Last updated: 15 October 2026
This Privacy Policy explains how personal data is processed when you use What Remains and its online services.
1. Controller
The controller responsible for the processing of personal data is:
Sebastian Gräser
Im kleinen Dorf 68
99834 Gerstungen
Germany
Email: what_remains@outlook.de
2. Steam Authentication
What Remains uses Steam for user authentication.
When the game is launched through Steam, Steam provides information required to identify and authenticate the user. This may include:
your Steam ID;
your Steam display name, if used by the game;
temporary Steam authentication information.
Steam authentication tickets are used only for authentication and are not intentionally stored permanently.
We do not receive your Steam password, payment information, email address, or other billing information from Steam.
Steam is operated by Valve Corporation. Valve processes personal data independently in accordance with its own Privacy Policy.
3. Game and Account Data
To provide the online game service, we may store data associated with your Steam ID, including:
character names;
characters and character progression;
levels, classes and skills;
inventory and equipment;
quests and world progression;
crafting and gathering progression;
game settings stored on the server;
moderation information, such as warnings or bans.
This information is required to provide and maintain your persistent game account and game world.
The legal basis for this processing is Article 6(1)(b) GDPR where processing is necessary to provide the requested game service.
4. Connection and Server Data
When you connect to the game servers, your IP address is technically transmitted to the server.
Server systems may temporarily process connection information such as:
IP address;
connection time;
server requests;
technical errors;
security-related events.
This information may be used to maintain the technical operation and security of the service, diagnose problems, and prevent attacks, cheating, or abuse.
Where such processing is based on our legitimate interests, the legal basis is Article 6(1)(f) GDPR. Our legitimate interests are providing a secure, stable and abuse-resistant online service.
IP addresses and technical server logs are retained for no longer than 7 days, unless longer retention is necessary to investigate a specific security incident, abuse, or legal claim.
5. Bug Reports and Feedback
When you submit a bug report or feedback from within the game, we store:
your account name and character name;
the text you wrote, including the title, description, suspected cause and reproduction steps where provided;
technical details recorded automatically when you send the report: the game client and version, the browser or desktop shell, the control scheme in use (keyboard or gamepad), and your in-game location (zone, named place and coordinates).
We use this information exclusively to reproduce, diagnose and fix errors and to improve the game. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is maintaining a working and stable game; reports are sent deliberately for exactly that purpose.
Bug reports and feedback are deleted automatically no later than 12 months after they were received. You may request earlier deletion of your reports at any time using the contact address in section 9.
6. Hosting
The game servers are hosted by:
Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany
The hosting provider may process connection and server data on our behalf insofar as this is technically necessary to provide the game servers.
7. Data Sharing
Personal data is not sold.
Data is only disclosed where necessary for operating the game, including to:
our hosting provider;
Valve Corporation / Steam for authentication and Steam-related functionality;
authorities or other third parties where disclosure is required by law.
Valve may process personal data outside the European Economic Area. Valve provides information regarding international data transfers and applicable safeguards in its own Privacy Policy.
8. Storage Period
Game progress and account-related data are generally stored for as long as they are required to provide the persistent online game service.
If you request deletion of your game-related personal data, the data associated with your Steam ID will be deleted or anonymised where legally and technically possible.
Certain information may be retained for a longer period where necessary to comply with legal obligations, prevent abuse, enforce active sanctions, or establish, exercise, or defend legal claims.
Deleting your game data may result in the permanent loss of characters, inventory, progression, and other game-related information.
Bug reports and feedback are deleted automatically no later than 12 months after receipt, as described in section 5.
9. Your Rights
Under the GDPR, you may have the right to:
request access to your personal data;
request correction of inaccurate personal data;
request deletion of your personal data;
request restriction of processing;
object to processing based on legitimate interests;
receive certain personal data in a portable format where applicable.
You also have the right to lodge a complaint with a competent data protection supervisory authority.
To exercise your rights regarding data processed directly by What Remains, contact:
what_remains@outlook.de
Requests concerning data processed directly by Steam or Valve must be directed to Valve through the Steam privacy and support services.
10. Analytics and Advertising
What Remains currently does not use third-party advertising, behavioural tracking, or advertising analytics.
If such services are introduced in the future, this Privacy Policy will be updated before they are activated.
11. Changes to this Privacy Policy
This Privacy Policy may be updated if the game, its infrastructure, or the way personal data is processed changes.
The current version will always be accessible from within the game.
This website
This website is a static page hosted by GitHub Pages (GitHub, Inc., USA). When you open it, GitHub processes your IP address and the technical details of the request to deliver the page and keep it secure; see the GitHub Privacy Statement.
The website sets no cookies, runs no tracking or analytics and loads nothing from other services: fonts, video and music are delivered with the page. The music plays only when you switch the sound on; that choice is kept in your browser’s local storage and never leaves it.
