Privacy - MGDS

What this site collects, why, and what you can do about it. Nothing here has changed since 30 October 2026.

Who is responsible

Maffin e.U., Brochweg 12, 6100 Mösern, Austria.
Email: admin@dasmaffin.com. Full details on the imprint.

We are not required to appoint a data protection officer and have not appointed one. Write to the address above and you reach the person who runs this.

The site itself

This part applies wherever you are on the site. Last changed 24 October 2026.

Signing in with Steam

What is kept: Your SteamID, which is the public number identifying your Steam account, the moment you first signed in, the moment you last signed in, and which permissions on this site have been granted to you. Signing in happens at Steam: you type your password on Valve's pages, never on ours, and we never see it. Steam tells us the SteamID and nothing else.
What for: To know who you are between pages, and to decide what you are allowed to see.
On what basis: Article 6(1)(b) GDPR - it is what you asked for by signing in. There is nothing on this site you have to sign in to read unless it is somebody's private data.
For how long: Until you ask for it to be removed. Ask and it is removed.
Who can see it: You, and the accounts holding the permission to manage permissions.

Signing in with an email address

What is kept: Your email address, a hash of your password, when the account was made and when it was last used, and a name if you chose to give one. The password itself is never stored and cannot be recovered from what is: it is put through a one-way function with a random salt, and even we cannot read it back.
What for: So that somebody without a Steam account can have one here. The address is used for two letters and nothing else: one asking you to confirm it is yours, and one carrying a link to choose a new password, sent only when somebody asks for it. There is no newsletter, no announcement, and no way to opt in to one.
On what basis: Article 6(1)(b) GDPR - it is what you asked for by making an account.
For how long: Until you ask for it to be removed. Ask and it is removed.
Who can see it: You, and the company that carries the letters, which is the mail provider for this domain. They are handed the address and the letter in order to deliver it and for nothing else. Nobody else is sent it and nothing is shown it.

The robot check when you make an account

What is kept: Only when you open the form for making an account with an email address: Google reCAPTCHA is loaded from Google's servers, and Google receives your IP address, details of your browser and how you use the page, and may set or read its own cookies. When you send the form we pass your answer and your IP address to Google to check it. We keep none of it. Signing in, and every other page, never load it.
What for: Bots were making accounts here with other people's addresses, so that this site sent those people letters they never asked for.
On what basis: Article 6(1)(f) GDPR - our legitimate interest in keeping automated sign-ups out, and in not sending mail to people who never asked for it.
For how long: Nothing is kept by us. Google keeps what it collects under its own policy, at policies.google.com/privacy.
Who can see it: Google (Google Ireland Limited, which may pass it to Google LLC in the USA).

Two factor authentication, if you turn it on

What is kept: A random secret shared with your authenticator app, when the code was last used, and the one-way hashes of ten recovery codes. The secret is not a hash and cannot be one - working out the same six digits your phone shows means knowing the same number it does. Nothing about your phone is collected: no device name, no push token, and no contact with the app you chose, which never speaks to this site at all.
What for: So that knowing your password is not enough to sign in as you.
On what basis: Article 6(1)(b) GDPR - it is what you asked for by turning it on.
For how long: Until you turn it off, which deletes the secret and every remaining recovery code, or until the account is removed.
Who can see it: Nobody. It is never shown again after the setup screen and is not sent anywhere.

Staying signed in

What is kept: One cookie holding a session identifier. No advertising cookie, no analytics, no tracking pixel, and nothing loaded from another company's servers - every stylesheet, script and font on this site is served from this site.
What for: So that following a link does not sign you out.
On what basis: Strictly necessary for a service you asked for, so no consent banner and nothing to opt out of.
For how long: Until the session ends or you sign out.
Who can see it: Nobody. It is an identifier, not information about you.

Web server logs

What is kept: The ordinary record a web server keeps of each request: the IP address it came from, the time, the address requested, and the browser's own description of itself.
What for: Keeping the site up, and working out what happened when something breaks or somebody attacks it.
On what basis: Article 6(1)(f) GDPR - our interest in a site that works and is not abused.
For how long: By the hosting provider, under their retention. Nothing on this site reads them as a matter of course.
Who can see it: The site's operator and the hosting provider.

MGDS

This part applies to the MGDS pages and to anything that sends data to them. Last changed 30 October 2026.

Projects you make

What is kept: The name you give each project, the id the site gave it, when you made it, and that it is yours. Each project gets a database of its own, named after your email address or SteamID and the project's id.
What for: So the project is there when you come back, and only you can see it.
On what basis: Article 6(1)(b) GDPR - providing the service you asked for by making one.
For how long: For as long as the project exists. Ask and it goes.
Who can see it: Only you, and the people who run this site.

Service accounts you make

What is kept: The name you give each service account, when you made it, which of your projects it may use and for what, and for each of its keys a one-way hash, its last four characters, when it was made, last used and revoked. The key itself is never kept.
What for: So your servers and tools can call MGDS on your behalf, and you can see which key is in use.
On what basis: Article 6(1)(b) GDPR - providing the service you asked for by making one.
For how long: For as long as the service account exists; archiving keeps it. Ask and it goes.
Who can see it: Only you, and the people who run this site.

Signing in to a game that uses MGDS

What is kept: When a game built on MGDS signs you in, that game's project keeps a player record for you: an id, when it was made and when you last played, and how you signed in. That is your SteamID if you used Steam; your dasmaffin.com account's id and the name on your profile if you used dasmaffin.com (the game is never given your email address or password); or, if you played without an account, only a one-way hash of a key the game keeps on your device. While you are signed in, a hash of the game's session token is kept too.
What for: So the game knows it is you when you come back, on whichever device you sign in from.
On what basis: Article 6(1)(b) GDPR - providing the sign-in the game asked for on your behalf.
For how long: As long as the game's project exists. Signing out deletes that session at once, and an unused session expires after 90 days. Ask and your player record goes.
Who can see it: The developer of that game, in their project, and the people who run this site. Steam is asked whether a Steam ticket is real; nothing else is sent anywhere.

Reporting a problem in a game that uses MGDS

What is kept: What you write in the report, its kind, the game's build and where you were, and whatever the game attaches: logs, pictures, recordings, measurements, and facts about your device. If you were signed in to the game, which player you are; if not, the name the game gave, if any. Any answers you and the developer write. Large attachments are kept on our file storage server, encrypted with a key only this site holds. Your address is held in memory for an hour to limit how many reports can be sent, and is not stored.
What for: So the game's developer can fix what went wrong and answer you.
On what basis: Article 6(1)(b) GDPR - providing the report feature you chose to use.
For how long: As long as the game's developer has chosen to keep reports for, or until they delete it. Ask and it goes.
Who can see it: The game's developer, through this site and through their own servers if they allow them to read reports, and the people who run this site. If you were signed in, you, in the game.

Save files in a game that uses MGDS

What is kept: Whatever the game saves for you: numbers, text, structured data and files it uploads, under names the game chooses, with when each was last changed. Large values and uploaded files are kept on our file storage server, encrypted with a key only this site holds.
What for: So your progress and settings are there on any device you sign in from.
On what basis: Article 6(1)(b) GDPR - providing the game's save feature on your behalf.
For how long: Until every owner of a file has left it (a game can share a file between several players), or the game's project is deleted. Ask and they go.
Who can see it: A private save file: its owners, through the game - you, and anybody the game added to it with you - and the game's developer. A public one: anybody who knows it, which is what public means; the game decides which of its files are public. The people who run this site can see both.

Other parts of this site keep their own things:

What you can ask for

Under the GDPR you may ask us to:

Show you what we hold about you (Article 15). You do not have to write to anybody for this one: your profile has a button that gathers it from every part of the site and sends it to you as a file, once a week.
Correct it if it is wrong (Article 16).
Delete it (Article 17).
Stop using it while a disagreement is sorted out (Article 18).
Hand it over in a form you can take elsewhere (Article 20).
Object to any use we base on our own legitimate interest (Article 21).

For the rest, write to admin@dasmaffin.com from an address we can tie to your account, or include your SteamID. There is no form and no fee, and we answer within a month. Deleting is done by hand today, so ask and it is done rather than pressed.

If you are not happy with the answer

You can complain to the Austrian data protection authority: Osterreichische Datenschutzbehorde, Barichgasse 40-42, 1030 Wien, dsb@dsb.gv.at, dsb.gv.at. If you live in another EU country you may complain to your own authority instead.

Where it is kept

On servers rented from a hosting provider, who processes it on our behalf and under contract and does nothing else with it. Signing in involves Valve Corporation, whose own handling of your Steam account is described in the Steam Privacy Policy. We send Valve nothing about you; you are sent to them, and they tell us the SteamID you signed in with.

Children

Nothing here is aimed at children, and we do not knowingly keep data about anybody under 14. Tell us and it goes.

Changes

When this changes, the date at the top changes with it. There is no mailing list to be dropped from, because there is no mailing list.