Skip to content

Privacy Policy

1. Overview

We take the protection of your personal data seriously. This privacy policy explains which personal data we process when you use tyria.today, for what purposes, on what legal basis, and what rights you have. It is based on the EU General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).


tyria.today is an independent, non-commercial Guild Wars community fan site, run on self-managed infrastructure. We practise data minimisation and use no advertising, no profiling, and no cross-site tracking. We use Cloudflare for DNS, content delivery, and security / bot protection (Section 4), Hetzner for hosting and our domain's email (Sections 3 and 11), and our own self-hosted, cookieless analytics (Section 12).

2. Controller

The controller responsible for data processing on this website is:

Marvin Paul
Kortumstr. 12
52222 Stolberg (Rhld.)
Germany

Email: [email protected]

3. Hosting and server log files

The website runs on our own self-managed servers, hosted in a German data centre operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany ("Hetzner"), which acts as a processor on our behalf under a data-processing agreement (Art. 28 GDPR); data is processed on servers in Germany.


When you access the website, the web server automatically collects and temporarily stores information that your browser transmits in so-called server log files:

  • IP address (Redacted)
  • date and time of the request
  • the specific page or file requested
  • referrer URL, if transmitted
  • browser type and version
  • operating system
  • HTTP status code
  • amount of data transferred


This data is processed to deliver the website, ensure technical stability and security, and detect or investigate misuse and attacks. The legal basis is our legitimate interest in the secure, stable, and functional operation of the website and in defending against misuse and attacks (Art. 6 (1) (f) GDPR).


Log data is stored for 7 days and then deleted, unless longer storage is required in an individual case to investigate a specific security incident.

4. Cloudflare (CDN, DNS, and security / bot protection)

We use services provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA ("Cloudflare"). Cloudflare acts as a reverse proxy, content delivery network (CDN), and DNS provider, and protects the site against DDoS attacks and malicious bots (Web Application Firewall / bot management).


As a result, all traffic between your browser and our server is routed through Cloudflare's network. In doing so, Cloudflare processes connection data — in particular your IP address and metadata about your request — in order to deliver the content and to detect and block malicious or automated traffic. To provide these functions, Cloudflare also sets technically necessary cookies in your browser; these are described in Section 5 (Cookies).


The use of Cloudflare is based on our legitimate interest in a secure, performant, and attack-resistant provision of the website (Art. 6 (1) (f) GDPR). We have concluded a data processing agreement (Art. 28 GDPR) with Cloudflare.


Cloudflare is a US company and may process data in the USA. For these third-country transfers, Cloudflare relies on its certification under the EU-U.S. Data Privacy Framework (for which the European Commission issued an adequacy decision pursuant to Art. 45 GDPR) and additionally on the EU Standard Contractual Clauses pursuant to Art. 46 GDPR.


Further information is available in Cloudflare's privacy policy:

https://www.cloudflare.com/privacypolicy/

5. Cookies and local storage

Our website does not set any tracking, analytics, or marketing cookies, and we do not use such cookies. The only cookies and storage used are strictly necessary, so this site shows no cookie-consent banner — none is legally required.


  • Cloudflare security cookies. Cloudflare may set technically necessary cookies to deliver the website and provide security functions such as bot protection and access verification — depending on the active features, these may include `__cf_bm` (bot management) and `cf_clearance` (challenge / access verification). They are used on the basis of § 25 (2) no. 2 TDDDG; no consent is required. See Cloudflare's cookie documentation: https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/
  • Sign-in session cookie (`payload-token`). Set only when you log in to a member account. It keeps you signed in, is `httpOnly` and `SameSite=Lax`, and expires after about 7 days. Strictly necessary under § 25 (2) no. 2 TDDDG; legal basis Art. 6 (1) (f) GDPR.
  • Theme preference (browser local storage, `tyria.prefs.v1`). Remembers your light/dark choice; it stays on your device and is never transmitted to us.


Should we introduce any non-essential cookies or similar technologies in the future (e.g. analytics or marketing cookies), we will obtain your consent beforehand where required.

6. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the "https://" prefix in your browser's address bar.

7. Member accounts

If you register an account, we process the data needed to provide it: your display name, your handle (which is public, at /members/your-handle), your email address (kept private — only you and our editors can see it), your password (stored only as a salted hash, never in plain text), and any bio or avatar you choose to add. We also store a verification status, your role, and session records so you can stay signed in and sign out of all your devices.


Registration uses email verification (double opt-in): you must confirm your address before the account becomes active. Changing your email later requires confirming the new address via a link we send to it.

Legal basis: Art. 6 (1) (b) GDPR (providing the account relationship you requested) and Art. 6 (1) (f) (account security and abuse prevention). To prevent abuse we briefly process your IP address in memory to rate-limit sign-up and sign-in attempts; it is not stored for this.


We keep your account data until you delete your account, which you can do yourself at any time in your account settings. When you do, your comments are kept but anonymized (your name is removed and the byline becomes "Departed Traveler"), and your bookmarks are deleted. Accounts may be locked in cases of serious abuse.

8. Comments

When you post a comment, we store its text, the link to your account as author, and like counts. Comments are published publicly on the relevant article once an editor approves them; we moderate to keep the community healthy and may hold, approve, or mark a comment as spam. Please don't post personal information you don't want to be public.

Legal basis: Art. 6 (1) (a) GDPR (your decision to participate) and Art. 6 (1) (f) (a functioning, moderated community). You can edit or delete your own comments at any time.

9. Bookmarks

If you save an article ("satchel"), we store the link between your account and that article so you can find it again. It is private — visible only to you (and to editors for moderation).

Legal basis: Art. 6 (1) (b) GDPR. Bookmarks are deleted when you delete your account.

10. Newsletter — "The Dispatch"

When you subscribe, we send a confirmation email and only add you once you click the link (double opt-in). We store your email address, your subscription status, a confirmation token, and the time you confirmed, as proof of consent. We do not use tracking pixels and do not track opens or clicks.

Legal basis: Art. 6 (1) (a) GDPR (consent). You can withdraw your consent at any time with the unsubscribe link in every newsletter, or by contacting us; withdrawal does not affect the lawfulness of processing carried out beforehand. The newsletter is delivered via our email service (Section 11).

11. Email (sending and contact)

The email service for our domain is provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany ("Hetzner"). Hetzner acts as a processor on our behalf under a data-processing agreement (Art. 28 GDPR) and processes the data on servers in Germany / the EU, so no transfer to a third country takes place.

  • Email we send. To operate the account and newsletter features, the site sends you email such as address verification, password resets, email-change confirmations, the Dispatch newsletter, and (to us) internal moderation notices. Only the data needed to deliver the message (your email address and the message content) is processed.
    Legal basis: the same basis as the underlying purpose — Art.6 (1) (b), (a) or (f) GDPR as applicable.
  • Email you send us. If you contact us by email (Section 2), your message and the data it contains (e.g. your email address, name, and the content of your enquiry) are stored on Hetzner's mail servers and processed solely to handle your request.
    Legal basis: our legitimate interest in responding (Art. 6 (1) (f) GDPR), or Art. 6 (1) (b) where your request concerns a contract or pre-contractual measures. We delete this data once your request has been dealt with conclusively, unless statutory retention obligations apply.


Hetzner's data protection information: https://www.hetzner.com/legal/privacy-policy/

12. Analytics (self-hosted, cookieless)

To understand which content is read, we run our own instance of Umami, a privacy-focused analytics tool hosted on our own servers. Umami:

  • sets no cookies and uses no other device storage;
  • stores no IP addresses — visitors are counted via a salted hash that is regenerated daily, so you cannot be recognised across days or across other websites;
  • collects only aggregate data such as page views, referrer, approximate region, and device / browser type;
  • sends nothing to any third party, and we never sell or share it.


Because this is anonymous, cookieless reach measurement, no consent is required.

Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in understanding and improving our content). You can object at any time (see Section 16).

13. Avatars and uploaded images

If you upload an avatar, it is resized and stored on our own servers and shown publicly next to your byline and comments. Please don't upload images you aren't happy to make public.

14. Embedded content and external links

Embedded videos (YouTube). Some articles embed YouTube videos using the privacy-enhanced youtube-nocookie.com mode. When a page with an embedded video loads, your IP address and device / browser data are transmitted to YouTube so the player can load; in this mode YouTube does not set its usual tracking cookies unless you start playback. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent Google LLC, USA; third-country transfers covered by the EU-U.S. Data Privacy Framework adequacy decision and EU Standard Contractual Clauses).

Legal basis: Art. 6 (1) (f) GDPR (presenting editorial video content). See https://policies.google.com/privacy


Discord. We link to our community Discord server. If you join it, Discord processes your data as its own independent controller under its own privacy policy. When we publish an article we may post an announcement of it (title, excerpt, link) to Discord — this contains article content, not your personal data.


External links. Our articles link to other websites whose privacy practices we do not control.

15. Provision of personal data

The collection of technical access and log data is necessary to deliver the website and ensure its secure operation; without it the website cannot be accessed properly. Creating an account, posting comments, subscribing to the newsletter, and contacting us are all voluntary — but where you use these features, the data you provide (e.g. your email address) is required to provide them.

16. Your rights

Regarding your personal data, you have the right to:

  • Access (Art. 15 GDPR) — obtain information about the data we process about you.
  • Rectification (Art. 16 GDPR) — have inaccurate data corrected.
  • Erasure (Art. 17 GDPR) — have your data deleted.
  • Restriction of processing (Art. 18 GDPR).
  • Data portability (Art. 20 GDPR).
  • Objection (Art. 21 GDPR) — object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR.
  • Withdraw consent (Art. 7 (3) GDPR) — where processing is based on consent (e.g. the newsletter), with effect for the future.


To exercise these rights, contact us using the details in Section 2.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77

GDPR). The authority competent for us is:


Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf

17. Storage duration

Unless a more specific period is stated in this policy, your personal data is deleted once the purpose for processing it no longer applies. Account data is kept until you delete your account; newsletter data until you unsubscribe; comments until you (or, on account deletion, our anonymization) remove the link to you. Where statutory retention periods apply, processing is restricted for their duration and the data is deleted afterwards.

18. Automated decision-making

We do not use automated decision-making or profiling with legal effect within the meaning of Art. 22 GDPR.

19. Changes to this privacy policy

We may update this privacy policy to reflect changes to our website or to legal requirements. The version published here currently applies.


Last updated: 14 June 2026