Privacy policy
How QUIRSO processes data when you use IR Arena. For privacy questions, contact datenschutz@quirso.de.
Privacy at a glance
- Account: your email address and display name let you sign in and save your progress.
- Games: your decisions and results are saved so you can continue and review them.
- Leaderboard: your nickname and results appear only if you enable visibility. Your email stays private.
- Your choice: export or delete your account in account settings. The Arena uses no advertising or analytics trackers.
Open a topic for details about purposes, recipients and retention.
Updated 27 October 2026. This notice covers the public Halloween 2026 edition of IR Arena: solo games against the bot, accounts, saved matches, the leaderboard and account email features.
Controller and contact
QUIRSO GmbH, August-Bebel-Straße 26-53, 14482 Potsdam, Germany, represented by Stefan Zimmermann, Denis Szadkowski and Çağatay Yürekli. General contact: info@quirso.de. Privacy contact: datenschutz@quirso.de. See the legal notice for company details.
Accounts, games and visibility
We use your email and display name to provide your account. We save your games, results and any feedback you submit. Other players cannot access your saved games.
The leaderboard is optional and off by default. If you enable it, other signed-in players can see your leaderboard name and results. You can turn it off at any time.
Purposes and legal bases
Accounts, saved games and requested account messages provide the service you request (GDPR Article 6(1)(b)). Security, operational diagnosis and improvement through voluntary feedback serve legitimate interests in a secure, useful service (Article 6(1)(f)). Optional leaderboard publication uses your consent (Article 6(1)(a)), which you may withdraw for the future.
Requests necessarily process your IP address, timestamp, requested path and connection metadata. Abuse protection uses time-limited hashes of IP and email; these hashes are not treated as fully anonymous data.
Hosting, email and recipients
Microsoft Azure provides hosting; Microsoft 365 delivers account verification and password-reset emails. Only authorized staff and service providers can access your data as needed to run and support the service.
Cookies, storage and retention
The necessary __Host-arena_session cookie is HttpOnly and sent over HTTPS. Sessions last at most seven days, expire after 24 hours of inactivity and can be revoked by logout or credential changes. The arena-language cookie retains your selected language for up to one year. Browser storage retains your selected display settings. The application includes no advertising/analytics trackers and serves bundled fonts locally. Necessary login and expressly requested functions rely on the exception in section 25(2)(2) TDDDG; no blanket tracking consent is requested.
Account data and progress remain available while your account is used, until deletion or the processing purpose ends. Account settings provide data export and password-confirmed deletion. Deletion removes your sign-in credentials, saved matches and feedback, and anonymizes your profile.
Verification links expire after 24 hours and reset links after 15 minutes; both are single-use. Abuse-limit windows last 15 minutes. Expired technical entries are cleaned in bounded batches during subsequent authentication activity. Logs are kept for up to 30 days and backups for up to 14 days. Deleted data may remain in backups until they expire.
Your rights
Subject to applicable requirements, you may request access, rectification, erasure, restriction or portability, object to legitimate-interest processing based on your situation, and withdraw consent for the future. Contact datenschutz@quirso.de.