Who is responsible
schottentotten.com is a free, unofficial fan site for Reiner Knizia's game, run by Robin Clerc, an individual based in France, who is the data controller.
For any question or request about your data, write to contact@schottentotten.com
What we collect
Playing solo, hotseat or the tutorial needs no account: those games stay in your browser. With an account, we collect:
- Your email address, to send your sign-in links (there are no passwords) and, only if you opt in, the weekly digest and move or tournament notifications.
- Your display name and user ID, shown on your profile, the leaderboard, games and tournaments.
- What you write: game and tournament chat, team names, study notes and the reports you send.
- Your games: moves, results, ratings, puzzles and trophies, used to run matches, replays and rankings and to suggest games and puzzles that fit your level.
- Usage events: which screens and features are used, recorded on our own server under a salted hash rather than an identifier, to decide what to improve.
- Technical data: your browser's user agent, to label your signed-in devices, and your timezone, so notifications arrive at a sensible hour.
Your preferences (language, theme, sound) stay in your browser's local storage and are never sent to us. Signing in sets one strictly necessary session cookie. There is no advertising and no third-party tracker, we do not sell data, and we do not track you across other apps or websites.
Who processes it
- netcup GmbH (Karlsruhe, Germany) hosts the servers and the database.
- Amazon Web Services (AWS EMEA SARL, Ireland region) sends our emails (Amazon SES), receives the mail sent to the contact address and stores our encrypted backups (Amazon S3).
- If you turn notifications on, your browser's push service, or Apple's push notification service in the iOS app, delivers them.
All of this data is stored in the European Union.
How long we keep it
- Account data: as long as your account exists.
- Backups: 14 days for the database; up to 6 months for files (hourly, daily, weekly and monthly copies). They are encrypted, only the operator can restore them, and a restore re-applies every deletion.
- Mail sent to the contact address: 12 months.
- When the site moved to its current host on 14 October 2026, one encrypted archive of the previous server was kept; it is deleted within 12 months.
Deleting your account
From Account settings you can delete your account at any time. We anonymise it at once: your email address is replaced by an address that cannot receive mail, your display name becomes «Deleted player», your preferences are cleared and every session and API token is revoked. Your chat messages and past games stay, shown under «Deleted player». The display name stored inside past game records is not rewritten.
Your rights
You can access, correct, export, delete or object to the processing of your data. «Export my data» in Account settings downloads your profile, ratings, trophies and puzzle history as JSON. Every digest email has an unsubscribe link. For anything else, write to the contact address. You can also complain to the French data protection authority, the CNIL (cnil.fr).
Shared replays
You can revoke a replay you shared at any time. The server refuses the revoked link immediately, on every request.