redbat.freberg.guru

Last updated: 25 June 2026

This policy explains what personal data redbat.freberg.guru ("we", "the site") collects, why, and the rights you have under the EU/EEA General Data Protection Regulation (GDPR). The site is operated from within the EEA (Norway).

Who is responsible

The data controller is the operator of redbat.freberg.guru, Hypnotize. For any privacy request you can contact us at redbat.freberg.guru.qy8sv@passmail.net.

What we collect

• Account details you provide when registering: full name, nickname and e-mail address.
• Your password, stored only as a salted bcrypt hash — we can never read it.
• Technical data: the IP address of your last sign-in / account change, kept for security and abuse prevention. Failed-login and rate-limit counters store only a one-way hash of your IP.
• Gameplay data: which challenge level you have reached.
• Two-factor authentication data, if you turn it on: the authenticator secret shared with your app (which we must keep to check your codes) and your one-time recovery codes (kept only as one-way hashes). You can turn it off again at any time in account settings, which deletes them.
• Purchase records for the paid chapters: which chapter you bought, the amount and currency, the payment status, and the PayPal order and transaction (capture) identifiers. We never see or store your card number or PayPal login — those are handled entirely by PayPal.
• Licence records if you redeem a whole-game licence key: which licence is tied to your account, its tier (for example one week or lifetime), its status, and the dates it was redeemed, expires and — if applicable — was revoked. The licence key itself is stored only as a one-way hash, never in readable form.

How we use it and our legal basis

• To create and run your game account and save your progress — necessary to provide the service you asked for.
• To send the account-confirmation e-mail when you register and a password-reset e-mail when you request one — at your request. We do not send marketing e-mail.
• To sell and unlock the paid chapters and to handle any refunds or payment disputes — necessary to perform the purchase contract you enter into. We are also required to keep the resulting purchase records to meet our accounting obligations.
• To validate and activate a whole-game licence key you redeem, to unlock the paid chapters it covers, and to revoke a licence where necessary (for example a refund or chargeback) — necessary to perform the purchase contract. As with chapter purchases, we keep the resulting licence records to meet our accounting obligations.
• To protect the site (login rate-limiting, abuse prevention) using your IP address — our legitimate interest in keeping the service secure.

Cookies

We use only strictly necessary, first-party cookies — no analytics, advertising or third-party tracking:

• A session cookie (PHPSESSID) that keeps you signed in. It is HttpOnly, SameSite=Lax and Secure over HTTPS.
• Small challenge cookies (e.g. helpme, lvl24_token) set by some of the puzzles. They hold only throwaway gameplay values, never personal data.

Because these cookies are essential to the site working, they do not require consent, but we disclose them here for transparency. Your "OK" on the cookie notice is only stored in your browser (local storage), not sent to us.

Who we share it with

We do not sell your data or share it for marketing. We rely on the following third parties:

• Proton Mail (Proton AG, Switzerland) — whose SMTP service we use to deliver the account-confirmation and password-reset e-mails you request. Switzerland is recognised by the EU as providing an adequate level of data protection.
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) — which processes payments for the paid chapters and handles any refunds or disputes. You enter your payment details with PayPal directly; we receive only confirmation of the payment together with the order and transaction identifiers, never your card number or PayPal credentials.
• Our licence store — the third-party service that sells the whole-game licence keys. When you buy a licence you transact with that store directly, under its own terms and privacy policy; it sends us only the licence key and its tier so the key can be redeemed on the site. We do not receive your payment details from it.

How long we keep it

We keep your account data until you delete your account. Deleting your account erases your account record — your name, nickname, e-mail, last sign-in IP address, progress and any two-factor data — immediately and permanently. The one exception is your nickname: we keep a one-way hash of it so the handle can never be re-registered by anyone else, which protects your past identity on the site. The hash cannot be turned back into your nickname.

We keep your purchase records (chapter, amount, status and PayPal identifiers) and your licence records (tier, status and redemption dates) even after you delete your account, because we are legally required to retain accounting records and may need them to process a refund or payment dispute. We hold these only for as long as the law requires (in Norway, up to five years) and then delete them.

Unconfirmed sign-ups are discarded when their confirmation link lapses (24 hours). Password-reset tokens expire after one hour.

Your rights

Under the GDPR you have the right to access, correct, export, restrict or object to the processing of your data, to withdraw consent, and to erase your data:

• Access & portability — while signed in you can download a copy of your data at any time, in machine-readable JSON: Download my data.
• Erasure — while signed in you can delete your account and all its data yourself at any time: Delete my account.
• Correction — update your nickname, e-mail or password yourself anytime in account settings.
• Restriction or objection — e-mail redbat.freberg.guru.qy8sv@passmail.net and we will respond within one month.

If you believe we have mishandled your data you may lodge a complaint with your local data protection authority. In Norway this is Datatilsynet (datatilsynet.no).

Changes

If this policy changes we will update the date above.