Privacy policy

1.Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

No data protection officer has been appointed at present. Please send privacy requests to the email address above.

2.Principles and legal bases

We process only data that is necessary to run the site, provide memberships and keep the service secure. There is no tracking, no analytics or advertising cookies and no sharing for advertising purposes. External content (videos, music players, station previews, map) is loaded only after you actively click on it.

Depending on the operation, the legal bases are:

• Art. 6(1)(b) GDPR – performance of the usage agreement for the member account (registration, login, posts, notifications),
• Art. 6(1)(f) GDPR – legitimate interests in secure, stable operation, abuse prevention and the handling of reports,
• Art. 6(1)(c) GDPR – legal obligations, for example under the Digital Services Act (handling and documenting notices),
• Art. 6(1)(a) GDPR – consent, insofar as you load external content by clicking.

3.Hosting, database and server logs

The application is operated at Hostinger International Ltd.. A data processing agreement under Art. 28 GDPR is in place with the provider. Server location: Placeholder: [data centre location according to the hosting contract].

The application's database is operated on our behalf by Neon Inc. (USA), AWS eu-central-1 (Frankfurt am Main). It stores the site content, member accounts (see registration and member account) as well as forum posts, comments, chat messages and reports (see forum, comments and chat). As with hosting, the legal basis is Art. 6(1)(f) GDPR (secure, stable operation); insofar as your member account and your posts are concerned, additionally Art. 6(1)(b) GDPR (usage agreement). A data processing agreement under Art. 28 GDPR is in place with the provider.

Database provider headquartered outside the EU or the EEA: insofar as personal data is transferred to the provider's home country in the course of operating the database (for example for maintenance or support), this takes place on the basis of an adequacy decision of the European Commission (Art. 45 GDPR; for a provider headquartered in the USA, the EU-US Data Privacy Framework, provided the provider is certified under it) or standard contractual clauses (Art. 46(2)(c) GDPR). A copy of the standard contractual clauses is available from us on request (see controller for contact details).

When a page is requested, the following data is processed in server logs for technical reasons:

• IP address of the requesting device,
• date and time, requested address, HTTP status code and amount of data transferred,
• browser identifier (user agent) and, where applicable, the previously visited page (referrer).

The purpose is delivering the site, analysing errors and defending against attacks (Art. 6(1)(f) GDPR). Log retention: Placeholder: [retention period according to hosting configuration, e.g. 14 days].

We notify search engines (e.g. Microsoft Bing) of new or updated pages via the IndexNow protocol; only the addresses (URLs) of our pages are transmitted, no data about visitors or members.

4.Content delivery network (images)

We deliver images through a content delivery network (CDN) operated by BunnyWay d.o.o. (bunny.net), Slowenien. When an image is requested, the CDN processes the IP address of your device and the usual connection data in order to deliver the file and prevent abuse (Art. 6(1)(f) GDPR). A data processing agreement is in place. Delivery locations: Placeholder: [confirmation that delivery is restricted to EU locations].

This also applies to official images from Rockstar Games: we store them ourselves and deliver them through our server or the CDN. Viewing our pages does not open a connection to Rockstar Games.

5.Email delivery

Transactional emails (registration confirmation, password reset, optional notifications) are sent via Placeholder: [SMTP provider for transactional email]. Your email address, the subject and the content of the message are transmitted to that provider (Art. 6(1)(b) GDPR; data processing agreement under Art. 28 GDPR). We also email you about moderation decisions concerning your account (temporary or permanent suspension) and – if you reported something without an account and gave your email address – about the decision on your report; members receive this feedback in their notifications (Art. 6(1)(c) GDPR in conjunction with Art. 16 and 17 DSA). There are no newsletters or marketing emails.

6.Registration and member account

An account is only needed for community features (forum, comments, chat, bookmarks). Articles can be read without an account. When you register we store:

• email address (visible only to you and the editorial team) and public username,
• your password exclusively as a hash (Payload authentication, bcrypt); the plain-text password is not stored,
• timestamps of your confirmations: minimum age 18 (self-declaration), community rules with version number, privacy policy, registration language,
• a truncated hash of your IP address at the time of registration, computed with a secret key (no plain-text IP),
• time of last login, post counters, optionally a profile text and display name,
• the time of your last activity (updated at most every five minutes). It is used only to list you under “Who is online” – and only if your profile is public and you have not switched the display off in your account,
• your rank (Member, Supporter, Honorable Member) and achievements derived from your posts (e.g. first post, helpful answers); they are part of your public profile,
• optionally an avatar: either a preset from our set or an image of your own. When uploading you confirm that you hold the rights to the image; it is resized to 512 pixels, stripped of metadata and stored with the CDN provider (see CDN) under a path containing your account ID. Images of new accounts are reviewed by moderation before they are shown. You can remove the avatar at any time; it is deleted with your account.

Spam protection at registration: the form contains a field invisible to humans and a signed timestamp. If the field is filled in or the form is submitted in under four seconds, no account is created. No additional data is stored for this (Art. 6(1)(f) GDPR).

Purpose: providing the account and the community features (Art. 6(1)(b) GDPR); the IP hash serves to prevent mass registrations and ban evasion (Art. 6(1)(f) GDPR). Registration is confirmed by email (double opt-in).

Login: after five failed attempts the account is locked for 15 minutes. The session runs via a cookie (see cookies) and ends after seven days at the latest; you can end all sessions at any time in your account. A password reset link is valid for one hour.

Retention: until the account is deleted. You can request deletion in your account; we carry it out, anonymise your posts (the username is removed) and delete the account data including the IP hash. Public posts remain in anonymised form so that discussions stay readable.

7.Forum, comments and chat

Forum posts and article comments are public and visible with your username and timestamp – also to visitors without an account and to search engines. Consider what you share; personal data of third parties is not allowed.

• Edits to a post are stored as revisions so that moderation decisions remain traceable.
• For each post we store a truncated hash of your IP address at the time of posting, computed with a secret key (no plain-text IP). The purpose is abuse prevention (spam, ban evasion, multiple accounts; Art. 6(1)(f) GDPR). The hash is visible only to the editorial team and is removed automatically 90 days after the post; the post itself is not affected.
• Reactions (“helpful”), bookmarks, subscriptions and notifications are linked to your account and deleted with it.
• The member chat is visible only to logged-in members. Messages are deleted automatically after the retention period, which is 30 days by default.
• If you block a member, we store that relation until you lift it or your account is deleted.
• For the “New” marker in topic lists we store, for each topic you open as a logged-in member, the time of your last visit (read state). This record is visible only to you and the editorial team and is deleted with your account.

Legal basis: Art. 6(1)(b) GDPR (usage agreement) and Art. 6(1)(f) GDPR for moderation and traceability.

8.Reports and moderation

You can report content with or without an account. When you report, we store the reason, description, the reported address, for guests the email address given for follow-up questions, and a hash of your IP address for abuse prevention. Moderation actions (notice, hiding, temporary suspension, ban) are logged with a reason and communicated to the affected member.

Legal bases: Art. 6(1)(c) GDPR (obligations under the Digital Services Act, in particular Art. 16 and 17) and Art. 6(1)(f) GDPR. Retention: Placeholder: [retention period for closed reports and moderation logs, e.g. 12 months].

9.Abuse protection (rate limits)

To limit spam, mass registrations and attacks on login forms, we count actions per time window. For this we briefly store a key made up of the action and either your account ID or a hash of your IP address. These entries are deleted automatically after two hours at the latest (Art. 6(1)(f) GDPR).

10.Cookies and local storage

We set at most two cookies, both strictly necessary – one only when you log in, the other only in the preview before launch:

These cookies are strictly necessary (Section 25(2) no. 2 of the German TDDDG); no consent is required for them, which is why there is no cookie banner. There are no tracking, analytics or advertising cookies.

In addition, your browser may store locally (localStorage, never transmitted to us) that you confirmed the age notice (key leonidatime-age-confirmed), if the age confirmation is active.

Leonidatime is non-commercial and shows no advertising. There are therefore no ad networks, partner programmes or payment providers that could receive data.

11.Embedded content (only after a click)

Videos and the station previews and music players on the music page are initially shown only as placeholders with a notice.Only when you click “load” is a connection to the respective provider established and your IP address and browser data transmitted there (Art. 6(1)(a) GDPR). No data flows before the click.

• Rockstar Games – station previews (Rockstar Games, Inc., Take-Two Interactive Software, Inc., New York, USA): the radio station previews on our music page are the official players from rockstargames.com, embedded with the code Rockstar provides. After loading, Rockstar may set its own cookies and transfer data to the USA. Details: Rockstar Games privacy policy ↗.
• Spotify (Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden): we embed the singles of the official album as Spotify players. After loading, Spotify may set its own cookies and – depending on your login – link data to your Spotify account; a transfer to the USA is possible. Details: Spotify privacy policy ↗.
• YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): we use the privacy-enhanced mode via youtube-nocookie.com. After loading, YouTube may set its own cookies and transfer data – including to the USA (Google LLC); according to its own statements, Google relies on the EU-US Data Privacy Framework and standard contractual clauses for this. Details: Google privacy policy ↗.
• Interactive map: we currently neither embed nor link a third-party map; no data is transferred to any map provider.

12.Your rights

Under the GDPR you have the following rights towards us:

• access to the data stored about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing based on legitimate interests (Art. 21),
• withdrawal of consent with effect for the future (Art. 7(3)).

To exercise them, write to kontakt@leonidatime.de. You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for our registered office: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.

13.Retention periods at a glance

14.Transfers to third countries

Apart from the database provider headquartered outside the EU or the EEA (see hosting, database and server logs), we ourselves do not transfer data to countries outside the EU or the EEA. Any other transfer can only take place if you actively load embedded content (YouTube, Rockstar Games, Spotify) – see embedded content. For hosting, database, CDN and email delivery, the locations and agreements stated above apply.

15.Changes to this policy

We update this policy when the site or the legal situation changes – for example before introducing new features or services. The date at the top shows the current version. We announce material changes to members with a notice in their account. If you have questions, reach us via the contact page.