Privacy Policy

1. Controller

The controller responsible for personal data processed on this website within the meaning of Art. 4 No. 7 GDPR is:

ODY Technologies e.U.

Full legal disclosure: Imprint.

2. Scope

This policy applies to galaxy-online.com. The website is a pre-launch teaser for the game Galaxy Online — A New Beginning. We do not run user accounts, a forum, comments, or analytics on this site. The only personal data we actively process is the email address you submit to the roster signup form, plus the technical request data automatically generated by visiting any website on the public internet.

3. Roster Signup (Email)

What we collect. When you submit your email through the roster form, we store your email address and the timestamp of submission. We do not collect a name, phone number, address, or any other field — the form has one input.

Purpose. To send you development updates and a one-time invitation when the alpha opens.

Legal basis. Your explicit consent under Art. 6 (1) (a) GDPR, given by submitting the form. You may withdraw this consent at any time.

Processor. Email collection and delivery are handled by Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). Brevo processes your email under a data processing agreement (Art. 28 GDPR). Brevo's privacy policy: brevo.com/legal/privacypolicy.

Retention. Until you unsubscribe, or until 30 days after the public launch of the game — whichever comes first. After that the address is deleted from Brevo and from any backups within a reasonable rolling window.

How to unsubscribe. Every email we send contains an unsubscribe link. You can also email contact@galaxy-online.com at any time and we will remove your address.

4. Hosting & Server Logs

This website is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you load any page, Cloudflare's edge servers automatically receive standard web request data:

• your IP address (used to route the response and detect abuse);
• the URL you requested and the HTTP referrer (if any);
• your browser's User-Agent string;
• the date and time of the request.

Purpose. To deliver the website, protect against DDoS and abuse, and maintain technical operations.

Legal basis. Legitimate interest in operating a secure and reliable website (Art. 6 (1) (f) GDPR).

Retention. Cloudflare typically retains edge access logs for a short rolling window (days, not months) for security and operational purposes. See Cloudflare's privacy policy for the current schedule.

International transfer. Cloudflare is a US-based provider with servers worldwide, including in the EU. Transfers to the United States are covered by the EU-U.S. Data Privacy Framework (Cloudflare is certified) and supplementary Standard Contractual Clauses where applicable.

5. Cookies & Tracking

This website does not set any tracking cookies, analytics cookies, or third-party advertising pixels. We use one harmless preference value in your browser's localStorage — galaxyLang — to remember whether you chose the EN or DE locale, so the language toggle persists across page loads. This value never leaves your browser.

6. Your Rights

Under the GDPR you have the following rights regarding your personal data:

• Right of access (Art. 15) — confirmation of whether we process your data and a copy of it.
• Right to rectification (Art. 16) — correction of inaccurate data.
• Right to erasure (Art. 17) — deletion of your data, also known as the "right to be forgotten".
• Right to restriction (Art. 18) — pause processing in disputed cases.
• Right to data portability (Art. 20) — receive your data in a machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7 (3)) — without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email contact@galaxy-online.com. We will respond within one month.

7. Right to Lodge a Complaint

If you believe our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. The competent authority for us is the Austrian Data Protection Authority (Datenschutzbehörde):

Österreichische Datenschutzbehörde

8. Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

9. Children

This website and the future game are intended for users aged 16 and over. If you are under 16 you may not submit your email to the roster signup. If we become aware that we have collected data from a child without parental consent we will delete it.

10. Changes to This Policy

We may update this policy as the game evolves and new processing flows come online (game client, account system, payments, in-game chat, etc.). Material changes will be announced on the website and — for roster signups — by email before they take effect.