Processing of personal data
Privacy policy
This policy describes what the application processes and what this web site processes. The two are set out separately because they happen separately.
Controller
The controller within the meaning of Art. 4(7) GDPR is the provider named in the legal notice. The address and contact details are there and are not repeated here. Data protection enquiries to support@armamentarium.app or through the contact form.
The application
What stays on the device
Army lists, the collection and the settings live in a database on the device. Photos added to the collection do not leave it. An army list leaves it only when it is explicitly sent from the roster export — see the third access below. There are no accounts, no sign-in, no telemetry, no advertising and no analytics services.
The application reaches the network in three places. All three happen at the user's instigation; none runs in the background.
1 Catalogue download
Purpose
Obtaining public rules catalogues from public GitHub repositories of the BSData community, on an explicit request made in the application.
Transmitted
No personal data. The connection itself is made to the operator of the repository; their terms apply to that retrieval.
Legal basis
Art. 6(1)(b) GDPR — carrying out the function that was requested.
2 Message from the Contact section
Purpose
Fixing reported faults and receiving suggestions. The message is written in the settings by the user and sent by the user, who chooses there which of the two it is.
Transmitted
Solely the text that was entered and — only on a problem report, and only where the box is ticked — the program log. A suggestion never carries one.
Redaction of the log
Before sending, the user name, personal folder paths and the names of army lists are removed from the log.
No sender
No sender is transmitted; there is no field for a reply address and there will not be one. A message from the application therefore cannot be answered; anyone expecting a reply uses the contact form on this web site.
Legal basis
Art. 6(1)(f) GDPR — legitimate interest in a working application.
3 Sending an army list to YellowScribe
Purpose
Setting up your own army list in Tabletop Simulator. It is started explicitly from the roster export of an open list; the service answers with a short code to be typed in there.
Transmitted
The complete army list — units, models, wargear and points, as it stands on the device. Nothing about it is removed or shortened; it is the payload. Without that click no army list leaves the device.
Recipient
YellowScribe, a third-party open-source service run by a single person — no account, no sign-in and no availability promise. The transmitted list is stored there temporarily and expires after ten minutes. That service's own terms apply to it.
Server location
Not determinable: the service is reached through a content delivery network that hides the actual server. A transfer to a country outside the European Union can therefore not be ruled out. Anyone wishing to avoid that does not send the list and uses the file export beside it — that one does not leave the device.
Legal basis
Art. 6(1)(b) GDPR — carrying out the function that was requested.
This web site
Access data
When this page is retrieved, the provider of the server infrastructure processes technically necessary access data. The purpose is delivery and operational security. The legal basis is Art. 6(1)(f) GDPR.
Processor
The site runs on a virtual server operated by IONOS SE, Montabaur. The processing is carried out under a data processing agreement pursuant to Art. 28 GDPR.
Third-party services
No audience measurement, no analytics, no consent banner. Fonts, icons and images are served from the same server.
One single foreign host is contacted: the two front pages embed Microsoft's store button, so that the way to the application sits where the application is offered. Opening a front page makes your browser fetch a script, the button's image file and an embedded frame from get.microsoft.com. In doing so, technical connection data is sent to Microsoft Corporation, based in the United States — among it your IP address, your browser identification and the address of the page the request comes from. The legal basis is Art. 6(1)(f) GDPR: the legitimate interest in showing the official route to the application right there. Every other page of this site contacts no foreign host, and the two front pages fetch nothing further from it.
Two references point outwards: the support page links to Ko-fi, and the two front pages link to the application's listing on Google Play. Nothing is loaded from either — the Google Play button, too, is an image file on this server, and a link is a destination that only a click follows. Following one leaves this website; the terms and privacy statement of Ko-fi or Google apply there. This website does not learn whether anyone clicks.
One single cookie, and it is technically necessary: the two pages carrying the contact form set one that protects the submission against forgery. It holds no identifier of the person, ends with the browser session, and requires no consent under § 25(2) TDDDG. Every other page of this site sets none.
The contact form
Fields and recipient
Two details are transmitted: the email address that was entered and the message. No name, no subject. They are sent as an email to the provider; delivery runs through the same host that serves the site.
Purpose, legal basis, retention
The purpose is handling the enquiry. The legal basis is Art. 6(1)(f) GDPR, or (b) for pre-contractual enquiries. The details are kept until the enquiry has been dealt with and are deleted afterwards; statutory retention obligations remain unaffected.
Voluntary
Giving an address is not required — there is no obligation to use the form at all. Without one, however, no reply is possible.
Spam protection
The form checks a hidden field and a minimum time between opening and sending. Both run on the same server; no third-party captcha is used.
The purchase
The unlock is handled solely through the respective distribution channel. Payment data does not reach the provider, who learns neither the means of payment nor the buyer's address. The terms of the operator of the distribution channel apply to the transaction. The price and the contracting party are under Legal.
Rights of the data subject
| Right | Article |
|---|---|
| Access to the data processed | Art. 15 |
| Rectification of inaccurate data | Art. 16 |
| Erasure | Art. 17 |
| Restriction of processing | Art. 18 |
| Data portability | Art. 20 |
| Objection to processing | Art. 21 |
Right to lodge a complaint
Independently of the above, there is a right to lodge a complaint with a supervisory authority under Art. 77 GDPR. The competent authority is the data protection supervisory authority of Baden-Württemberg.