Privacy Policy

In accordance with the GDPR

Last updated: October 8, 2026 · Deutsche Fassung (the German version is authoritative)

This privacy policy applies to the website crimsondragon.de. We have deliberately kept it short: it only describes the processing that actually takes place on this website. Our apps and services (e.g. Change Happens, rytica, GKV Alarm (German) or Bitcoin Island) each have their own privacy notices.

1. Controller

Crimson Dragon UG (haftungsbeschränkt)
Hallstattweg 4
70839 Gerlingen
Germany
Email: info@crimsondragon.de
Managing director: Thomas Feucht
Legal notice: crimsondragon.de/impressum

We have not appointed a data protection officer, as we are not legally required to do so. If you have questions about data protection, contact us at the email address above.

2. Summary

  • We measure website usage with PostHog (EU cloud, Frankfurt). Without your consent, this happens without cookies and without recognising you. We only set a cookie if you agree.
  • We use no advertising services and no session recording.
  • Fonts are loaded from our own server. There is no connection to Google Fonts.
  • No third-party content (videos, maps, social media plugins) is embedded. Links to external services are plain links.
  • We only process personal data to deliver the website, for audience measurement, when you subscribe to the newsletter and when you contact us.

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and delivered through its content delivery network. When you visit the website, Vercel processes technically necessary data, in particular your IP address, the date and time of the request, the page or file requested, the referrer, browser type and operating system, and the HTTP status code. The website cannot be delivered without this data.

The legal basis is our legitimate interest in providing the website securely, reliably and quickly (Art. 6(1)(f) GDPR). We have a data processing agreement with Vercel under Art. 28 GDPR. Vercel stores log data only for a limited period for operational and security purposes and then deletes it.

Data may be transferred to the USA in the process. Vercel is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR) and additionally on the EU Standard Contractual Clauses (Art. 46 GDPR). Vercel's privacy policy: vercel.com/legal/privacy-policy.

4. Fonts

We use the fonts “Inter” and “DM Sans”. They are embedded locally in this website and delivered by our host. No connection to servers of Google or other font providers is made when you load a page.

5. Audience measurement with PostHog and cookies

To understand which content is read and how visitors find our website, we use PostHog, a service of PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. We use PostHog's EU cloud; the data is stored on servers in Frankfurt am Main. Requests run through our own domain and are forwarded to PostHog by our host Vercel.

Without consent (cookieless): PostHog records the page visited, the referrer, clicks on links and buttons, browser, operating system, device type, screen size and the approximate location derived from the IP address (country, region, city). No cookies or other identifiers are stored on your device; each page view is recorded without recognising you. PostHog does not store the IP address itself. The legal basis is our legitimate interest in designing and improving the website according to need (Art. 6(1)(f) GDPR).

With consent: If you click “Allow” in the notice, PostHog additionally stores a random identifier in a cookie and in your browser's local storage (name starting with ph_, stored for up to one year). This lets us recognise and analyse returning visits together. The legal basis is your consent (Section 25(1) of the German TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time via “Cookie Settings” in the footer; the stored identifier is then deleted.

We store your choice in the notice in your browser's local storage (cd_analytics_consent) so that the notice doesn't appear on every page view. This is strictly necessary to respect your decision (Section 25(2) no. 2 TDDDG).

We do not record sessions, do not build profiles with your name or email address and do not use the data for advertising. If your browser sends a “Do Not Track” signal, no measurement takes place. Regardless of this, you can object to the cookieless measurement at any time (Art. 21 GDPR), for example with this switch: With JavaScript disabled, no measurement takes place.

Analytics data is deleted after twelve months at the latest. We have a data processing agreement with PostHog under Art. 28 GDPR. As PostHog is a US company, access from the USA cannot be completely ruled out; the EU Standard Contractual Clauses (Art. 46 GDPR) apply to this. PostHog's privacy policy: posthog.com/privacy.

6. Newsletter

You can subscribe to our newsletter with news about our products, devlogs and the studio. We only need your email address for this. Sign-up uses double opt-in: you receive an email in which you confirm the subscription. We log the time of sign-up and confirmation and the IP address to be able to prove your consent.

We send the newsletter with Mailchimp, a service of The Rocket Science Group LLC (Intuit Inc.), 405 N Angier Ave NE, Atlanta, GA 30308, USA. When you submit the form, your data is transferred directly to Mailchimp and stored there. Mailchimp analyses whether a newsletter was opened and which links were clicked; we only use this analysis in aggregated form to improve the newsletter.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, e.g. via the unsubscribe link in every newsletter or by emailing us. After you unsubscribe, we delete your address; we may keep proof of your earlier consent for up to three years to defend against claims (Art. 6(1)(f) GDPR).

We have a data processing agreement with Mailchimp under Art. 28 GDPR. Intuit is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses apply additionally. Privacy policy: intuit.com/privacy/statement.

7. Contact by email

If you contact us by email (e.g. at info@ or press@crimsondragon.de), we process your details to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete the data once the enquiry has been dealt with and no statutory retention obligations (e.g. for business correspondence) apply.

8. Links to external services and social media

Our website links to external services, e.g. Steam, the Apple App Store, Discord, X (Twitter), Facebook, YouTube and the websites of our products. These are plain links: data is only transferred to the respective provider once you click a link. The respective provider is responsible for processing there, and its privacy policy applies.

We also run profiles on Discord, X, Facebook and YouTube to stay in touch with our community. When you visit these profiles, the platform operators process your data under their own terms. For our Facebook page, we are jointly responsible with Meta Platforms Ireland Ltd. for the page statistics (“Page Insights”) (Art. 26 GDPR); the agreement is available at facebook.com/legal/terms/page_controller_addendum. Requests for access and other data subject requests are most effective when made directly to the respective provider; we are happy to help.

9. Retention

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods (e.g. six or ten years under the German Commercial Code and Fiscal Code). The data is then deleted.

10. Your rights

Under the GDPR you have the following rights:

  • access to the data stored about you (Art. 15)
  • rectification of inaccurate data (Art. 16)
  • erasure (Art. 17) and restriction of processing (Art. 18)
  • data portability (Art. 20)
  • withdrawal of consent with effect for the future (Art. 7(3))

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation.

An email to info@crimsondragon.de is enough. You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, baden-wuerttemberg.datenschutz.de.

11. Security

The website is delivered exclusively encrypted via HTTPS (TLS). No automated decision-making, including profiling, takes place.

12. Changes

We update this privacy policy whenever the website or the services we use change. The version published here applies.