Privacy Policy
What personal data we collect, why, and what your rights are.
Effective date: 18 October 2026
This policy explains what personal data we collect when you use sori-resitve.si, your account with us, and our software and games ("our products"), why we collect it, how long we keep it, and what rights you have. If a product collects anything beyond what is described here, we will tell you in this policy before it does.
We collect as little as we can. We do not sell your data, we do not use it for advertising, and we do not use analytics or tracking.
Who we are
The controller of your personal data is:
Šori rešitve, Daniel Arthur Hawton, s.p. Slovenska cesta 56, 1000 Ljubljana, Slovenia Registration number: 7543727000 · Tax number: 28722795 Email: daniel@sori-resitve.si · Phone: +386 70 633 552
We are a one-person business. We have not appointed a data protection officer, because the law does not require one for a business of our size and type. Send every privacy question to the email address above.
What we collect, and why
Your account
You log in to our products with your Discord account. We ask Discord only for
your basic profile (the identify permission). We do not get your email
address, your Discord friends, your servers or your messages.
From Discord we store:
- your Discord user ID,
- your Discord username and display name,
- your Discord avatar (we store a reference to it; the picture stays on Discord).
We also store when your account was created and when you last logged in, and whether you have an admin role.
Why: to create your account, to log you in, and to show your name and avatar to other users. Legal basis: performance of a contract (GDPR Article 6(1)(b)), because you cannot use online features without an account.
Login sessions
When you log in, we keep a session so that you stay logged in:
- On the website: a session record with your IP address and browser name (user agent). It is deleted 2 hours after your last visit. If you log in, a "remember me" cookie keeps you logged in for up to 400 days, or until you log out.
- In a product: a login session with a code that lets the product stay logged in, plus your IP address and the product's user agent. We store the code only in scrambled (hashed) form. The product stores it on your device.
Why: to keep you logged in and to stop someone else from using your account. Legal basis: performance of a contract (Article 6(1)(b)) and our legitimate interest in keeping accounts secure (Article 6(1)(f)).
Using online features
When you use a product's online features, its server stores:
- your user profile in that product (the account details above, linked to your account),
- records of your activity that the product needs to work, for example the start and end of a game, who took part (by user ID), and the result.
Other users of the same product can see your display name and avatar, that you are online, and what you do together with them, for example your moves in a game.
Why: to run the product, to show results, and to deal with cheating and abuse. Legal basis: performance of a contract (Article 6(1)(b)) and our legitimate interest in fair use (Article 6(1)(f)).
Bans
If you break the Terms of Service, we can ban you from one product or from all of them. We store the ban, the reason, when it ends, and which admin made it. When a ban starts, we tell the product's server, so that it can end your current session.
Why: to keep our products fair and safe for other users. Legal basis: our legitimate interest (Article 6(1)(f)).
Server logs
Like almost every website, our servers record each request: your IP address, the date and time, the page or file requested, the result, the referring page and your browser or product user agent. Product servers also record when a user connects and disconnects, with their IP address and user ID, and important events.
Our products may check for updates when they start. These requests are logged in the same way.
Why: to keep our services running, to find faults, and to protect them against attacks and abuse. Legal basis: our legitimate interest (Article 6(1)(f)).
When you contact us
If you send us an email, we use your email address and your message to answer you. Legal basis: our legitimate interest in answering you (Article 6(1)(f)), or steps before a contract (Article 6(1)(b)) if you ask about a product.
Cookies and storage on your device
We use only what the site needs to work. We do not use advertising, analytics or tracking cookies, so we do not ask for cookie consent.
| Name | What it does | How long |
|---|---|---|
sori-resitve-session |
Keeps your session while you use the site | 2 hours after your last visit |
XSRF-TOKEN |
Protects forms against forgery | 2 hours |
remember_web_… |
Keeps you logged in, if you log in | Up to 400 days, or until you log out |
theme (browser storage) |
Remembers light or dark mode, if you choose one | Until you clear it |
Our products store their settings and your login code on your device. Log out or uninstall the product to remove the login code.
Where we store your data
We keep the personal data that we hold in the European Union, except for emails (see below).
| Data | Where it is stored | Provider |
|---|---|---|
| Accounts, user profiles, login sessions, activity records and bans | Our database servers in Nuremberg and Falkenstein, Germany | Hetzner |
| Server logs | Our servers in Nuremberg and Falkenstein, Germany | Hetzner |
| Database backups (encrypted) | Cloudflare R2 storage, limited to data centers in the EU | Cloudflare |
| Emails you send us, and our answers | Our mail server in Ashburn, Virginia, USA | MXroute |
Your Discord profile and avatar picture stay on Discord's servers. Discord decides where it stores them.
Cloudflare handles each request in the Cloudflare data center nearest to you, which can be outside the EU. Cloudflare does not keep the content of the request there.
Who we share data with
We do not sell or rent your personal data. We share it only with these service providers, and only as far as they need it to provide their service:
- Hetzner Online GmbH (Germany) hosts our servers and databases in its data centers in Nuremberg and Falkenstein, Germany.
- Cloudflare, Inc. (USA) sits in front of our website and servers. It protects them against attacks and delivers pages faster. All traffic, including your IP address, passes through Cloudflare. Cloudflare also stores our encrypted database backups, in the EU only (Cloudflare R2).
- MXroute (USA) hosts our email. If you email us, your email address and your message are stored on its server in the USA.
- Discord Inc. (USA) handles the login. When you log in, you share your basic profile with us through Discord. When the website or a product shows your avatar, your device loads the picture from Discord's servers. Discord is responsible for its own processing under the Discord Privacy Policy.
Other users see your display name and avatar, as described above.
We may also give data to authorities when the law requires it.
Transfers outside the EU
Cloudflare, Discord and MXroute are based in the USA. Where personal data goes to the USA, the transfer is protected by the EU-U.S. Data Privacy Framework (where the company is certified) or by the European Commission's standard contractual clauses (GDPR Articles 45 and 46).
How long we keep data
| Data | How long |
|---|---|
| Account and user profiles | Until you ask us to delete your account |
| Activity records (for example game results) | Until you ask us to delete your account |
| Website session | 2 hours after your last visit |
| Product login session | Until you log out, or 30 days after it was last used |
| Server logs | 14 days (web server), 30 days (product servers) |
| Database backups | Up to 3 years, or longer where the law requires it (for example, Slovenian accounting law requires us to keep invoices for 10 years). Deleted data leaves the backups when they expire |
| Bans | For as long as the account exists, so that a lifted ban is still on record |
| Emails | As long as we need them to deal with your question, then up to 2 years |
When you ask us to delete your account, we delete your account, your user profiles and your login sessions. Copies in our backups are deleted when those backups expire. We replace your user ID in old activity records so that they no longer point to you. If you were banned, we may keep a minimal record (your Discord user ID and the ban) for up to 2 years, so that a banned user cannot simply return. We do this in our legitimate interest in protecting other users.
Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it,
- correct data that is wrong,
- delete your data ("right to be forgotten"),
- restrict how we use your data,
- data portability: get your data in a machine-readable format,
- object to processing that we base on our legitimate interest,
- complain to a supervisory authority.
To use a right, email daniel@sori-resitve.si. We may ask you to prove that the account is yours, for example by sending us a message from your Discord account. We answer within one month. Using your rights is free.
The supervisory authority in Slovenia is the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si. You can also complain to the authority in the EU country where you live or work.
We do not make decisions about you based only on automated processing that have legal or similarly important effects (GDPR Article 22). Bans are always made by a person.
California residents
This section is for residents of California, USA, under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), the California Online Privacy Protection Act ("CalOPPA") and California's "Shine the Light" law.
Categories we collected in the last 12 months:
- Identifiers: Discord user ID, username, display name, avatar, IP address, account ID.
- Internet or network activity: server logs, login sessions, activity records.
We collected them from you, your device and Discord, for the purposes described in "What we collect, and why". We disclosed them for business purposes only to the service providers listed in "Who we share data with". We keep each category for the periods in "How long we keep data".
We do not collect sensitive personal information, other than account login data that we use only to log you in.
We do not sell or share your personal information, as "sell" and "share" are defined in the CCPA. We do not use it for cross-context behavioral advertising. We have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16.
Your rights. You have the right to:
- know what personal information we collected about you, where it came from, why we collected it and who we disclosed it to,
- get a copy of it,
- delete it,
- correct it,
- opt out of sale or sharing (we do neither),
- limit the use of sensitive personal information (we use it only to log you in),
- not be discriminated against for using these rights.
To make a request, email daniel@sori-resitve.si. We will confirm we received it within 10 business days and answer within 45 days. We verify the request by checking that you control the account, for example through a message from your Discord account. You can use an authorized agent; we may ask for proof of the agent's authority and verify your identity directly.
Do Not Track and Global Privacy Control. We do not track you across websites, so there is nothing for these signals to switch off. We treat a Global Privacy Control signal as a valid request to opt out of sale or sharing.
Shine the Light. We do not disclose personal information to third parties for their direct marketing.
Children
Our products are not for children under 13, and you need a Discord account, which also requires you to be at least 13 (or older, where your country's law says so). We do not knowingly collect personal data from children under 13. If you think a child under 13 has an account, contact us and we will delete it.
Security
We protect your data with encrypted connections (HTTPS), hashed login codes, short-lived signed access tokens, and restricted server access. No system is perfectly secure. If a data breach is likely to put your rights at risk, we will tell you and the supervisory authority as the law requires.
Changes to this policy
When we change this policy, we update the effective date at the top. If a change is important, we will tell you on the website or in our products before it takes effect.