Privacy Policy

The party responsible for data processing on this platform within the meaning of the General Data Protection Regulation (GDPR) is:

Nadine und Florian Munzert
Im Ziegelfeld 22
27432 Bremervörde OT Bevern
Germany

Email: info@munlabs.de
Web: www.munlabs.de

TravTools is published under the unregistered “MUNLabs” label, under which we release our private hobby projects. We have not appointed a data protection officer, as we are not legally required to do so. For any privacy-related questions, please contact us at the email address above.

TravTools is an unofficial organisation and planning tool for alliances of the browser game Travian. It helps alliances coordinate defence calls, plan operations and artefact runs, maintain player and troop overviews, evaluate reports and communicate internally.

To use these features you create a user account and link your player to an alliance on a game world. The data processed is entered by you or imported from the game. TravTools is not affiliated with Travian Games GmbH.

We only process personal data insofar as this is necessary to provide a functional platform and our content and services. The relevant legal bases are in particular:

• Art. 6(1)(b) GDPR – to perform the usage relationship (providing the account and tool functions).
• Art. 6(1)(f) GDPR – to safeguard our legitimate interests, especially in secure, stable and abuse-free operation.
• Art. 6(1)(a) GDPR – based on your consent, e.g. for optional features such as the newsletter, Discord integration or automatic translation.
• Art. 6(1)(c) GDPR – to comply with legal obligations.

You may withdraw any consent given at any time with effect for the future.

On your first visit – and again every 30 days – we show you a consent notice (“consent banner”). Only once you agree is signing in or registering possible. For the services we use, we are legally required to obtain and document your consent.

For documentation, we store for each consent: a random identifier (token), the version of the text, the language, the time, and a shortened, non-reversible checksum of your browser identifier (user agent). No IP address is stored in the process. If you subsequently sign in or register, we link the consent to your account so it remains traceable who consented and when.

The consent is remembered via a technically necessary cookie (tt_consent, 30 days); after it expires, we ask again. You can withdraw your consent at any time with effect for the future by writing to us at info@munlabs.de – the lawfulness of processing carried out until then remains unaffected. The legal basis is Art. 6(1)(a) GDPR (consent) and our legitimate interest in documentation (Art. 6(1)(f) GDPR).

TravTools runs on a dedicated server operated by COLOREA Nadine und Florian Munzert GbR (Im Ziegelfeld 22, 27432 Bremervörde OT Bevern, www.colorea.de). The technical infrastructure (data centre) is provided by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (all-inkl.com).

All servers are located exclusively in Germany. No transfer of your data to a third country takes place as part of the hosting.

When you access the site, the server automatically records technical access data (server log files): including the IP address, date and time of access, the file requested, the browser used and the operating system. This data is technically required to deliver the site, ensure its stability and security and to fend off attacks. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

The data processing agreements required under data protection law (Art. 28 GDPR) are in place with ALL-INKL and within COLOREA GbR. Further information can be found in ALL-INKL’s privacy policy: all-inkl.com/datenschutzinformationen.

To use TravTools you create a user account. In doing so we process:

• Display name (freely chosen, need not be your in-game name),
• Email address (for login, account confirmation and important system messages),
• Password – stored exclusively as a non-reversible cryptographic hash; we never know your plain-text password,
• Language setting and timestamps for registration, confirmation and last login,
• optionally a newsletter consent.

The legal basis is Art. 6(1)(b) GDPR (usage relationship). These details are required for the account; without them registration is not possible.

Minimum age: Use of TravTools is only permitted from the age of 16. By registering you confirm that you are at least 16 years old. In addition, you must expressly acknowledge this privacy policy during registration via a mandatory checkbox.

After registration we send you an email with a confirmation link (double opt-in) to make sure the address you provided actually belongs to you.

If you do not confirm your email address, the system proceeds automatically as follows:

• About one week after registration you receive a reminder email with a new confirmation code and a note that the account will otherwise be deleted.
• If confirmation is still not provided, the unconfirmed account is automatically and completely deleted about 37 days after registration (7 days until the reminder plus a 30-day grace period).

Confirmed accounts remain permanently until you delete them yourself or we remove them at your request or for good cause (e.g. abuse). The legal basis for the confirmation and the automatic clean-up is our legitimate interest in a clean, secure data set (Art. 6(1)(f) GDPR) and Art. 6(1)(b) GDPR.

The actual purpose of TravTools is to organise your alliance. For this you process game-related data – mostly entered by you or imported from the game – in particular:

• your player name and your membership in an alliance and game world,
• villages (names and coordinates), troop and defence data,
• reports, targets, artefacts, operation plans, defence calls, wonder-of-the-world data and similar tactical information,
• notes, statistics, online times and internal communication (e.g. alliance messages, group and VIP chat).

This data is used solely to coordinate within your alliance. The legal basis is Art. 6(1)(b) and (f) GDPR. Please only enter data you are authorised to process, and note that information entered within your alliance may be visible to authorised members of your alliance.

TravTools is built so that the data of different alliances is strictly separated. An alliance generally only sees its own data; access across alliance boundaries is technically prevented.

The only exception is explicitly established confederations (BNDs): if two alliances agree on a confederation and set it up in TravTools, selected data (e.g. defence calls) can be shared with the partner alliance to the agreed extent. This sharing is deliberately enabled by the alliance leadership and can be revoked. Without such a confederation, no data is exchanged between alliances.

TravTools works with very few, exclusively technically necessary cookies. We do not use any tracking, analytics or advertising cookies.

• Session cookie (PHPSESSID): keeps you logged in during your visit. It is strictly required for operation and expires when the session ends.
• tt_lang: stores your chosen language so the interface appears in that language.
• tt_consent: remembers the consent you gave (30 days) – see the “Consent & Consent Banner” section.
• tt_remember: only if you choose “Stay signed in” – keeps you securely signed in for up to 30 days. A random, hashed token is stored, never your password; it is deleted when you sign out.

In addition, we store some pure display settings in your browser’s local storage (localStorage), e.g. whether the sidebar is expanded or collapsed and which views you prefer. This information remains solely on your device and is not transmitted to us. The legal basis for the necessary cookies is § 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.

To protect against abuse and to keep security-relevant events traceable, we maintain an event log. For certain actions (e.g. logins, account changes, security-relevant events) we store the time, the type of event, your user account and the IP address used at the time.

You can view your own event log in your account. For administration and security purposes it is also visible to authorised superusers. The legal basis is our legitimate interest in security and abuse prevention (Art. 6(1)(f) GDPR).

For reasons of data minimisation, we store only the last 30 events per account. As soon as a new entry is added, the oldest one is deleted automatically. The log is removed completely at the latest when your account is deleted.

To protect your account and the platform from automated attacks, we monitor failed login attempts. If too many wrong passwords are entered from one IP address within a short time window (default: 10 attempts), that IP address is automatically blocked. In addition, known attacker IPs can be blocked manually.

For this purpose we store – exclusively for security purposes – failed login attempts with IP address and time, as well as blocked IP addresses with reason and time. This data serves solely to prevent abuse and attacks and is cleaned up regularly. The legal basis is our legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR). Further technical safeguards are described in the “Data Security” section.

We send emails exclusively for functional purposes, in particular the confirmation email upon registration, password-reset emails, important system messages and – only with corresponding consent – occasional news (newsletter).

Delivery takes place via our own SMTP server at our host; no external newsletter or marketing provider is used. In doing so we process your email address and the respective message content. The legal basis is Art. 6(1)(b) GDPR or – for the newsletter – your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time.

TravTools offers the option to have certain texts (e.g. alliance messages) translated automatically. If this feature is used, we transmit the text to be translated together with the language pair to a translation service:

• DeepL – DeepL SE, Maximilianstraße 6, 50668 Cologne, Germany (if a DeepL key is configured), or
• MyMemory – Translated S.r.l., Rome, Italy (freely usable default service without a key).

Both providers are based in the European Union. Only the text content to be translated is transmitted, no account data. Please do not submit any sensitive personal data via the translation feature. The legal basis is our or your legitimate interest in comprehensible, cross-language collaboration (Art. 6(1)(f) GDPR). Use of the translation feature is voluntary.

Alliances can optionally set up an integration with Discord. If the alliance leadership stores and activates a Discord webhook address, TravTools transmits selected content (e.g. defence calls, operation plans, messages) to the relevant Discord channel. This content may contain player names, coordinates and time details.

In this case the recipient is Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA. As Discord is a US provider, this may involve a transfer to the USA (see “Transfers to Third Countries”). Setup is entirely voluntary and carried out by the alliance leadership; without an activated webhook, no data is transmitted to Discord. The legal basis is Art. 6(1)(f) GDPR or the consent of those involved (Art. 6(1)(a) GDPR). Discord’s own privacy policy applies in addition.

If an alliance stores a WhatsApp link, only a clickable reference (click-to-chat link) is displayed at the relevant place. TravTools itself transmits no data to WhatsApp. Only when you actively click such a link does WhatsApp open, and the privacy policy of the respective provider applies. Clicking is voluntary.

TravTools is free of charge. Anyone who would like to support the project voluntarily can donate via PayPal. When you click the donation button, you are redirected to PayPal; the entire payment processing takes place there.

The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. You enter your payment and account details (e.g. credit card or bank details) exclusively at PayPal; we do not receive this data and never see it. PayPal’s privacy policy applies. The donation is entirely voluntary; the legal basis is the initiation of a contract or your legitimate interest in supporting the project (Art. 6(1)(b) and (f) GDPR).

It is important to us to include as few external services as possible. The font used (Inter) and the icons (Font Awesome) are stored entirely on our own server and loaded from there.

We do not embed Google Fonts, any content delivery networks (CDNs) or any other external font or icon services. As a result, no connection to Google, Cloudflare or any other third party is established when you access the site, and no related data (in particular no IP address) is transmitted to such providers. All display elements come from the same server in Germany that also delivers the application.

We would like to state this expressly: TravTools does not track you.

• We use no analytics or tracking tools (such as Google Analytics).
• We display no advertising and do not pass on your data for advertising purposes.
• There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.
• We do not sell your data and do not pass it on to third parties, except as described in this policy.

To improve TravTools, we keep anonymous usage statistics. We count page views and record for each view the time, the page visited, the rough device type, as well as the browser and operating system (each only as a category, e.g. “Chrome” / “Windows”). For the origin, we determine only the country code from the IP address – locally on our server via an offline database; the IP address itself is not stored.

No IP addresses, no names and no advertising cookies are stored. Sessions are counted only via a daily-rotating, non-reversible token that does not allow any conclusion about a person. As no personal data is processed here, these statistics are unproblematic under data protection law; they are based on our legitimate interest in measuring reach and improving the service (Art. 6(1)(f) GDPR). For country assignment we use offline data from DB-IP (licence CC-BY-4.0).

Your data is treated confidentially. It is only disclosed insofar as necessary for operation, and is limited to the following categories of recipients:

• Hosting/infrastructure: COLOREA GbR and ALL-INKL.COM (server operation in Germany) – with a data processing agreement under Art. 28 GDPR.
• Translation (only when used): DeepL (Germany) or MyMemory/Translated (Italy).
• Discord (only when integration is active): Discord Inc. (USA).
• Payment processing (only when donating): PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg).

Within your alliance, the data you enter there is visible to authorised members (see “Alliance Separation & Confederations”). No disclosure to third parties beyond this takes place.

The core data processing of TravTools (hosting, fonts, icons, email delivery) takes place exclusively within the European Union. The translation services used are also based in the EU.

A transfer to a third country outside the EU/EEA is only possible for the expressly optional features:

• with an activated Discord integration (USA) and
• with a PayPal donation, insofar as PayPal transfers data to third countries.

These providers base such transfers on appropriate safeguards within the meaning of Art. 44 et seq. GDPR, in particular the EU Commission’s Standard Contractual Clauses or – in the case of the USA – the EU-US Data Privacy Framework, insofar as the respective provider is certified. If you do not use these optional features, no third-country transfer takes place.

We only store personal data for as long as is necessary for the respective purpose:

• Account and game-related data: for the duration of your account use, at most until the account is deleted.
• Unconfirmed accounts: automatic deletion about 37 days after registration (see section 6).
• Server log files: retained only briefly for security purposes and then deleted or anonymised.
• Event log: only the last 30 events are stored per account; older ones are deleted automatically and the log is removed completely at the latest when the account is deleted.
• Imported daily statistics: automatically deleted after about 60 days.

You can irrevocably delete your account yourself at any time via “My Account → Delete Account”. This removes your account, your login data and your personal log and usage data. Contributions you have made to the alliance within a world – such as reported Deffcall shipments or imported reports – are retained for the alliance for reasons of data completeness; they are then no longer linked to your deleted account. Statutory retention obligations remain unaffected.

As a data subject, you have extensive rights under the GDPR:

• Access to the data stored about you (Art. 15 GDPR),
• Rectification of inaccurate data (Art. 16 GDPR),
• Erasure of your data (Art. 17 GDPR),
• Restriction of processing (Art. 18 GDPR),
• Data portability (Art. 20 GDPR),
• Objection to processing based on a legitimate interest (Art. 21 GDPR),
• Withdrawal of a given consent with effect for the future (Art. 7(3) GDPR).

To exercise your rights, an informal message to info@munlabs.de is sufficient. Many matters can also be handled directly in the tool (e.g. changing data or deleting the account).

Access directly in the tool: You can exercise your right of access under Art. 15 GDPR yourself at any time. In your event log, click “Request access”. We review the request and then provide you with a complete PDF access report covering all data stored about your account (master data, consents, logins, messages, tickets and much more) for download directly in the event log. While a request is being processed, no further request can be made.

Irrespective of this, you have the right to complain to a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR). The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover, Germany
lfd.niedersachsen.de

You may also contact the supervisory authority of your habitual residence.

We take appropriate technical and organisational measures to protect your data:

• Transmission is encrypted via HTTPS/TLS.
• Passwords are stored exclusively as a secure, non-reversible hash.
• Access to data is secured by login, rights and role concepts and by the strict separation of alliances.
• Forms are protected against cross-site request forgery (CSRF).

Please note that, despite all care, data transmission over the internet can never be protected with absolute security against access by third parties. Therefore choose a strong, unique password and do not share your login details.

We adapt this privacy policy as soon as the legal situation or our features change and this makes an adjustment necessary. The current version published on this page always applies. You can find the status of the current version above under “Last updated”.

For questions, concerns or to exercise your rights, you can reach us at any time at:

Nadine und Florian Munzert
Email: info@munlabs.de
Web: www.munlabs.de

Further details can be found in our Legal Notice.