Privacy

As of 4 October 2026

This is a convenience translation. The legally binding version is the German one: Datenschutz. This site does exactly two things with data: it serves itself, and on request it accepts your email address for the beta. No account, no login, no analytics, no advertising IDs.

The site itself

All files — fonts, scripts, images — sit on the same server as the page. Nothing is loaded from third-party servers: no Google Fonts, no CDN, no analytics service. No cookies are set; your browser stores nothing from this site.

No access logs. The web server keeps no access log for this domain: neither IP address nor timestamp, requested path or browser identification is stored permanently. Connection data is processed in memory only while the page is being served, and discarded afterwards. The server is operated by Hetzner Online GmbH in Germany.

The beta signup

What is stored: your email address, the time of signup, whether you have confirmed, and whether you used the upper or the lower form. Nothing else — no name, no IP address in the list.

Double opt-in. After you submit, your address first sits in the list as "unconfirmed", and exactly one email goes out to you: the request to confirm the entry. Only your click on the button in that email actually signs you up. If you do not click, nothing further happens, and the unconfirmed entry is deleted after 60 days at the latest. This protects you from someone else putting your address on lists you never asked for. The confirmation email and the confirmation page are currently in German.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by confirming. You can withdraw it at any time — through the unsubscribe link in every email or by an informal message to the address below. After withdrawal we send you nothing further.

What we use the address for: solely the closed beta of Tap to the Top. That means the invitation, short notes on the state of the beta, and the message when the game is released. No general newsletter, no advertising for other products, no passing on or selling to third parties.

For how long: until the end of the beta phase, and at most until you object. After that the address is deleted. A demonstrable record of consent is kept for as long as it is needed as evidence, and no longer.

Abuse protection

So that no bot can enter other people's addresses, the server checks three things on submission: that the request comes from this site, that an invisible check field has stayed empty, and that the form was actually open. For the last check, and for a limit of a few signup attempts per hour, your IP address is processed briefly: once to compute a check value, and once as a non-reversible hash for the hourly counter. The IP address itself is not stored; the counter file contains only the hash and timestamps and becomes meaningless after an hour. The legal basis is our legitimate interest in a working, abuse-free form (Art. 6(1)(f) GDPR). We deliberately do not use a captcha.

Email delivery

The confirmation and beta emails are sent on our behalf by Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA, via their infrastructure in the EU (Ireland). Your email address is transmitted to Resend for this purpose. A data processing agreement is in place with Resend; for the transfer to the USA the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR). It is possible that US authorities access this data and that you do not have the same legal remedies against this as in the EU. Only what is needed for delivery is transmitted: your address and the text of the email.

No tracking pixels

Our emails contain no counting pixels and no redirected links. We cannot see whether you opened an email — only whether you pressed the confirmation button, because that is what the button is for.

Your rights

Access to the data stored about you (Art. 15 GDPR)
Rectification (Art. 16) and erasure (Art. 17)
Restriction of processing (Art. 18)
Data portability (Art. 20)
Objection (Art. 21) and withdrawal of consent (Art. 7(3))

An informal message to the address below is enough; you do not need a form for it. You can also complain to a supervisory authority — the competent one is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.

Controller

Martin Langhammer
Carola-Neher-Straße 12
81379 München
Germany
contact@c-arena.com

Full provider identification in the imprint.