Privacy

As of 4 October 2026

This site does exactly two things with data: it serves itself, and on request it accepts your email address for the beta. No account, no login, no analytics, no advertising IDs.

The site itself

Every file — fonts, scripts, images — sits on the same server as the page. Nothing is loaded from third-party servers: no Google Fonts, no CDN, no analytics service. No cookies are set; the browser stores nothing from this site.

No access logs. The web server writes no access log for this domain: neither IP address nor timestamp, requested path or user agent is stored permanently. Connection data is processed in memory only while the page is being served and discarded afterwards. The server is hosted by Hetzner Online GmbH in Germany.

The beta signup

What is stored: your email address, the time you signed up, whether you confirmed, and whether you used the upper or the lower form. Nothing else — no name, no IP address in the list.

Double opt-in. After you submit, your address sits in the list as “unconfirmed” and exactly one email goes out to you: the request to confirm the entry. Only your click on the button in that email actually signs you up. If you do not click, nothing further happens and the unconfirmed entry is deleted after 60 days at the latest. This protects you from somebody else putting your address on lists.

The legal basis is your consent (Art. 6(1)(a) GDPR), given when you confirm. You can withdraw it at any time — through the unsubscribe link in every email or informally to the address below. After withdrawal we send you nothing further.

What we use the address for: solely for the closed beta of Horde Rush: Castle Siege. That means the invitation, short notes on how the beta is going and the message when the game is released. No general newsletter, no advertising for other products, no sharing or selling to third parties.

How long: until the end of the beta phase, at most until you object. After that the address is deleted. We keep a record of consent for as long as it is needed as proof, and no longer.

Abuse protection

So that no bot can enter other people’s addresses, the server checks three things on submission: that the request comes from this site, that an invisible check field stayed empty, and that the form was actually open. For the last check and for a limit of a few signup attempts per hour, your IP address is processed briefly: once to compute a check value, and once as a non-reversible hash for the hourly counter. The IP address itself is not stored; the counter file holds only the hash and timestamps and becomes meaningless after an hour. The legal basis is our legitimate interest in a working, abuse-free form (Art. 6(1)(f) GDPR). We deliberately do not use a captcha.

Email delivery

The confirmation and beta emails are sent on our behalf by Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA, over their infrastructure in the EU (Ireland). Your email address is transmitted to Resend for this. A data processing agreement is in place with Resend; the EU Commission’s standard contractual clauses apply to the transfer to the USA (Art. 46(2)(c) GDPR). It is possible that US authorities access this data and that you do not have the same legal remedies against that as in the EU. Only what is needed for delivery is transmitted: your address and the text of the email.

No tracking pixels

Our emails contain no counting pixels and no redirected links. We cannot see whether you opened an email — only whether you pressed the confirmation button, because that is what the button is for.

Your rights

An informal message to the address below is enough; you do not need a form for it. You may also complain to a supervisory authority — the competent one is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

Controller

Martin Langhammer
Carola-Neher-Straße 12
81379 Munich
Germany
contact@c-arena.com

Full provider details in the imprint.