Privacy Policy

1. Who is responsible?

The controller for the personal data handled by Winnetrie.be is Timmy Verrept. Privacy requests can be sent to contact@winnetrie.be.

Country: Belgium.

Where applicable, the operator's registered-business particulars are published in the Terms of Use.

2. What information is processed?

Accounts and profiles: username, email address, password hash (not your plaintext password), account status, role/rank, email verification status, and any optional display name or biography you provide.

Community activity: posts, chat messages, topics, authorship, timestamps, and moderation information. Public posts can be visible to other visitors.

Games: game scores, progress, achievements, player identifiers and competitive match statistics, where the relevant game provides online features. Some games also store progress locally in your browser.

Security and account recovery: session identifiers; limited security and rate-limiting records (which may include hashed IP or email identifiers); email-change, verification and password-reset token hashes; and administrator actions or moderation logs. A reset link is valid for 30 minutes, and a registration verification link for 24 hours.

Live website presence: while a site tab is visible, the website sends a short heartbeat approximately every 25 seconds. The presence database stores a temporary random session token, the associated account ID if signed in, and the last activity time. It does not store IP addresses, page URLs, or browser fingerprints for this feature. Visitors see aggregate counts of active browsing sessions and unique signed-in accounts. Administrators can view the usernames of currently active registered accounts in User Management. Sessions are considered online for 90 seconds after the last heartbeat; presence records older than one day are periodically purged. This functionality is separate from optional historical visitor analytics.

Anonymous activity statistics: the live presence heartbeat also contributes aggregate hourly counts of newly active browser sessions, guest and signed-in visits, estimated active browsing time and the highest observed number of concurrent connections. Those historical hourly statistics do not contain session tokens, account IDs, usernames, IP addresses, page URLs or browsing histories. Aggregated records are retained to provide historical trends and an all-time concurrency record. A visit means an active browser session, not necessarily a unique person; session activity times are estimates.

Optional detailed visitor analytics: only after you choose to allow analytics, the site's separate visitor logger can record requested page URLs, visit/session token, IP address, browser user agent, account identifier or username (when signed in), page views, and visit timing. Independently, the web server may produce technical access and error logs.

IoT features: device names and identifiers, sensor readings, device status and, where enabled, camera images or location data. The website applies device-level visibility rules. Do not upload or share other people's personal information through a device without a lawful basis.

Support and payments: where a bank-transfer donation or paid supporter-rank application is enabled, the site may record your account, selected amount or rank, payment reference, request status and administrator confirmation. The operator does not automatically verify your bank transfer; any PayPal.Me link takes you to PayPal's own site.

3. Why and on what legal basis?

Accounts, game features and requested community services are generally operated to provide the functionality you requested (Article 6(1)(b) GDPR, where applicable). Website security, fraud prevention, rate limits and moderation rely, as appropriate, on the operator's legitimate interests (Article 6(1)(f)), subject to your rights and the balancing test.

The minimal live-presence indication and anonymous statistics are operated for community awareness and site administration, under the operator's legitimate interests (Article 6(1)(f)), subject to applicable ePrivacy rules and a balancing assessment. Detailed visitor analytics rely on your consent (Article 6(1)(a)). You can refuse or withdraw this permission using Cookie Preferences in the footer. Bank transfers, supporter-rank orders and legal accounting obligations are handled, where relevant, for contractual and legal compliance purposes (Article 6(1)(b) and (c)).

4. Providers and recipients

Site and database hosting: STRATO. Email delivery provider: STRATO. Necessary technical providers may process data on the operator's instructions under appropriate agreements; actual contracts, locations and any transfers outside the EEA must be verified by the operator.

Content you publish in the forum or chat may be seen by other visitors. A link to an external provider (such as PayPal, YouTube or GitHub) takes you to a separate service with its own privacy practices.

5. Retention and safeguards

Account information is retained while the account is active. How long selected information remains after account deletion: Known account/profile records are removed on confirmed account deletion. Limited moderation and deletion-audit records may remain while needed; no general automatic expiry is configured..

• Live presence: temporary session tokens and last-seen timestamps older than one day are periodically removed; online counts use only the last 90 seconds.
• Optional visit analytics: 30 days for consent-based detailed visitor logs; expired data is removed in batches when site traffic triggers housekeeping..
• Security, moderation and rate-limit records: 30 days for failed-login rate-limit records. Other moderation and incident records are retained while needed; their exact expiry policy still requires review..
• Payment and support records: Where statutory Belgian accounting or tax duties apply, normally 7 years for relevant documents (longer where legally required). There is no automatic purge of payment records..

The optional detailed-log cleanup runs in bounded batches when website traffic triggers maintenance; on a low-traffic site, expired records may remain until maintenance next runs. The anonymous aggregate visitor statistics do not contain session or account identifiers and are retained for historical comparisons. Access restrictions, password hashing and server-side authorization are used, but no online service can guarantee absolute security.

6. Your rights

Depending on your situation and the applicable law, you can request access, correction, deletion, restriction, data portability or objection. Where processing is based on consent, you may withdraw consent without affecting earlier lawful processing. Contact contact@winnetrie.be and include enough information to help us verify that the data is yours, without sending your password.

You may also complain to the Belgian Data Protection Authority.

7. Cookies and device storage

Our login/session cookies, preference cookie, optional analytics and browser-game storage are explained in the Cookies & Storage Policy. Live presence uses the existing session cookie and does not introduce an additional tracking cookie.

8. Changes

This notice will be updated when services, data categories, providers or retention arrangements change. Material changes should be communicated to affected users when required.