of your avatar. The user ID is your actual identity here — it is how your profile is recognised again, even after you change your name.

The list of servers and your roles are checked at the moment you log in and are not stored.

The purpose is using the list — your profile and your submissions — and checking that you are on the associated Discord server. The legal basis is Art. 6 (1) (b) GDPR.

For users in the European Economic Area the provider is Discord Netherlands B.V., Amsterdam. Discord may also transfer data to the United States. What Discord itself does with your data is described in its own privacy policy: https://discord.com/privacy

Submissions

When you submit a record, the following is stored: the video link, optionally a link to raw footage, the platform, the refresh rate, your notes and the level you submitted. Alongside it, who reviewed the submission and when.

What is publicly visible

Publicly visible are your display name, a country flag (if one is set), your points, your approved records including the video link and — where applicable — your credit as the verifier or a creator of a level.

Your Discord user ID is not public. Only staff can see it, inside the staff area.

Videos from YouTube

Videos are only loaded once you click the thumbnail. Before that, no connection to Google is made. The thumbnails themselves are served by this server, not fetched from Google by your browser.

Once you press play, your browser connects to YouTube and transmits at least your IP address. The youtube-nocookie.com variant is used, which sets no advertising cookies. The provider is Google Ireland Limited, Dublin. Details: https://policies.google.com/privacy

Staff activity log

Changes made in the staff area are recorded: who accepted or rejected which submission and who changed which entry, and when. This exists so decisions stay traceable, based on legitimate interest (Art. 6 (1) (f) GDPR).

How long data is kept

Your profile and records stay as long as the list exists and you do not ask for them to be removed. Server logs are deleted after 30 days. Entries in the staff activity log are kept so past decisions stay traceable.

Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). An informal email to the address above is enough.

If you believe something is wrong, you can complain to a supervisory authority. The competent one is the data protection authority of German.