Privacy

Last updated: July 2026

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Curbolt
Email: info@curbolt.net
Website: https://www.curbolt.de, https://www.curbolt.net

2. General information

Protecting your personal data is important to us. Personal data means any information relating to an identifiable person. This privacy policy explains what data we collect, why we use it, and what rights you have.

Unless stated otherwise below, processing is based on the GDPR. Our Terms of Use also apply.

3. Your rights as a data subject

You may contact us at any time using the details above to exercise the following rights:

Access to your stored data (Art. 15 GDPR),
Rectification of inaccurate data (Art. 16 GDPR),
Erasure of your data (Art. 17 GDPR),
Restriction of processing (Art. 18 GDPR),
Data portability (Art. 20 GDPR), where processing is based on consent or contract,
Objection to processing (Art. 21 GDPR) where processing is based on legitimate interests.

Logged-in users can export their account data as a JSON file under Profile → Settings (GDPR Art. 20) and delete their account themselves (GDPR Art. 17).

You may withdraw consent at any time with effect for the future.

You also have the right to lodge a complaint with a supervisory authority. An overview of authorities in Germany is available at bfdi.bund.de.

4. Visiting our website and server log files

Type and purpose of processing

When you visit our website, our hosting provider automatically records technical access data in server log files, for example:

IP address (possibly truncated/anonymized),
date and time of the request,
page/URL accessed,
browser type and version,
operating system used,
referrer URL,
hostname of the accessing device.

This data is used to provide the website, maintain security, troubleshoot errors, and optimize technical performance.

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation of the website).

Retention

Log data is kept only as long as necessary for these purposes, typically up to 14 days, after which it is deleted or anonymized.

5. SSL/TLS encryption

For security reasons, this site uses SSL/TLS encryption. You can recognize a secure connection by “https://” in your browser’s address bar and the lock icon.

6. Cookies and session data

We use technically necessary cookies and similar technologies, in particular:

session cookies for login status, language, and security features (e.g. CSRF protection),
an optional “remember me” cookie (cb_remember) when selected,
theme/display preference (cb_theme),
a pseudonymous visitor token (cb_vuid, typically up to about one year) to limit duplicate votes/polls and view counting without a login.

If a cookie cannot be set, a technical key derived from hashed IP address and User-Agent may be used as a fallback (without storing those raw values as a clear-text profile).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest) and Art. 6(1)(b) GDPR where the session is required to use your account.

Session data is removed after logout or when the session ends, unless statutory retention obligations apply. The visitor token ends when you delete cookies or the cookie expires.

If Google Analytics and/or AdSense are enabled in the site settings, a cookie notice is shown. Your choice is stored in the cb_consent cookie (typically up to 180 days). You can reopen the settings anytime via the footer “Cookies” link.

7. Registration and user accounts

You may create a user account on our website. We process in particular:

username,
email address,
password (stored only as a cryptographic hash, never in plain text),
registration date, last login, login count,
optional profile and activity data (e.g. level, XP, comment count),
optional avatar image,
optional saved perk planner / build data,
optional favorites visibility setting,
language preference.

Purposes: providing the account, authentication, email activation, abuse prevention, and communication related to use of the service.

Legal basis: Art. 6(1)(b) GDPR (contract/user relationship).

Account data is stored until you delete the account under Profile → Settings or request deletion, unless legal obligations require longer retention. Email deletion requests to info@curbolt.net. You can also export your data at any time under Profile → Settings.

8. Comments and community posts

Registered and logged-in users may post comments on certain articles (e.g. news) and on community mods. We store the text, timestamp, related content, user ID, optional parent/reply relationship, status (e.g. published/hidden), and optionally rating data (karma).

Legal basis: Art. 6(1)(b) GDPR (use of community features) and Art. 6(1)(f) GDPR (moderation and abuse prevention).

Posts remain published until deleted/hidden by us or upon your request, unless legitimate interests (e.g. evidence preservation) require otherwise.

9. Community mods, RWG seeds, and uploads

When you submit community mods, RWG seeds, or similar content, we process in particular:

metadata (titles, descriptions, categories/tags, license notes, source URLs, version notes),
uploaded files (e.g. ZIP archives) and preview images/screenshots,
your user ID as submitter and moderation/approval status,
optional moderator notes during review,
for collections: owner, labels, and related mod references.

Purposes: providing the community library, delivering downloads, moderation, abuse prevention, and auditability of submissions.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (operating and securing the platform).

Published content remains stored while offered on the website or until deletion/rejection. Rejected or removed submissions may be retained temporarily for moderation and abuse-prevention purposes.

10. Votes, favorites, and view counts

For upvotes/votes, favorites, and view counts we store technical keys (voter_key / viewer_key), e.g. u:{user id} for signed-in users or a pseudonymous visitor/fingerprint token for guests, together with the related content reference and timestamp.

Favorites are linked to your account and may be private or publicly visible depending on your setting.

Legal basis: Art. 6(1)(b) GDPR (use of the feature) and Art. 6(1)(f) GDPR (abuse prevention, statistics).

11. Reports

Via the report feature you can report content (e.g. seeds, community mods, mod posts). We store the reported entity type and ID, the selected reason, an optional free-text message, your user ID as reporter, and handling status, handler, and optional internal moderation notes.

Purpose: reviewing and handling reports of legal or policy violations.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in enforcement and platform safety) and Art. 6(1)(b) GDPR where reporting is part of using community features.

Reports are retained as long as needed for handling, auditability, and abuse prevention.

12. Contact form

If you contact us via the contact form, we process name, email address, topic, and message content, plus technical data for abuse prevention (e.g. hashed IP timestamps for rate limits).

Legal basis: Art. 6(1)(b) GDPR (handling your request) or Art. 6(1)(f) GDPR (spam/abuse protection).

Data is used to process your request and then deleted unless statutory retention obligations apply.

13. Email communication

We use your email address to send activation links during registration and, where applicable, password reset information. For contact requests we reply to the address you provide.

Legal basis: Art. 6(1)(b) GDPR.

Emails are sent via configured SMTP services and only for the purposes stated above.

14. Google sign-in (optional)

If enabled, you can sign in with a Google account (Google Ireland Limited / Google LLC). Google provides us with your OpenID subject ID, verified email address, and optionally your display name so we can create or link your user account.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract / user account).

More information: Google Privacy Policy.

15. Google Analytics (optional)

If enabled in the site settings, we use Google Analytics (Google Ireland Limited / Google LLC). Usage data (e.g. pages visited, time on site, approximate location derived from IP) may be processed via cookies or similar technologies. IP anonymization is enabled (anonymize_ip).

Legal basis: Art. 6(1)(a) GDPR (consent via the cookie notice). We do not load Google Analytics without consent.

More information: Google Privacy Policy.

16. Google AdSense (optional)

When analytics/tracking features are enabled, Google AdSense may also be integrated. Cookies may be set and usage data transmitted to Google to deliver ads and generate statistics.

Legal basis: Art. 6(1)(a) GDPR (consent via the cookie notice). We do not load AdSense without consent.

Opt-out and settings: Google Ad Settings.

17. Transfers to third countries

When using Google services (sign-in, Analytics, AdSense), data may be transferred to the USA or other third countries. Where required, we rely on appropriate safeguards (e.g. Standard Contractual Clauses) and the provider’s current documentation.

18. Hosting

Our website is hosted by an external provider that processes access data and content on our behalf to operate the site (Art. 28 GDPR, data processing agreement).

19. Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data based on Art. 6(1)(f) GDPR.

After an objection, we will no longer process the relevant data unless we demonstrate compelling legitimate grounds that override your interests, or processing is necessary for the establishment, exercise, or defense of legal claims.

Please send objections to: info@curbolt.net

20. Changes to this privacy policy

We may update this privacy policy when legal requirements, website features, or services change. The version published on this page applies.

21. Privacy contact

If you have questions about personal data processing or wish to exercise your rights, please contact:

Email: info@curbolt.net