Who is responsible for your data
The operator — the controller within the meaning of Art. 4(7) GDPR — is [COMPANY], [ADDRESS]; [REGISTRATION]. It decides why and how the data of System K15 players is processed, and answers for it.
For any question about your data, write to privacy@k15.space or use the contact form — it reaches the same place.
We have not appointed a data protection officer (DPO): our processing does not fall under Art. 37 GDPR — there is no large-scale systematic monitoring of people and no special categories of data.
We process nobody else's data on another company's behalf, so the project has no separate data processing agreement (DPA): everything we do with data is described on this page.
What we keep
The account — in the site's database:
- the email — it is the login and the only way to tell who you are. Other players never see it;
- the name — it is also the name of your consciousness in the game. Players whose signal has reached you see it, as do players who can view a system with a station whose functions you breached. It cannot be changed (see the terms);
- the password — only as a hash, which the password cannot be recovered from. It is never stored in the clear, neither on the site nor in the engine;
- the date of birth — for the age limit (16+) and for nothing else;
- the plumbing — the date of registration, the language you read the site in, and whether the account is a player's or an administrator's.
The game — in the game engine's database, apart from the account. It holds the same email, name, password hash and date of birth: you sign in to the game with the same password, and it is the engine that checks it. It also holds ships, colonies, knowledge, history, the tick balance with the history of its entries, and the messages you exchange with other players. If a message has been reported, the report is kept too — a human reads it.
Letters to us — whatever you typed into the contact form: the name you gave, the address to answer at, the topic, the text and the date it was sent. If you were signed in at the time, your account is attached to it: that is how we can tell who wrote, even when you called yourself something else. Letters to privacy@k15.space sit in a mailbox at Zoho (see subprocessors).
Server logs — the web server records requests: the IP address, the time, the address requested, the server's response, the address of the previous page and the browser string. The game API's log has no query string — that is where a sign-in token can travel.
One exception about the password is worth saying out loud: a password the game engine has yet to learn goes into a queue encrypted. That happens if the engine was unreachable at the moment you registered, if you changed your password in your account, and if an administrator reset it. The queue is drained within seconds, and the row is deleted together with the message.
If you lost your password and asked for it to be reset, the site makes up the new one. An administrator sees it once, on the reset page, in order to pass it on to you; it is never written down anywhere in the clear.
What we do not collect: special categories of data (Art. 9 GDPR) or criminal records (Art. 10), payment details, analytics, advertising identifiers, device fingerprints. The limiter on sign-in attempts keeps an IP address only in the engine's memory and never writes it down.
Why, and on what legal basis
| Why | What | Legal basis |
|---|---|---|
| Create the account and let you play | email, name, password, plumbing, game state | Art. 6(1)(b) GDPR — the contract, that is the terms |
| Check the age | date of birth | Art. 6(1)(b) — a condition of the contract: you may play from 16 |
| Deliver a message to another player | messages | Art. 6(1)(b) — it is part of the game |
| Deal with a report on a message | the message and the report | Art. 6(1)(f) — legitimate interest |
| Answer a letter | the letter, the reply address, the account | Art. 6(1)(b) if the letter is about your account; otherwise Art. 6(1)(f) |
| Keep sign-in and forms secure | session and form-protection cookies | Art. 6(1)(b) and 6(1)(f) |
| Fix breakages and notice break-ins | server logs | Art. 6(1)(f) |
| Carry out a request about your rights and show that it was carried out | the correspondence about the request | Art. 6(1)(c) — an obligation under the GDPR |
There is no advertising and no mailing list, and today we rely on consent (Art. 6(1)(a)) for nothing.
Email, name, password and date of birth are required: without them there is no account and no contract. Writing to us is up to you.
When mail and the tick shop appear, the table will grow by two rows, and this page will change before they start working: letters about your account — Art. 6(1)(b), not advertising; paying for ticks — Art. 6(1)(b), with payment records under Art. 6(1)(c).
Legitimate interest
Where the basis is Art. 6(1)(f), we have weighed our interest against yours:
| What | Our interest | What limits it |
|---|---|---|
| Server logs | fixing breakages, noticing password guessing and break-ins | a short retention period; the game API's log has no query string |
| Reports on messages | so that harassment and threats do not go unanswered | a report is read by a human; it is kept only as long as the message itself |
| Letters from non-players | answering whoever asked | kept while the conversation goes on; deleted on request |
You have the right to object to such processing (Art. 21 GDPR) — write to privacy@k15.space. We will stop, unless we can show compelling grounds that override your interests.
How long we keep it
| What | How long |
|---|---|
| The account and the game state, messages and reports included | as long as the account exists; deleted on request (see “How to delete the account”) |
| Letters through the form | while the conversation goes on; deleted at once if you ask |
| Letters to privacy@k15.space | ordinary ones — 12 months after the last letter; requests about rights and complaints — 3 years, so that we can show the request was carried out |
| Web server logs | 14 days |
| The password in the queue | seconds — until the message is processed |
| The session cookie | up to 30 days, or until you sign out |
| The sign-in token in the game | until the tab is closed |
| Database backups | up to 7 days, then deleted automatically |
Who receives it
The data is not sold, not handed to advertisers and not exported anywhere. It is received only by:
- those who run the infrastructure for us — under contract and only on our instructions: DigitalOcean (servers, the database, DNS; the data sits in Frankfurt) and Zoho (the privacy@k15.space mailbox). The full list — what, where and on what basis — is on the subprocessors page;
- other players — your name and whatever the game shows them: your signal, the messages you sent them, and any station functions you gained access to by breaching them, with the access expiry. Players who can view that system can see your name on the affected stations. No player ever sees your email or your date of birth;
- public authorities — only on a lawful request, and only what the request names;
- our advisers — lawyers and accountants bound by confidentiality, and only when it cannot be avoided.
Two companies on the subprocessors list are marked “connected later”: MailerSend — when the site starts sending mail; Paddle — when the tick shop opens. Nothing is sent to either of them today. Paddle will be the seller of the ticks (Merchant of Record) and will handle the payment data itself: it is not our processor but an independent controller with its own privacy policy. We will never see your card details.
When you open the site, your browser contacts nobody but us: the fonts, styles and scripts sit on our own server, and the ALTCHA captcha is computed there too.
Transfers outside the EEA
The data is stored in the EEA, but some of the companies that hold it are registered outside it. For that case, Chapter V of the GDPR applies:
| Who | Where the data is | What protects the transfer |
|---|---|---|
| DigitalOcean, LLC (USA) | Frankfurt, Germany | EU–US Data Privacy Framework; as a fallback, the standard contractual clauses (SCC) |
| Zoho Corporation B.V. (Netherlands) | EU data centres | processing in the EEA; SCC within the Zoho group |
| MailerSend, Inc. (USA) — connected later | EU data centres | SCC; EU–US Data Privacy Framework |
| Paddle.com Market Ltd (United Kingdom) — connected later | United Kingdom, EU | the European Commission's adequacy decision for the United Kingdom |
The SCC are those of Commission Implementing Decision 2021/914. We will send a copy on request to privacy@k15.space.
Your rights
Under the GDPR you have the right:
- to know what we keep about you and to get a copy (Art. 15);
- to correct what is wrong — the date of birth, say, if you mistyped it (Art. 16);
- to erase the account and everything connected with it (Art. 17);
- to restrict processing while a dispute about it is being settled (Art. 18);
- to take your data with you in a machine-readable form (Art. 20);
- to object to processing based on legitimate interest (Art. 21);
- to withdraw consent at any time (Art. 7(3)). Today we rely on nobody's consent, but if that changes, withdrawing it will be no harder than giving it.
How: write to privacy@k15.space from the email the account is registered to, or through the contact form while signed in — that is how we know the owner is writing. We answer free of charge and within one month. A complex request may extend that by two more months, and if so we will tell you within the first month (Art. 12(3)).
If you believe we are infringing your rights, you can complain to a data protection supervisory authority — in the country where you live, work, or where you believe the infringement took place (Art. 77). Our lead supervisory authority is [AUTHORITY]. The authorities of every EEA country are listed on the European Data Protection Board's site. But write to us first: that will most likely be quicker.
How to delete the account
While the closed alpha is on, there is no button for it. Write to privacy@k15.space, through the contact form, or through the same channel your invitation came from — and we will delete the account on the site and the player in the engine together with the game state, and your letters to us along with them. Only the correspondence about the deletion itself remains: we keep it for 3 years so that we can show the request was carried out. The data leaves the backups on its own, when their term runs out.
Age
You may play from the age of 16. That is the highest age limit the GDPR allows for online services (Art. 8), so parental consent is not required in any EU country. The registration form does not let anyone younger through. If we learn that someone younger has created an account anyway, we will delete it; parents who have found such an account only need to write to privacy@k15.space.
Automated decisions
There is one decision taken without a human: the form refuses registration if, by the date of birth given, you are under 16. Without it the contract cannot be entered into (Art. 22(2)(a) GDPR). If you mistyped the date, write to us and a human will look. There is no profiling.
Cookies and browser storage
The site has two cookies, both plumbing: the session and form protection. The game keeps a few entries in the browser's storage: the sign-in token, the language, the graphics quality you chose. There is no analytics, no advertising and no visitor counter, and so there is no consent banner either. The details, with names and lifetimes, are on the cookies page.
Security
- all traffic goes over HTTPS only;
- passwords are kept only as hashes; the password in the queue is encrypted;
- the site's and the game's databases are separate: a query from one into the other is physically impossible;
- from outside the server only the web server is visible, everything else listens on the local address alone;
- the administrative part of the site is open to a separate role only;
- the game's sign-in token never reaches the server logs;
- sign-in attempts are rate-limited;
- there are no third-party scripts on the pages.
Should data leak nonetheless, we will notify the supervisory authority within 72 hours (Art. 33 GDPR), and you without undue delay if the leak threatens your rights (Art. 34).
This page will change
If anything that collects data appears on the site, this page changes — and it changes before that thing does. We will announce substantial changes in advance. The date of the last edit is below; earlier versions are available on request.
Language
This page exists in Russian and in English. Should the two versions differ, the English text prevails.
Last changed on 12 October 2026.