Privacy policy

1. Overview

ecstasyevrima.com is the website of the ECSTASY community server for The Isle: sign-in, player statistics, the live map, a garage for dinosaurs, chat, support tickets, memberships and similar features. We only process personal data that these features need. We use no tracking, no analytics and no advertising.

2. Hosting, content delivery and server logs

The site runs on a server of OVHcloud (OVH SAS, France) in a data centre in Germany. Requests pass through Cloudflare, Inc. (USA), which delivers the site, protects it against attacks and may set a technically necessary security cookie (e.g. "__cf_bm"). Both process your IP address and technical request data on our behalf (data processing agreements, Art. 28 GDPR).

We keep no access logs. To protect accounts and enforce bans (rate limits, ban evasion) we store IP addresses and a device identifier only as keyed hashes that cannot be turned back into the address. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in a secure and fair service.

3. Signing in with Steam or Discord

You sign in with Steam (Valve Corporation, USA) or Discord (Discord Inc., USA). We receive your SteamID64 and public profile name and avatar, or your Discord ID, username and avatar. We use them to create and run your account. Legal basis: Art. 6 (1) (b) GDPR. If you also set a password or two-factor login, we store the password only as a hash and the two-factor secret encrypted.

4. Account and game data

Linked to your SteamID we process: playtime, kills and deaths, your dinosaurs and garage, positions on the live map, ECoins, rubies and other balances, purchases on the site, levels, quests, achievements, cards, cosmetics, trades, friends, nest and group posts, support tickets with any screenshots you upload, and moderation records (warnings, strikes, bans and their evidence). This data comes from your use of the site and from our game server. Legal basis: Art. 6 (1) (b) GDPR (providing the features) and Art. 6 (1) (f) GDPR (fair play, security, enforcing the rules).

5. Chat, direct messages and voice chat

Messages in the general chat are deleted after 30 days, direct messages after 180 days, staff chat after one year. Reported messages may be kept as evidence for a moderation case.

Proximity voice chat connects players directly (WebRTC). Your IP address therefore becomes visible to the devices of the players you talk to, and STUN servers of Google LLC (USA) help establish the connection. The microphone is only used after you switch voice chat on; voice is not recorded or stored by us.

6. Payments

Payments in euros and dollars are processed by Tebex Limited (United Kingdom) as reseller. Tebex tells us the transaction number, the package, amount, currency and your SteamID or username so that we can unlock what you bought; we never see your card or bank details. Ruble subscriptions run through Boosty: we only see the Discord role that Boosty gives you, read by our Discord bot. We keep payment records as long as tax and commercial law requires. Legal basis: Art. 6 (1) (b) and (c) GDPR.

7. Cookies and local storage

We only use cookies that the site needs to work: "ecs_session" (keeps you signed in, 30 days), "ecs_did" (device identifier against ban evasion and account abuse, 2 years), "ecs_oauth_state" (protects the sign-in, a few minutes), "ecs_ref" (an invite link you opened, 30 days), "lang" (your language), "ecs_intro" (the opening animation, until the browser closes) and display preferences ("chat_dock", "bgfx"). Your browser's local storage keeps small preferences such as an open tab. Legal basis: § 25 (2) no. 2 TDDDG and Art. 6 (1) (f) GDPR. There is no consent banner because nothing beyond this is stored.

8. Content from other services

Profile pictures are loaded from the servers of Steam and Discord, and stream previews from YouTube (Google) and Twitch (Twitch Interactive, USA). When your browser loads them, these providers receive your IP address. Links to other sites (Discord, Boosty, Tebex, YouTube, Twitch) lead to services whose own privacy policies apply.

9. Transfers to third countries

Some of the providers named above are based in the USA. Transfers take place on the basis of the EU-US Data Privacy Framework or the EU standard contractual clauses. For the United Kingdom (Tebex) there is an adequacy decision of the European Commission.

10. How long we keep data

Data is kept as long as your account exists, unless shorter periods are named above (chat, sessions, notifications). You can delete your account yourself in the account settings: your profile, sign-in methods, friends, messages, cosmetics and preferences are then deleted. Data tied to your SteamID in the game (garage, balances) and moderation records stay, so that bans keep working and fair play is protected (Art. 6 (1) (f) GDPR); legal retention periods remain unaffected.

11. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to the e-mail address above. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live.