This policy describes which personal data is processed when you visit and use GameNavigator.ai. We wrote it to be understandable without prior knowledge; the legal references are there so you can look things up. The German version of this policy is the legally binding one.

Controller

The controller within the meaning of Art. 4 (7) GDPR is:

Provimedia GmbH
Weidenweg 12, 74321 Bietigheim-Bissingen, Germany
Email: info@provimedia.de
Phone: +49 7142 9170511

Data protection officer: Patrick Rempfer, email rempfer@provimedia-team.de

The essentials

  • Without your consent we only set the cookies the site needs to work (session, form protection, your consent choice).
  • Google ads and the cookies that come with them are only loaded once you have agreed in the consent dialog. Supporters see no ads.
  • The navigator (AI chat) sends your question to Anthropic and OpenAI. Names, email addresses or account data are not sent along.
  • The navigator only keeps a memory if you switch it on in your account; you can export and delete it at any time.
  • What you write in the forum is public. If your account is deleted, we delete your forum profile; your posts remain under "Deleted account".
  • Five labelled AI accounts of the team write in the forum. If one of them replies to a post, that post's public text goes to Anthropic, without your display name. For your own threads and for your own posts you switch this off in your profile.
  • We use an AI model from Anthropic to translate forum posts and thread titles into the language of the other language area, where they are shown with a label. Quotes from other posts are not sent, and neither is your display name. You can switch this off with "Don't translate my posts" in your profile.
  • Private messages in the forum are seen only by the two people in the conversation. The team does not read them, and there is no view for them in the administration.
  • Forum notifications exist only on the site, not by email. We delete them after 90 days.
  • Payments are handled by Stripe. We do not store card data.
  • The newsletter uses double opt-in; every mail contains an unsubscribe link.

Hosting and server log files

GameNavigator runs on servers of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, in a data centre in Germany. A data processing agreement under Art. 28 GDPR is in place with netcup. Our search (Meilisearch) and the database run on these servers as well.

On every request the web server writes to a log file: the IP address of your device, date and time, the address requested, the page visited before (referrer), browser type and operating system, and the status code of the response. We only use this data to keep the service running, to find faults and to fend off attacks.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure, stable operation). Retention: 14 days, in the event of a security incident until it has been resolved.

Cookies and access to your device

Which cookies and storage technologies we use, when they require consent and how you withdraw it is described on the page Cookies & Consent. In short: strictly necessary cookies (session, form protection, consent storage) are set without consent under Section 25 (2) no. 2 of the German TDDDG; advertising cookies only after your consent under Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR.

Newsletter

When you subscribe to the newsletter, we store your email address, the language you chose, the game you signed up for, and the time of sign-up and confirmation. Of the IP address you signed up from we store only a hash value (SHA-256) to detect abuse of the form; the address itself is not stored.

We first send you an email with a confirmation link (double opt-in). Only when you open that link is the address subscribed; without confirmation nothing is sent. Mails are sent through our own mail server; no external newsletter service is involved.

Legal basis: Art. 6 (1) (a) GDPR (consent), in addition Section 7 (2) no. 2 of the German Unfair Competition Act (UWG). You can withdraw your consent at any time: via the unsubscribe link in every email or by emailing us. After withdrawal we send no further mails; the address remains stored together with the unsubscribe date so that we can prove the withdrawal, and is deleted after 3 years. Unconfirmed sign-ups are deleted after 30 days.

The navigator is an AI system: your questions are answered by a language model that searches our game database and the wiki and cites its sources. We say so here and in the chat itself (Art. 50 of Regulation (EU) 2024/1689). Answers can contain errors; for decisions that matter to you, check the cited sources.

What we process. The text of your questions, the answers, the database tools and sources used along the way, the chosen language and mode, timestamps, the number of tokens processed and the game build the answer is based on. If you paste a character export string from our companion addon, we process the character data it contains (character name, level, race, class, talents, gear, professions, quests) to tailor the answer; it becomes part of the conversation history. This data comes from your game client, not from a Blizzard API.

Guests and daily quota. The navigator can be used without an account. To count the daily quota per person and to limit abuse, we derive a hash value (SHA-256) from your IP address and browser identification. We store this hash with the conversation and the usage counters; the IP address itself is not stored for this purpose. We set no cookies for the quota and read no device characteristics beyond the normal browser request.

Recipient: Anthropic. We send the questions together with the conversation history and the game data returned by our tools to Anthropic Ireland, Limited, Ireland, which processes them through its parent company Anthropic, PBC in the USA. Anthropic acts as our processor under Art. 28 GDPR on the basis of its Data Processing Addendum (effective 24 February 2025), which incorporates the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR) for the transfer to the USA. Under Anthropic's Commercial Terms (effective 17 June 2025), customer content is not used to train models. Names, email addresses, account data or the guest hash are not transmitted. This sentence is about the navigator, and it holds for the forum just the same: when an AI account replies to a post there, that post's public text goes along, but not the display name of its author. This is described in the section Forum under "AI accounts in the forum".

Recipient: OpenAI. So that our search can find matching wiki passages, the text of your question is converted into a numeric vector (embedding). This is done by OpenAI Ireland Ltd, Ireland, using the model text-embedding-3-small; processing takes place partly in the USA, safeguarded by the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR). According to its data controls, OpenAI does not use data sent through the API for training and keeps abuse-monitoring logs for at most 30 days.

Conversation history. We store your conversations in our database so that you can continue them and so that we can account for cost and quota. Guest conversations are deleted 30 days after the last message; conversations of signed-in users remain until you delete them or your account. Usage counters (tokens, cost, day) are kept without reference to the conversation for cost control.

Memory (only with consent). Signed-in users can switch on a memory. The navigator then remembers details such as your characters, your goals and your language as short entries and includes them with new questions. Without this consent nothing is remembered. You can view all entries at any time, export them as a file and delete them; if you switch the memory off, all entries are deleted. Legal basis: Art. 6 (1) (a) GDPR.

Legal bases. For answering your questions Art. 6 (1) (b) GDPR (provision of the service you requested); for quota, cost control and abuse prevention Art. 6 (1) (f) GDPR (legitimate interest in an affordable, fair operation).

User account

For the Supporter subscription, the navigator memory and writing in the forum you need an account. For it we store your email address, a name of your choice, a hashed password, the time of registration and confirmation, and the status of your subscription. Legal basis: Art. 6 (1) (b) GDPR. You can delete the account at any time; account data, memory and conversations are then deleted unless the retention periods stated below for invoices, business letters and cancellation and withdrawal declarations prevent this. If deleting the account ends a running Supporter subscription, we also keep a copy of the deletion confirmation, exactly as it was sent, for six years from the end of the year it was sent. We treat it as a business letter (Art. 6 (1) (c) GDPR in conjunction with Section 257 of the German Commercial Code (HGB), alternatively Art. 6 (1) (f) GDPR). The copy contains your name and email address but is no longer linked to the deleted account. What happens to your forum profile and your posts is described in the next section.

Forum

Anyone can read the forum at /forum and /de/forum, even without an account. Writing there means publishing: posts are visible to everyone. Which rules apply and how we moderate is described in the Forum Rules.

What is publicly visible. Threads and posts with their date, plus your display name, your avatar, your signature, your rank and your post count, a title if the team has given you one, and the reactions you have added to posts. Your profile page also shows your "About me" text, the date you joined and your posts. While you are signed in and active, your display name appears in the "Around right now" list. Threads and posts can be found by search engines; profile pages are marked so that search engines should not include them (noindex). Your threads and posts also appear translated in the other language area (see "Translation of forum posts"). Our own forum search (Meilisearch) runs on our servers at netcup.

What else we store.

  • For your forum profile: your role (member, moderator, super moderator, administrator), whether you want to see other people's signatures, when you were last active, and a suspension with its time limit and reason.
  • For posts: when, by whom and why a post was edited, and whether and why it is hidden.
  • Read positions: up to which post you have read a thread, so that we can mark what is new for you. Only you see this.
  • Subscriptions: which threads you have subscribed to (see Notifications and subscriptions). Only you see this.
  • Reports: who reported, which post, the chosen reason and your description, the processing status, who handled it and the outcome.
  • Moderation log: who took which measure on which post, thread or account, who was affected, the reason and the time.
  • For moderators: which boards they are responsible for.

For the rate limit we count how often your account posts; each counter lasts at most one minute. We do not store an IP address with posts; for the server log files, the section "Hosting and server log files" applies.

AI accounts in the forum. Five accounts of the team write in the forum with an AI model. They carry "(AI user)" after their display name, and every one of their posts states that a second model has checked the statements against our sources and that no person read the post before publication. What this means for your data:

  • What is transmitted. When an AI account replies to a post, we send the public text of that post and the title of the thread to Anthropic Ireland, Limited. The display name of its author does not go along: the model is not told who wrote the post. Your email address, your account data and everything that is not public in the forum do not go along either. Private messages never go along.
  • Why. So that one model can write the reply. A second model then checks the finished reply against our sources, for that it does not need your post: it gets only our own draft and our own evidence.
  • Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is a forum in which a question gets an answer even when nobody else is around. Our balancing, stated openly: what is transmitted is a text you published yourself, without your display name. No contact data goes along, the recipient is our processor, and it does not use the content for training. For your own threads and for your own posts you can switch the transmission off. That is why we do not regard your interest as overriding here. You may see it differently; that is what the objection is for.
  • Third country and safeguards. Anthropic Ireland, Limited processes the data through its parent company Anthropic, PBC in the USA. The basis are the European Commission's standard contractual clauses under Art. 46 (2) (c) GDPR, incorporated as Module Two or Three in Anthropic's Data Processing Addendum (effective 24 February 2025). We provide a copy on request.
  • Retention. What is transmitted is the post text that is public in the forum anyway; the retention stated in this section applies to it. Under its Data Processing Addendum, Anthropic deletes all copies of customer data at the latest 30 days after our agreement ends. Anthropic states no separate period for the individual request in its public documents; as soon as we have a reliable figure, it will be stated here.
  • Your objection (Art. 21 (1) GDPR). Your profile has the switch "No AI replies to my posts". With it set, no AI account replies in a thread you started any more, and nothing about those posts goes to Anthropic. You do not have to write to us for this and do not have to give reasons; the switch is the objection, and with it we ask for less than the law does. The switch works for the threads you started and for your own posts in other people's threads: no AI account replies to a post of yours any more, and its text does not go to Anthropic. What other people write in the same thread is not covered by it; their own switch decides that.

Translation of forum posts. The forum has an English and a German area, and every thread appears in both. That is why we use an AI model to translate what you write into the language of the other area. What this means for your data:

  • What is transmitted. After you save a post or a new thread, we send its text and, for the first post of a thread, the title to Anthropic Ireland, Limited. Quotes from other posts are not sent; they stay in the original wording inside the translation. Your display name, your email address and your account data are not sent. If you mention someone with @, that mention is part of the text and is sent along. If you edit a post, we translate it again. We do not translate private messages, signatures or your profile.
  • Why. So that members of both language areas can talk with each other instead of past each other. A program then compares each translation with the original (links, mentions, quotes). If it differs, we show your original in the other area instead of the translation.
  • How it appears. In the other area, the translation appears under your display name, labelled "Machine-translated (AI)", and your original is one click away. A thread that only appears mirrored in the other area is blocked for search engines there (noindex). If you reply in the other area to a thread, the labelled translation of your reply appears on that thread's page in its own area, and search engines can find that page. Our own forum search also finds the translation.
  • Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is a forum in which players talk to each other across the language barrier. Our balancing, stated openly: what is translated is a text you published yourself, without your display name. The recipient is our processor and does not use the content for training. The translation is labelled, your original stays readable next to it, and you can switch the translation off without giving reasons. That is why we do not regard your interest as overriding here. You may see it differently; that is what the objection is for.
  • Third country and safeguards. As for the AI accounts: Anthropic Ireland, Limited processes the data through its parent company Anthropic, PBC in the USA, on the basis of the standard contractual clauses under Art. 46 (2) (c) GDPR in Anthropic's Data Processing Addendum (effective 24 February 2025). We provide a copy on request.
  • Retention. We store the translation in our database and our forum search on our servers at netcup for as long as your original exists. If the original is deleted, we delete the translation with it; if it is hidden, the translation is no longer visible either. If you edit the post, a new translation replaces the old one. For storage at Anthropic, what is stated above under "AI accounts in the forum" applies.
  • Your objection (Art. 21 (1) GDPR). Your profile has the switch "Don't translate my posts". With it set, none of your posts and none of your titles go to Anthropic any more, and we delete all existing translations of your posts and titles, including from our search. The other area then shows your original. You do not have to write to us for this and do not have to give reasons; the switch is the objection. If someone else mentions you with @, that mention belongs to their post; you can object to that by email to the address above.

Purposes and legal bases.

  • Providing the forum, that is showing your profile, publishing posts and reactions, keeping read positions and subscriptions: Art. 6 (1) (b) GDPR (usage contract for the forum, Terms section 13).
  • Receiving and handling reports, giving reasons for restrictions and recording measures in the moderation log: Art. 6 (1) (c) GDPR in conjunction with Art. 16 and Art. 17 of Regulation (EU) 2022/2065 on digital services (Digital Services Act), and Art. 6 (1) (f) GDPR. Our legitimate interest: a safe forum, proof of our decisions, reviewing objections and defending against legal claims.
  • Rate limit, links only from the fifth post and an invisible form field: Art. 6 (1) (f) GDPR. Our legitimate interest: protecting the forum against spam and abuse.
  • The "Around right now" list: Art. 6 (1) (f) GDPR. Our legitimate interest: showing that someone is around in the forum right now. The five AI accounts stand in this list permanently, labelled; one sentence below the list says so, and a second counts separately the people who have been here in the last 15 minutes.
  • Letting the AI accounts reply and letting a second model check the reply against our sources: Art. 6 (1) (f) GDPR. The legitimate interest and the balancing are set out above under "AI accounts in the forum"; your objection is the switch in your profile.
  • Translating posts and titles into the language of the other language area, checking and showing the translation: Art. 6 (1) (f) GDPR. The legitimate interest and the balancing are set out above under "Translation of forum posts"; your objection is the switch in your profile.

Recipients. Public content can be seen by anyone who visits the forum, including search engines. When an AI account replies to a post, that post's public text also goes to Anthropic Ireland, Limited, without the display name of its author (see "AI accounts in the forum"). For translation, the text of a post and the title of a thread also go to Anthropic Ireland, Limited, without the author's display name (see "Translation of forum posts"). Hidden posts, reports and the moderation log are only seen by the responsible moderators and the administrators. We do not tell the affected person who reported them, unless this is exceptionally strictly necessary (Art. 17 (3) (b) DSA). If a post points to a crime that threatens someone's life or safety, we pass the information on to the law enforcement authorities (Art. 18 DSA, Art. 6 (1) (c) GDPR). Everything is stored on our servers at netcup.

Retention. We keep your profile, reactions, read positions and subscriptions as long as your account exists. Threads and posts remain until they are deleted, also beyond the deletion of your account (see below). We keep reports and moderation log entries as long as we need them to prove decisions, to handle objections (you have six months to object) and to defend against legal claims.

If your account is deleted. We then delete your forum profile with display name, avatar, signature, "About me", title, role and suspension note, as well as your reactions, read positions, subscriptions and your responsibilities as a moderator. Your threads and posts remain; instead of your name they show "Deleted account", and we no longer store a link to your account. Reports you sent and moderation log entries also remain, without a link to your account. The text of your posts stays readable unchanged, as do quotes from your posts and mentions of your display name in other people's posts. We keep the posts because discussions would otherwise stop making sense: replies and quotes refer to each other. The legal basis for this is Art. 6 (1) (f) GDPR. If you want individual posts to disappear as well, write to us; we review every such request under Art. 17 and Art. 21 GDPR. What happens to your private messages, blocks, notifications, votes in polls and the images in your posts is described in the following sections.

Private messages

In the forum you can write private messages to another member. A conversation always has exactly two participants.

Who can write. You need an account with a confirmed email address, a forum profile and at least one visible post of your own in the forum, and you must not be suspended from the forum. For the team (moderators and administrators) the requirement of a post of your own does not apply. Each account can write at most ten messages per hour.

What we store. The conversation with its two participants and its subject, every message with its text, sender and time, whether you have read a conversation or removed it for yourself, and whom you have blocked. For the limit of ten messages per hour we also count how many messages your account has written recently; that counter sits in the cache for up to an hour and then expires by itself.

Who sees the messages. Only the two participants. The team does not read private messages, and there is no view in the administration in which it could read them. Private messages are not in our search and not in the sitemap, and search engines do not include them. They are stored in our database on our servers at netcup. We do not tell you about new messages by email, only with a counter in the header of the site.

Blocking. You can block a member. That member can then no longer write to you, and an existing conversation between you becomes read-only for both of you: you can still read it, but no longer write in it. A block works in both directions: while it stands, you do not start a new conversation with that person either. The blocked person receives no notice; they only see that they cannot write to you. We store the block until you lift it (you can do so at any time in your messages) or one of the two accounts is deleted.

Removing and deleting. Each participant can remove a conversation for themselves; for the other person it remains. Once no participant is left, because both have removed the conversation or deleted their account, we delete the conversation together with its messages immediately.

If your account is deleted. The messages you wrote remain with the person you wrote to until they also remove the conversation or delete their account; then no participant is left, and we delete the conversation immediately. Until then the messages show "Deleted account" instead of your name. The text stays readable, and the other person usually still knows whom they were writing with. We keep the messages because they are also part of the other person's conversation and their own replies would no longer make sense without them. The legal basis for this is Art. 6 (1) (f) GDPR; the legitimate interest is that of the other person in keeping their conversation complete. You can object to this on grounds relating to your particular situation (Art. 21 (1) GDPR); to do so, write to the address above.

Purposes and legal bases.

  • Delivering, storing and showing messages and keeping the counter in the header: Art. 6 (1) (b) GDPR (usage contract for the forum, Terms section 13).
  • The requirements for writing, the limit of ten messages per hour and blocking: Art. 6 (1) (f) GDPR. Our legitimate interest: protecting members against spam and harassment.
  • Keeping the messages of a deleted account: Art. 6 (1) (f) GDPR, as described above.

Notifications and subscriptions

In the forum we notify you on the site when

  • a new reply appears in a thread you have subscribed to,
  • someone quotes one of your posts,
  • someone mentions you with @ and your display name,
  • the moderation team has taken a decision against you or has lifted one,
  • there is an outcome for a report you sent.

We send no emails for this. The notifications are kept in our database on our servers at netcup, and only you see yours.

Subscriptions. If you start a thread or reply in it, you subscribe to it automatically. You unsubscribe with the button in the thread.

What we store. For each notification its type, what it refers to (for example a thread, a post or a decision) and when it was created; for subscriptions, which threads you have subscribed to.

Legal bases. Art. 6 (1) (b) GDPR (usage contract for the forum). For the notices about a moderation decision against you and about the outcome of your report, in addition Art. 6 (1) (c) GDPR in conjunction with Art. 16 (5) and Art. 17 DSA.

Retention. We delete notifications automatically after 90 days, and immediately if your account is deleted. We keep subscriptions until you unsubscribe or your account is deleted. The statement of reasons for a moderation decision against you and the outcome of your report also remain available on the page My moderation decisions, even once the notification about them has been deleted; the retention of the moderation log from the section "Forum" applies to them.

Polls and images in the forum

Polls. Whoever starts a new thread can add a poll to it; one cannot be added later. Each member has one vote and cannot change it afterwards. Only the totals per answer are shown. So that each person can vote only once, we store internally which account has voted and when; that is personal data. Your choice itself is not stored with your account: we only increase the total of the chosen answer by one. That is why nobody, including the team, can look up who chose what. If only very few members have voted, however, the totals may reveal how someone voted. We keep the record that your account has voted as long as the thread exists: if the thread is deleted, we delete the poll together with its answers and all records immediately; if your account is deleted, the record is removed and the totals remain. Legal basis: Art. 6 (1) (b) GDPR (usage contract for the forum).

Images in posts. You can attach up to five images to a post (JPEG, PNG, WebP or GIF, at most 4 MB per file). While you are writing, the original file first sits unchanged in an upload cache: until you submit the post, and at most for 24 hours; after that it is deleted, even if you never submit the post. Our server converts every image anew to WebP, scales it down to at most 1600 pixels on the longest side and in doing so removes embedded metadata such as EXIF data and the GPS location. What can be seen in the image itself remains visible. We store the images non-publicly on our servers at netcup and deliver them only to readers who may see the post; for a public post, that is anyone who visits the forum. If a post is hidden, its images can only be seen by you and the moderation team. If a post is deleted, we delete its images immediately. As long as the post exists, its images remain as well, even if your account is deleted. Legal basis: Art. 6 (1) (b) GDPR (usage contract for the forum).

Supporter subscription and payment via Stripe

You pay for the Supporter subscription (EUR 4.99 per month) through Stripe. The contracting party for payment processing in the European Economic Area is Stripe Payments Europe, Limited, Dublin, Ireland. On Stripe's payment page you enter your payment details (for example the card number) directly with Stripe; we neither see nor store them. Stripe also receives your email address, the amount and the subscription reference. We store your Stripe customer ID, the status and term of your subscription and the invoice data.

Stripe processes payment data partly as our processor and partly under its own responsibility (for example for fraud prevention and because of legal obligations), as described in Stripe's privacy policy (last updated 16 January 2026). For transfers to the USA Stripe relies on the EU-US Data Privacy Framework and on the European Commission's standard contractual clauses.

Legal basis: Art. 6 (1) (b) GDPR (contract) and, for keeping invoices and accounting records, Art. 6 (1) (c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB). Retention: invoices and accounting records 8 years, business letters 6 years, each from the end of the calendar year. One such business letter is the contract confirmation we send you by email: we keep a copy exactly as it was sent. We do not delete it while the subscription it belongs to is running, and after that not earlier than six years from the end of the year it was sent and not before the end of the third calendar year after the subscription ended.

Cancellations and withdrawals

When you cancel your Supporter subscription with the cancellation button or withdraw from the contract, we store your declaration: the type of declaration, your email address, your subscription ID, when the contract was concluded, when your declaration reached us, when the contract ends and, where applicable, the amount and date of a refund, plus the language we reply in. For a cancellation we also store whether it is ordinary (at the regular end of the contract) or extraordinary (for good cause) and the date it is meant to take effect; we store a reason only for an extraordinary cancellation. If you still give a reason with an ordinary cancellation, we discard it without storing it. If you take back a cancellation with the link in the confirmation, we store when you did. For a withdrawal we also store your name. If you have an account, we link the declaration to it. If there is a subscription, we also keep a copy of the confirmation we send you by email, exactly as it was sent.

Purpose: we confirm receipt to you and want to be able to prove later that and when your declaration reached us and when the contract ended, for example if there is a dispute about a charge or a refund. Legal basis: if you have a contract with us, your declaration and our confirmation are business letters that we are required to keep: Art. 6 (1) (c) GDPR in conjunction with Section 257 (1) nos. 2 and 3 of the German Commercial Code (HGB) and Section 147 (1) nos. 2 and 3 of the German Fiscal Code (AO). Beyond that, and for a declaration with no contract behind it, Art. 6 (1) (f) GDPR (legitimate interest in keeping proof and defending ourselves against legal claims). If the reason for an extraordinary cancellation contains details such as information about your health, we process them only for this proof (Art. 9 (2) (f) GDPR).

Retention: if there is a contract, we keep your declaration and the copy of our confirmation for six years, counted from the end of the calendar year in which the declaration reached us or the confirmation was sent (Section 257 (4) and (5) HGB, Section 147 (3) and (4) AO). Independently of that, we keep the declaration and the copy of our confirmation until the end of the third calendar year after the year in which it reached us, the contract ended, a refund was paid or you took back a cancellation, whichever is latest; this is based on the standard limitation period under German law (Sections 195 and 199 of the German Civil Code). The later of the two periods applies. Example: if your cancellation reaches us in March 2027 and the contract ends in April 2027, we delete the declaration and the copy at the start of 2034. For a declaration with no contract behind it, only the second period applies. After that we delete automatically.

If you delete your account, the declaration and the copy stay until these periods end, because we are required to keep them and they serve exactly the proof we keep them for (Art. 17 (3) (b) and (e) GDPR). The link to your account is removed.

Measuring reach (Matomo, self-hosted)

We measure which pages get read, using Matomo. Matomo runs on our own server at www.provimedia.de/analytics/, operated by us. There is no processor here, nothing is passed to a third party, and nothing is transferred to a third country.

Only with consent, and truly nothing before it. On your first visit a banner asks whether we may measure. Only after you click "Allow" is the Matomo code loaded; until then no request goes to the measurement server, not even the one fetching the counting script. If you decline, nothing is loaded, nothing is stored, and you are not asked again.

What is processed. After your consent: IP address, the page visited, the referrer, time and duration of the visit, browser and device characteristics, and the identifiers from the Matomo cookies (_pk_id, _pk_ses, _pk_ref, _pk_cvar; names and lifetimes are on the cookie page). The purpose is measuring reach and nothing else: seeing which content gets read and where the site stumbles. We build no advertising profiles from it and do not combine it with any other data. In addition, also only after your consent: how far you read an article and which addresses on our site led nowhere (without the part of the address after the question mark). This only serves to improve content and to find errors.

IP shortening and retention. Matomo does not store your full IP address: the last two blocks are removed before anything is stored (192.168.12.34 becomes 192.168.0.0); for IPv6 addresses a correspondingly larger trailing part is removed. We delete the individual visit data after 365 days. What remains after that are only summary figures, such as how often a page was read in a month, with no link to individual visitors.

Private messages are exempt. On the pages of your inbox, the measurement only records that you were in the inbox, without the name of the person you are writing to and without the number of the conversation, both of which would otherwise be in the address. Which links you click inside a private message we do not record there at all.

Legal basis and withdrawal. § 25 (1) TDDDG and Art. 6 (1) (a) GDPR (consent). You can withdraw at any time with effect for the future: via the link "Change your choice on measurement" in the footer of every page, or by deleting the cookies in your browser. On withdrawal we delete the Matomo cookies immediately.

We show ads through Google AdSense, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data also flows to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (Commission adequacy decision (EU) 2023/1795 of 10 July 2023), and the standard contractual clauses apply in addition.

Only with consent. On your first visit a consent dialog (Google "Privacy & Messaging", certified under the IAB Transparency & Consent Framework 2.2) asks whether Google and its advertising partners may set cookies and process data for personalised or non-personalised advertising. Until you agree, consent for advertising cookies, advertising data and personalisation is set to "denied" (Google Consent Mode v2, default "denied"); advertising cookies are then not set and personalised ads are not shown. We store your choice in your browser so that we do not have to ask on every visit.

What Google processes. After your consent: IP address, cookie identifiers, the page visited, device characteristics and interactions with ads, in order to deliver, measure and personalise ads and to detect fraud. Details are in Google's notice How Google uses information from sites or apps that use our services and in Google's privacy policy.

Legal basis and withdrawal. Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR (consent). You can withdraw or change your consent at any time with effect for the future: via the link "Privacy settings" in the footer of every page or by deleting the cookies in your browser. Supporters see no ads; no advertising code is loaded for them.

Some links to retailers (for example for game time, game keys or accessories) are partner links and are marked with the "sponsored" attribute and a visible notice. Merely viewing the page transmits no data to the partner. Only when you click such a link are you forwarded to the partner's site; the partner then learns that you came from GameNavigator and may set a cookie on its site to attribute the commission. The partner's privacy policy applies to that. Current partner programmes: Instant Gaming, Eneba, Amazon Associates, Displate. Legal basis for the forwarding link: Art. 6 (1) (f) GDPR (funding of the service).

Amazon product images

In the fan shop and in the product suggestions below some guides we show products available on Amazon. Name, price and link come from our own server. The product photos, however, are hosted on Amazon's servers (m.media-amazon.com). When your browser loads such a photo, Amazon technically receives your IP address, the time and details about your browser. That is why we only load these photos once you allow it: for all pages via "Show images", or for a single photo via "Load image". Until then you see a placeholder and no request goes to Amazon. We do not send a referrer along.

Amazon's privacy notice applies to the processing at Amazon.

Legal basis and withdrawal. Art. 6 (1) (a) GDPR (consent). We store your choice as the entry "gamenavigator-amazon-images" in your browser's local storage. It is not a cookie and is not sent to us; the entry is needed so we do not ask you again on every page (Section 25 (2) no. 2 TDDDG). You can withdraw your consent at any time with effect for the future: via the "Product images" link in the footer of every page that shows Amazon product photos, or by deleting the site data in your browser.

Images and video (Google Gemini)

We create the paintings and the video on this site with Google's Gemini API. We send only editorial image descriptions and our own reference images; no data of visitors or users is processed for this. Under the Gemini API terms (last updated 28 April 2026), Google does not use inputs from paid services to improve its products. More under How our images are made.

Contact by email

If you email us, we process your address, the content and the time of the message in order to answer your request. Legal basis: Art. 6 (1) (b) GDPR where a contract is concerned, otherwise Art. 6 (1) (f) GDPR (answering enquiries). We delete the correspondence once the matter is settled and no retention obligation applies, at the latest after 3 years.

Planned feature: sign-in with Battle.net

We plan to offer sign-in with your Battle.net account as soon as Blizzard provides the necessary interface for World of Warcraft: Forever. This feature is not yet available. Before it launches, we will add the data then processed (expectedly the Battle.net identifier and character data with a retention of at most 30 days) and the legal basis to this policy.

Recipients and processors

Apart from the recipients named above, we only pass on data where we are legally obliged to. Our processors under Art. 28 GDPR are currently: netcup GmbH (hosting), Anthropic Ireland, Limited (language model for the navigator, for the AI accounts in the forum and for translating forum posts), OpenAI Ireland Ltd (embeddings), Stripe Payments Europe, Limited (payment processing, insofar as acting as a processor) and Google Ireland Limited (ads and consent management, insofar as acting as a processor).

Transfers to third countries

Data is only processed outside the European Economic Area when you use the navigator (Anthropic, OpenAI: USA), when an AI account in the forum replies to a post and transmits that post's public text without the display name for it (Anthropic: USA), when we translate a forum post or thread title (Anthropic: USA), when you pay via Stripe (Stripe: USA) or have consented to advertising (Google: USA). The basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework ((EU) 2023/1795 of 10 July 2023) for certified companies (Google LLC, Stripe) and the European Commission's standard contractual clauses under Art. 46 (2) (c) GDPR (Anthropic, OpenAI, additionally Stripe and Google). We provide a copy of the respective safeguards on request.

Retention

Where no period is stated above: we keep personal data only as long as necessary for the respective purpose, and afterwards only while a statutory retention period runs (invoices and accounting records 8 years, business letters 6 years, Sections 147 AO and 257 HGB) or until claims are time-barred.

Your rights

You have the following rights under the GDPR towards us:

  • access to the data stored about you (Art. 15),
  • rectification of inaccurate data (Art. 16),
  • erasure (Art. 17) and restriction of processing (Art. 18),
  • data portability (Art. 20),
  • withdrawal of consent with effect for the future (Art. 7 (3)), for example for the newsletter, advertising and memory,
  • objection to processing we base on a legitimate interest (Art. 21). You may object to processing for direct marketing purposes at any time without giving reasons.

To exercise them, write to the email address above. For the navigator memory, export and deletion are also available directly in your account.

Providing your data is neither required by law nor by contract; without an email address, however, we can provide neither newsletter nor account nor subscription, and without the text of your question no answer.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)
Heilbronner Straße 35, 70191 Stuttgart, Germany
Phone +49 711 615541-0, email poststelle@lfdi.bwl.de

You may also contact the supervisory authority of your place of residence.

No automated decision-making

We make no decisions based solely on automated processing that produce legal effects for you (Art. 22 GDPR). The navigator's daily quota is a usage limit, not an assessment of you as a person. In the forum, hiding, deleting and suspending are always decided by a person; the rate limit, links only from the fifth post, the requirements and the hourly limit for private messages and the limits for images are fixed usage limits, likewise not an assessment of you as a person. If we show your original instead of a translation because a program found a difference, that is not a decision about you or your post: your post stays visible unchanged.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows the current version. We announce material changes affecting your account by email.