Privacy - TGSC
What this site collects, why, and what you can do about it. Last changed 5 August 2026.
Who is responsible
Maffin e.U., Brochweg 12, 6100 Mösern, Austria.
Email: admin@dasmaffin.com.
Full details on the imprint.
We are not required to appoint a data protection officer and have not appointed one. Write to the address above and you reach the person who runs this.
The site itself
This part applies wherever you are on the site.
Signing in with Steam
- What is kept
- Your SteamID, which is the public number identifying your Steam account, the moment you first signed in, the moment you last signed in, and which permissions on this site have been granted to you. Signing in happens at Steam: you type your password on Valve's pages, never on ours, and we never see it. Steam tells us the SteamID and nothing else.
- What for
- To know who you are between pages, and to decide what you are allowed to see.
- On what basis
- Article 6(1)(b) GDPR - it is what you asked for by signing in. There is nothing on this site you have to sign in to read unless it is somebody's private data.
- For how long
- Until you ask for it to be removed. Ask and it is removed.
- Who can see it
- You, and the accounts holding the permission to manage permissions.
Staying signed in
- What is kept
- One cookie holding a session identifier. No advertising cookie, no analytics, no tracking pixel, and nothing loaded from another company's servers - every stylesheet, script and font on this site is served from this site.
- What for
- So that following a link does not sign you out.
- On what basis
- Strictly necessary for a service you asked for, so no consent banner and nothing to opt out of.
- For how long
- Until the session ends or you sign out.
- Who can see it
- Nobody. It is an identifier, not information about you.
Web server logs
- What is kept
- The ordinary record a web server keeps of each request: the IP address it came from, the time, the address requested, and the browser's own description of itself.
- What for
- Keeping the site up, and working out what happened when something breaks or somebody attacks it.
- On what basis
- Article 6(1)(f) GDPR - our interest in a site that works and is not abused.
- For how long
- By the hosting provider, under their retention. Nothing on this site reads them as a matter of course.
- Who can see it
- The site's operator and the hosting provider.
TGSC
This part applies to the TGSC pages and to anything that sends data to them.
Feedback sent from inside the game
- What is kept
- Only what you send by filling in the feedback form and pressing send. That is: your SteamID and Steam name, what you wrote, the pictures you chose to attach - which are screenshots of the game as it was, so whatever was on the screen is in them - the world you were playing, the game's own log for the session, and a description of the machine: operating system, processor, graphics card and driver, memory, screen size and settings. No report is ever sent without you pressing the button.
- What for
- Working out what went wrong and fixing it. Nothing in a report is used to advertise anything, and none of it is sold or passed to anybody.
- On what basis
- Article 6(1)(a) GDPR - you send it deliberately, and you can change your mind: ask and the report is deleted.
- For how long
- 120 days, then deleted automatically. Sooner if the pile of reports grows past its size limit, oldest first, and sooner still if you ask.
- Who can see it
- The accounts holding the permission to read TGSC feedback, which today is the developer, and the developer's own tooling, which reads the same reports through an address that answers nothing without a secret key. Reports are not public and are not reachable by guessing an address.
The report ban list
- What is kept
- The SteamID of an account barred from sending feedback, the reason, who barred it and when, and when it was lifted.
- What for
- Stopping abuse of the feedback address, which anybody on the internet can post to. Without it, one person can bury every real report.
- On what basis
- Article 6(1)(f) GDPR - our interest in a feedback channel that still works.
- For how long
- While the ban stands, and for as long afterwards as it takes to see a pattern. A lifted ban keeps only who lifted it and when.
- Who can see it
- The accounts holding the permission to read TGSC bans.
Counting visits to the sales page
- What is kept
- Three things per visit, and nothing that says who you are: the moment you opened the page, which country your internet connection is in, and which of the buttons - the demo, the Discord, the wishlist - was pressed. Your IP address is used once, in memory, to work out the country, and is never written down. There is no cookie, no identifier, no browser fingerprint and nothing kept on your machine, so two visits by you cannot be told apart from visits by two people - which also means this counts visits rather than visitors, and is described that way wherever it is shown.
- What for
- Knowing whether anybody is finding the game, and whether the page persuades them to try it. Nothing is sold, shared, or passed to an analytics company - there is no third party involved at any point, which is why the country is worked out here from a public list of address ranges rather than by asking a service.
- On what basis
- Article 6(1)(f) GDPR - our interest in knowing whether the page works. It is named here for completeness: with no identifier and no personal data in the record, there is no person for the Regulation to protect in it, and nothing stored on your device that would need your agreement.
- For how long
- The counts, indefinitely - a visitor number is only worth anything compared with last month's. There is nothing in a row that ages into being sensitive, because there was nothing personal in it to begin with.
- Who can see it
- The accounts holding the permission to read TGSC visitor counts. Not because it would harm anybody to publish, but because it is a business figure.
What you can ask for
Under the GDPR you may ask us to:
- Show you what we hold about you (Article 15).
- Correct it if it is wrong (Article 16).
- Delete it (Article 17).
- Stop using it while a disagreement is sorted out (Article 18).
- Hand it over in a form you can take elsewhere (Article 20).
- Object to any use we base on our own legitimate interest (Article 21).
Write to admin@dasmaffin.com from an address we can tie to your account, or include your SteamID. There is no form and no fee, and we answer within a month.
If you are not happy with the answer
You can complain to the Austrian data protection authority: Osterreichische Datenschutzbehorde, Barichgasse 40-42, 1030 Wien, dsb@dsb.gv.at, dsb.gv.at. If you live in another EU country you may complain to your own authority instead.
Where it is kept
On servers rented from a hosting provider, who processes it on our behalf and under contract and does nothing else with it. Signing in involves Valve Corporation, whose own handling of your Steam account is described in the Steam Privacy Policy. We send Valve nothing about you; you are sent to them, and they tell us the SteamID you signed in with.
Children
Nothing here is aimed at children, and we do not knowingly keep data about anybody under 14. Tell us and it goes.
Changes
When this changes, the date at the top changes with it. There is no mailing list to be dropped from, because there is no mailing list.