Privacy policy

The short version

The banners load from Admitad. The affiliate banners are images from Admitad's server, fetched as soon as a page carrying one opens - without asking first. That request tells Admitad your IP address, your browser and that you are on this site, so it can count the impression. A click goes through Admitad's tracking address to the advertiser. Both are described in full under Advertising. No script runs until you say so. No script that measures or advertises is put into the page before you have agreed to it. Refuse, and the page you receive simply does not contain one - it is not loaded and then held back, it is never sent. You can change your mind at any time through Privacy settings in the footer. Whatever is switched on at the moment is named in full under Advertising and Reach measurement below.

Fonts are our own. Fonts are served from our own server, and the trailer stays a still image until you press play. Any Google script is in the page only because you agreed to it: say no and it is not sent at all. The banner images are the exception - they come from Admitad, as described above. Not waiting for you either: the dialogue that asks you the question, which is itself a Google script and has to load before you can answer. It is described under Strictly necessary cookies, including what it stores and why we cannot put the question to you without it.

Cookies only where they are needed. The ones that are always there keep the site working, protect the forms and fend off automated traffic, and none of them identifies you across sites. Anything stored for measurement or advertising exists only after you have agreed to it, and only for as long as you leave that agreement standing.

Only what you send us. The forms on this site process the data you enter into them, and nothing beyond it.

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Nikolas Gottschalk
Sonnenhof 150
53119 Bonn
Deutschland

Email: hellcodex-w9lw0c@1stlevel.tech

Server log files

When you open this site, your browser automatically transmits data that the hosting provider stores in log files:

• the address requested
• date and time of the request
• amount of data transferred and HTTP status code
• the previously visited page (referrer), if your browser sends it
• browser type and version, and operating system
• the IP address

Purpose: delivering the site, operational security and troubleshooting.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in operating the website securely and without errors.

Retention: our own log files rotate out after 7 days and are then deleted; the rotation is configured from the same value printed in this sentence, so the two cannot drift apart. Logs that the hosting provider and the content delivery network keep for their own operation and abuse defence are subject to their retention periods, which are short and which we do not control.

The IP address is not combined with other data and is not used to identify individuals.

This processing happens regardless of any choice you make - without it the site could not be delivered at all.

Hosting and delivery

The website is operated on infrastructure provided by Laravel Cloud, operated by Laravel Holdings, Inc., Mohnton, Pennsylvania, USA, on Amazon Web Services infrastructure. In front of all of it sits a content delivery network operated by Cloudflare, Inc., San Francisco, USA, through which every request passes. All of them act on our instructions as processors under Art. 28 GDPR, and a data processing agreement is in place with each.

Where your data is stored, and who can reach it - two different questions, and we answer both. The site runs in the EU region (Frankfurt), so that is where the processing happens. The companies involved are nevertheless incorporated in the United States, and access from there - for maintenance or support, for instance - is not ruled out. Under the European Data Protection Board's guidelines that alone is a transfer to a third country under Chapter V GDPR.

Legal basis for the transfer: the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914, Module Two - controller to processor) under Art. 46(2)(c) GDPR. We deliberately do not rely on the adequacy decision for the EU-US Data Privacy Framework. A copy of the clauses is available on request at the address above.

A residual risk remains: US authorities could access data without a remedy fully meeting European standards being available.

Strictly necessary cookies

Our own application sets two:

• XSRF-TOKEN - protects the forms on this site against cross-site request forgery. Without it the forms could be submitted from other websites.
• hellcodex-session - holds the session that belongs to those forms, for example so that an error message survives a failed submission. It expires after 120 minutes of inactivity.

The content delivery network in front of the site may add its own short-lived cookies to tell automated traffic from human traffic - Cloudflare uses __cf_bm and, after a challenge, cf_clearance. They carry no identifier we can read and are not available to us for any other purpose.

The consent dialogue itself. The dialogue that asks you these questions is Google Funding Choices, provided by Google Ireland Limited. It is the only thing on this site that is loaded before you have answered - because it is what does the asking, and there is no way to put the question to you without it. Google requires a dialogue from its certified list before advertising may be served at all, and ours is not on that list.

It stores your answer on your device under the names FCCDCF and FCNEC, together with a standardised consent string defined by the IAB Transparency and Consent Framework, so that the advertising network can read what you decided. Your IP address reaches Google when the dialogue is loaded.

Legal basis: § 25(2)(2) TDDDG for the storage - it is strictly necessary to obtain and document your decision - and Art. 6(1)(f) GDPR for the processing, our legitimate interest being that we cannot lawfully show advertising without asking you first.

What it does not do: it does not load any advertising or measurement. Those remain absent from the page until your answer says otherwise.

One more is added once there is something to decide about:

• hc_consent - remembers what you answered in the privacy dialogue, so you are not asked again on every page. It holds your answer and the version of the question, nothing else - no identifier, no reference to you. It is strictly necessary in the literal sense: without it we could not honour the refusal you just expressed. It expires after 182 days, and you can delete it at any time by clearing this site's data in your browser.

We do not state a fixed total here on purpose: the network's protection is not under our control and the exact set can change. What does not change is the rule - nothing is stored on your device that is not needed to deliver the site and keep it secure.

All of this is set regardless of any choice you make. It is strictly necessary for operation under § 25(2)(2) TDDDG and therefore needs no consent; the processing relies on Art. 6(1)(f) GDPR and our legitimate interest in operating the site securely. None of it is used for advertising or analytics.

Contact form

If you write to us through the contact form, your message is filed as a ticket in our helpdesk at 1stlevel.tech. That service is run by NG IT-Projekte, sole proprietor Nikolas Gottschalk, Sonnenhof 150, 53119 Bonn - the same person who operates this site, so your message does not leave the controller named above and is not handed to a third-party mail provider.

What is stored: your name, your email address, the subject you picked and your message. Your IP address and the time of the request are stored with the ticket so that abuse of the form can be traced.

Why your email address: the reply goes back to the address you enter, which is the whole reason it is asked for. Without it we cannot answer you.

Purpose: answering your enquiry, and defending against automated abuse of the form.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is being reachable and being able to correct mistakes readers point out.

If filing the ticket fails: a message that cannot be handed to the helpdesk - because it is unreachable, for instance - is written to our server log instead, with your name, your email address and the text you wrote, so that it is not silently lost. That entry is subject to the same 7-day deletion as every other log entry.

Retention: the ticket stays for as long as the matter requires and is deleted afterwards. You can ask us to delete it sooner at any time.

You do not have to use the form. A plain email to hellcodex-w9lw0c@1stlevel.tech reaches us just the same.

Advertising

The banners on this site are affiliate advertising through Admitad (Admitad GmbH, Heinz-Nixdorf-Str. 6, 74172 Neckarsulm, Germany). They rotate between several advertisers: Lenovo, Alibaba.com, Govee, REDMAGIC, Geekbuying, TTGO, Homestyler, Turbo VPN, Justfashionnow, Noracora, Stylewe, Gshopper. Each one is labelled Advertisement.

Showing a banner contacts Admitad. The banner image is loaded from Admitad's server (ad.admitad.com, which forwards to its image server cdn.admitad-connect.com) as soon as a page carrying one opens. Your browser then sends Admitad your IP address, browser details and the address of this site, and Admitad counts the impression. No script of the network is in the page, and the image request sets no cookie. This happens without asking you first. Legal basis: our legitimate interest in funding the site through these banners, Art. 6(1)(f) GDPR. You can object at any time - an ad blocker, or blocking admitad.com in your browser, stops the request.

Which banner you see is picked at random for each page view, and its language depends on the country you are visiting from. The country is the two-letter code our content delivery network attaches to every request anyway; nothing is looked up and nothing is stored.

If you click one, your browser opens Admitad's tracking address for that advertiser (bednari.com, rzekl.com, rthsu.com, yyczo.com, bywiola.com, dkfrh.com, cafxq.com, grfpr.com, qwpeg.com, codeaven.com). Admitad records the click - including your IP address, browser details and a cookie on its own domain - so that a purchase with the advertiser can be credited to us, and forwards you to the advertiser's site. Our server is not involved in the click. From that point Admitad and the advertiser process your data as controllers in their own right, under their own privacy policies (Admitad's). We receive only totals of impressions, clicks and commissions, nothing that identifies you. Legal basis for placing the link: our legitimate interest in funding the site through commission, Art. 6(1)(f) GDPR.

No ad network that loads scripts is in use, and no advertising cookie is set by this site. Should that change, a consent banner will appear first, this policy will be updated, and nothing will load before you have agreed.

Reach measurement

We use Google Analytics 4, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to see which pages are actually read and which are not worth keeping.

Nothing is loaded until you agree. No Google script is placed in the page, no connection to Google is opened and no identifier is stored on your device before you have said yes in the dialogue. Say no, and the tag is simply not part of the page you receive - it is not loaded and then held back, it is never sent.

What is processed: the pages you open and when, referrer, approximate location derived from your IP address, device, browser and operating system, and a randomly generated identifier that Google stores on your device so that repeat visits can be recognised. Google truncates the IP address before storing it and does not make it available to us.

Legal basis: your consent, for the storage on your device under § 25(1) TDDDG and for the processing that follows under Art. 6(1)(a) GDPR.

Withdrawal: open Privacy settings in the footer and switch reach measurement off. It takes effect immediately, and withdrawal does not affect the lawfulness of what happened before it (Art. 7(3) GDPR).

Transfer to the USA: Google Ireland Limited is our contractual partner, but a transfer to Google LLC in the United States cannot be ruled out. It is based on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR. The residual risk described under Hosting and delivery applies here too.

Retention: Google deletes the data associated with these identifiers after the period set in our account. We do not merge it with anything else and use it only in aggregate.

One exception, and it is not about you. Google's own crawlers - the ones that check whether a tag is installed at all - are served the tag without being asked, because there is nobody to ask and no device to store anything on. They are identified by the name their software sends. No measurement of any visitor happens through this, and Google discards crawler traffic from its reports.

How we count visits

Independently of any of that, we count how often our pages are opened and by roughly how many people. This happens on our own server rather than through an analytics service, and nothing is stored on or read from your device for it - which is why it needs no consent (§ 25(2)(2) TDDDG).

What is stored: per day and per page, the number of views, and whether the request came from a person or from a crawler. Crawlers are recorded by name - "Googlebot", for example - never by their full identification string.

Two more counters describe where visits come from:

• The site that linked here, as a bare host - reddit.com, not the address on it. A referring address carries the page somebody was reading, and on a search engine the words they typed; the host answers the question we are asking and none of the ones we are not. A visit with no referrer at all is counted as "Direct".
• The country the request came from, as a two-letter code. It is read from a header our content delivery network already adds to the request. No location service is asked, nothing is looked up, and no IP address is stored in order to make it work.

How two visits are recognised as one visitor: from your IP address and your browser identification we calculate an irreversible check value. The key used for it is random, changes every day and is deleted two days later, so today's value cannot be connected to tomorrow's - not by us either, and not by anyone who knows your IP address. No history across days is created.

What is not stored: your IP address, your browser identification, the address you came from, and how long you stayed.

Legal basis: Art. 6(1)(f) GDPR - our legitimate interest in knowing whether and how this site is used. You can object under Art. 21 GDPR; an email to hellcodex-w9lw0c@1stlevel.tech is enough.

Retention: the check values are deleted after 365 days. The plain numbers remain, because they do not permit any conclusion about a person.

Article pages additionally keep a simple view counter in our own database. It counts requests only: no IP address, no identifier and no cookie is involved.

Searching this site

The search box queries our own database. No search service is involved, your words are not sent to anybody, and nothing is stored on or read from your device for it.

What happens to what you type: it travels in the address of the request - /search?q=... - which means it appears in the server log described above, the same way every other requested address does, and is deleted with it after 7 days. It is not written to our database and is not attached to anything about you.

What the visit counter records: /search, without your search term. The counter cuts the query off on purpose, so we can see how often the search is used without seeing what was searched for.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is answering the search at all; the log entry it produces serves the same operational interest as any other.

Fonts

The fonts used (Cinzel, EB Garamond and Inter) are stored on our own server and served from there. No connection is made to Google Fonts or any other external provider.

The teaser trailer

The Diablo V teaser is published by Blizzard on YouTube, and we show it the only way we can show it honestly: as a picture until you ask for the video.

Before you press play nothing is requested from Google for the video. The page carries our own illustration and a button - no player, no preconnect, no hidden request. Pressing play is the consent, which is why there is nothing to agree to beforehand.

When you press play, your browser loads the player from youtube-nocookie.com, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. From that moment Google receives your IP address, information about your browser and device, and the address of the page you are on, and can store information on your device. If you are signed in to a Google account, Google can associate the view with it. The nocookie domain means no advertising cookies are set before playback; it does not mean nothing is stored once the video runs.

Legal basis: your consent, given by pressing play - § 25(1) TDDDG for the storage on your device and Art. 6(1)(a) GDPR for what follows. You can avoid it entirely by not pressing it; the page is readable either way, and the video is linked so you can watch it on Google's own site instead.

Transfer to the USA: a transfer to Google LLC cannot be ruled out. It is based on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR. The residual risk described under Hosting and delivery applies here too.

What Google does with it afterwards is outside our control and described in Google's privacy policy.

External links

This site links to external sources - the official Blizzard pages we cite, and the sources named on the pages themselves. Those links only become active when you click them. Only then does the respective provider receive your IP address and can set its own cookies. No third-party content (videos, maps, social media buttons) is embedded in the site in a way that would transmit data on page load.

Your rights

You have the right at any time to:

• access the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

An informal email to hellcodex-w9lw0c@1stlevel.tech is enough for any of these.

Right to lodge a complaint

If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the one in the German state where the controller is based, or the authority where you reside.

Automated decisions and profiling

No automated decision producing legal effects concerning you, or similarly significantly affecting you, within the meaning of Art. 22 GDPR is taken here. Nothing on this site decides anything about you.

Profiling, said plainly. Reach measurement is a different matter, and we would rather write it down than let the word do quiet work. Google Analytics stores an identifier on your device and records which pages you open over time. Evaluating personal aspects that way is profiling within the meaning of Art. 4(4) GDPR - pseudonymous profiling, but profiling. It happens only if you agreed to it and stops when you withdraw that agreement under Privacy settings in the footer.

Changes

This policy is not written once and left alone. The sections describing advertising, reach measurement and the consent dialogue are driven by the same settings that switch those features on and off, so the page cannot go on describing a service that has been turned off - or stay silent about one that has been turned on. On top of that we run a check against the live configuration that reports every sentence on this page which no longer matches it.

What that cannot do is decide for you. Where consent is required it is asked for before anything loads, and a change that needs a fresh decision asks again rather than assume your previous answer still covers it. The date above shows the current version.