1. Data controller and our services

The controller responsible for data processing at Friendly-Helpers is:

Lars Heuschkel
Merschweg 6a
33449 Langenberg
Email: immerda@friendly-helpers.de

Friendly-Helpers is our free gaming community project. Lars Heuschkel operates it as an individual and pays for the servers, domains and infrastructure entirely himself. There are no paywalls, paid extra features, advertising, sponsors, affiliate earnings or funding through donations.

This policy covers friendly-helpers.de, including the wiki and WoWS analyses, our Discord bot and the Control Panel at cp.friendly-helpers.de. It also applies to players whose publicly available WoWS data we analyse even if they have not visited our website or used the bot themselves.

2. Purposes and legal bases

We process data to provide our website and community features, present game statistics in an understandable way, enable authorised administrators to manage their server features, and protect our services against errors and misuse. Where we rely on legitimate interests under Article 6(1)(f) of the GDPR, we explain the relevant purpose in the following sections. A publicly available player identifier or installation of our bot does not constitute blanket consent.

Google Analytics and optional personal OC messages are based on consent under Article 6(1)(a) of the GDPR. The administration of voluntary OC events is based on our legitimate interest in organising these community events. To handle statutory data protection requests, we process the necessary information under Article 6(1)(c) in conjunction with Articles 12 to 22 of the GDPR.

3. Website, hosting and locally served resources

When you visit our website, we process information including your IP address, the time, the requested page, the status code and browser information. Depending on the request and log, this may also include information about the referring page. This data is used to deliver the website, diagnose errors and protect against attacks. Our legitimate interest under Article 6(1)(f) of the GDPR is reliable and secure operation.

Our website runs on infrastructure provided by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. The hosting provider processes the data required to operate the service. Privacy at netcup.

Web server logs are rotated daily, with 14 archived versions retained. This is not a uniform 14-day deletion period for all operational data. Other technical logs have their own rotation schedules, such as four weekly archived versions for access-blocking logs, ten weekly archived versions for database logs, and a five-day history for a bot monitoring log. Logs of bot functions are separate from these.

We serve Google Fonts typefaces, Lucide icons and the texture image from Transparent Textures locally. When these resources load, the current website does not request files from Google Fonts, unpkg or Transparent Textures. Google Analytics is separate and is used only with your consent to analytics.

4. Cookies and local storage

We store your cookie preferences in your browser so that we can respect your consent or refusal on later visits. These locally stored preferences currently have no expiry date of their own. You can reset them at any time using Change cookie preferences.

Only if we can neither store a refusal locally nor remove an old consent do we use the fallback cookie fh_analytics_denied. It contains only the refusal value and is valid for no more than one year. Successfully storing a new choice removes this fallback cookie. If the browser prevents all storage, we cannot save your choice permanently; Analytics remains blocked on the current page.

The Control Panel requires cookies for sign-in and form protection. A session ends after 30 minutes of inactivity and no later than eight hours after it starts. The short-lived sign-in state is valid for ten minutes. These validity limits do not mean that the associated stored records are deleted immediately.

This necessary local storage and these session functions fall under Section 25(2), point 2, of the German TDDDG. The processing of personal data serves to reliably respect your choice and provide secure access to requested features, and is based on Article 6(1)(f) of the GDPR. Analytics cookies, by contrast, require your consent.

5. Google Analytics

We use Google Analytics 4 on an ongoing basis to measure our audience and analyse how our pages and tools are used. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is your consent under Article 6(1)(a) of the GDPR; Section 25(1) of the German TDDDG also applies to storing or reading non-essential information on your device.

Without consent to analytics, Analytics is not loaded and no Analytics measurement requests are sent. With your consent, Google processes technical connection data, cookie-based identifiers, and information about usage, your device and location. Detailed location and device data collection remains enabled. This measurement is not fully anonymous.

Page views, visitor and session counts, and scroll events when 90 percent of a page is reached remain enabled. Automatic measurement of website searches, outbound clicks, form interactions and browser history changes, as well as automatic detection of user-provided data, are disabled.

We limit the page addresses and titles transmitted: player and clan profiles are assigned to general page categories. Account IDs, nicknames, search parameters and URL fragments are not included in these measurement values. Known content pages may be analysed using their canonical paths and titles. Internal referring pages are categorised; for external referrals, only the origin is used, without the path or search parameters.

The confirmed GA4 retention settings are two months for event data and 14 months for user data. Resetting on new user activity is enabled: further activity restarts the retention period for the user identifier. This does not create an absolute maximum of 14 months from the first visit. These retention settings do not apply to aggregated standard reports.

Analytics uses cookies including _ga and _ga_8FNKWF6T9F. Both use Google's default lifetime of two years (730 days) from being set or last updated. Further page views while your consent to analytics remains in place extend this lifetime again. Your browser or its privacy settings may shorten the actual storage period. You can remove the cookies in your browser at any time.

This cookie lifetime is separate from the GA4 data retention described above and from our locally stored cookie preferences. Your cookie preferences currently have no expiry date of their own; this does not result in an automatic new consent request after two years.

You can withdraw your consent at any time using Change cookie preferences. Resetting your choice already stops further measurement requests, even if the tracker was previously loaded. Your choice is synchronised between open tabs of the same website, and the known Analytics cookies set by our website are removed. Requests already sent cannot be recalled, and withdrawing consent does not automatically delete data already stored by Google.

After consent is withdrawn, if the tracker was previously loaded, any new consent takes effect only on the next page view. Activity in the meantime is not sent later. Withdrawing consent does not affect the lawfulness of processing previously carried out on the basis of your consent.

For the core Analytics service, Google's contractual terms provide for processing on our behalf. Data may also be processed by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google identifies the EU-US Data Privacy Framework and standard contractual clauses in particular as safeguards for this. Information about these safeguards and their conditions is available in Google's information on data transfers, with information about processing in Google's privacy policy and about GA4 data retention.

6. Discord and Wargaming

Discord: For users in the European Economic Area, the platform provider is Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands. Privacy contact: privacy@discord.com. Discord processes sign-ins, bot interactions, channel posts and direct messages, among other things, under its own responsibility for the platform. In the Control Panel, we use Discord for sign-in and to verify identity and permissions; server images may also be loaded from Discord.

Discord also processes data in the USA and identifies the EU-US Data Privacy Framework and standard contractual clauses as grounds for transfers. Details and information about these safeguards are provided in Discord's privacy policy. We remain responsible for our own processing through the bot and Control Panel.

Wargaming: Our WoWS data comes from publicly available World of Warships data and the interfaces provided for it by Wargaming Group Limited, 105 Agion Omologiton Avenue, Nicosia 1080, Cyprus. Privacy contact: privacy@wargaming.net. Wargaming receives our API requests, including requests relating to accounts or clans. We do not receive players' private email addresses or passwords through these interfaces.

Wargaming is responsible for its own processing and international transfers. It explains these and the safeguards provided for them, including standard contractual clauses, in its privacy policy. Our processing of the retrieved data is described in the next section.

7. World of Warships data

We process account IDs, nicknames, clan and membership information, and activity, battle, ship, season and performance values from the Wargaming sources named above. We use them to provide player and clan profiles, search, comparisons, rankings, historical analyses and our own metrics. Configured clan notifications may post relevant information on Discord. Public profiles may also be found by search engines.

The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest, and the interest of the community using the service, is in understandable game statistics, longer-term comparisons and information about clan activity. Account identifiers allow game values to be reliably associated with an account even when a nickname changes. Historical values are needed to show developments beyond individual snapshots.

We also take into account that public game values remain personal data, and that combining and publishing them over a longer period may affect a player's expectations. Our analyses concern gameplay; public availability alone does not justify every further use. We respect available visibility settings, provide ways to submit data protection requests and objections, and protect excluded accounts against being included again and against personal data appearing in clan notifications. We do not use the data for advertising in our self-funded project.

Changes to source data may reach us with a delay. During disruptions, older cached information may be used; we do not guarantee that every visibility change will always be reflected immediately. A profile that later becomes public again is not permanently excluded solely because it was previously private.

Historical ranking snapshots are retained for 90 days under the existing procedure. Long-term player and ship statistics are retained for historical analyses; there is no uniform automatic deletion of these records based on their age. This also applies to certain historical import and verification records. Temporarily cached API responses are valid for between five minutes and 24 hours, depending on the data type; this is not a uniform period for final deletion.

You can contact us at the email address above for access requests, objections and erasure requests. We need the relevant profile to identify the data concerned, and request additional information only where necessary. Our targeted erasure procedure covers numerous player, statistics, cache and linked records. It also covers references to the affected accounts in earlier clan comparison records, delivery histories, and historical import and synchronisation data. Unrelated data is not deleted indiscriminately.

The extension has not yet been applied to real player data and has not automatically removed earlier residual records. It does not remove previously published Discord messages, separately maintained files or backup copies.

To prevent an account from being included again after erasure, we retain a protected pseudonymous exclusion identifier. Its sole purpose is to prevent renewed inclusion, and it is retained permanently under the existing procedure. The legal basis is Article 6(1)(f) of the GDPR: our interest is in continuing to respect justified erasure and objection decisions. This identifier is not a normal profile history and does not amount to full anonymisation.

8. Discord bot and quizzes

For bot functions, we process information including Discord user, server and channel IDs, display names, required role and permission information, and the settings and command options entered. Depending on the feature, this also includes membership and presence information, for example for aggregated server statistics. The Discord library maintains a limited temporary message cache in memory.

Our legitimate interest under Article 6(1)(f) of the GDPR is to reliably provide requested and configured community features. Installing the bot as an administrator does not constitute members' consent.

Clan notifications use earlier membership and comparison records, along with delivery records. Excluded WoWS players are filtered out before any output of personal data. This also applies to manual tests and alternative delivery routes. If the exclusion check cannot be completed reliably, the affected message containing personal data is not sent. This protection does not delete earlier messages or older records; requests already sent to Discord cannot be recalled.

Command and error logs may contain identifiers, command names, options and timestamps. They are used to diagnose errors, understand how functions were called, and protect against misuse. These legitimate interests form the basis for processing under Article 6(1)(f) of the GDPR. There is no uniform automatic deletion period for these logs of bot functions.

Quiz features store user identifiers, selected answers, whether answers were correct, points and timestamps. Answers and results support transparent scoring, fair competitions and leaderboards. The legal basis is Article 6(1)(f) of the GDPR. Quiz answers, result histories and leaderboards are retained for these features. Question content and temporary snapshots are cleared under the existing procedure when a run is completed or invalidated; this does not delete all answer or score data.

Certain list commands send direct messages at your request. The bot may respond to a direct message with a help notice. Personal OC messages are separately optional. Administrator onboarding assistance is only planned and does not create permission to contact anyone.

Removing the bot does not automatically end all storage. Some server and channel records are removed, while configurations, quiz histories, information about who added the bot, and logs may remain. There is currently no comprehensive automated procedure for erasing all general Discord data relating to a person. We handle personal data requests through the contact channel given above.

9. Control Panel

The Control Panel uses Discord for sign-in and verifies identity, server membership and the required permissions. We do not receive your Discord password. The information processed includes your Discord ID, username, session and permission details, and sign-in, expiry and revocation times.

Authorised administrators can configure server features. We may store who initiated a setting change or task, its target, time and processing status. Our legitimate interest under Article 6(1)(f) of the GDPR is secure and traceable administration by authorised people.

The global operator overview is separate from the access provided to ordinary server administrators. To identify who installed the bot, we may store inviter identifiers, names, sources and timestamps taken from existing Discord records. This information does not establish current administrator status or a personal need for support, and does not permit unsolicited onboarding messages.

Expiry and signing out make a session unusable. Expired session records and metadata for completed tasks may nevertheless remain stored. Session validity must therefore be distinguished from actual data deletion.

10. Operations Center

Our optional Operations Center organises internal gaming events. For this, we store event content, Discord user IDs and display names, registration status, timestamps and optional message preferences. Organisers can explicitly confirm actual attendance. There is no automatic attendance monitoring or linking to WoWS profiles.

Members see published events, participant counts and their own registration. Authorised organisers see participant lists and the change history. Discord processes the event information shown there and optional direct messages under its own privacy rules. Personal messages are optional and can be disabled independently of event registration.

Events and their associated participant data are scheduled for deletion 30 days after the event ends, is closed early or is cancelled; if there is no end time, the start time applies. Drafts have a deletion period of 30 days from creation, and withdrawn registrations seven days. Change records containing personal data have a maximum retention period of 30 days; read personal notices and completed delivery tasks have a maximum of seven days. Earlier event deletion deadlines continue to apply. After our bot is disabled or removed, remaining OC data has a deletion period of 30 days. Deletion takes place automatically at regular intervals; operational disruptions may delay it. Overdue data is cleared before the service is enabled again.

Withdrawing your registration does not erase all data relating to you. For access, rectification or complete erasure, contact us at the email address above. A minimal pseudonymous erasure record is kept in protected storage until older recoverable copies are no longer retained. Please do not enter real names, contact details or sensitive information in event free-text fields.

Existing protected backups retain their current retention periods. After restoring the root server, we deliberately start the Operations Center empty and disabled: old events, registrations, history and OC settings are not made available again. We handle our own known Discord messages through our deletion procedure where they remain accessible. We cannot completely remove copies held by others, screenshots or messages that are no longer accessible.

11. Search and short links

Search and comparison features process the player, clan or ship names and filters entered. Search selection counters may affect the ordering of frequently searched profiles.

Short links store their target, creation and expiry times, and aggregated click information. A target may contain a player identifier. An IP address is also processed in relation to time to prevent abusive link creation. Our legitimate interest under Article 6(1)(f) of the GDPR is to provide usable search and linking features and protect them against misuse.

A short link is valid for seven days. Expiry does not automatically delete its target from the database. Under the existing procedure, older IP entries are cleared only when another link is created later; deletion after 24 hours is not guaranteed.

12. Contact and backups

If you contact us, we process the contact details and content you provide to handle your enquiry. The legal basis for general enquiries is our legitimate interest in communication under Article 6(1)(f) of the GDPR; statutory data protection requests are subject to the legal obligation described in section 2.

Messages to our contact address are forwarded to our mailbox on our own mail server. The server infrastructure used for this is hosted at netcup. Please do not send us passwords or access tokens.

We create backups so that we can restore our services following data loss or technical disruptions. The operator personally manages and safeguards them. They may include personal data from the website, bot, Control Panel and email. The legal basis is our legitimate interest in availability and recoverability under Article 6(1)(f) of the GDPR.

Storage in backups is separate from storage in live systems. During a restoration, known erasure requests and exclusions preventing renewed inclusion must be taken into account before personal data is made publicly available again. The separate empty restart described above applies to the OC. This does not guarantee that every older copy has already been fully cleared of the relevant data.

13. Your rights and data protection requests

You can contact us at immerda@friendly-helpers.de about your personal data. The responsible contact is Lars Heuschkel. Where possible, identify the feature concerned and the player or Discord identifier needed to locate the relevant data. We do not routinely require a copy of an identity document; where necessary, we use proportionate checks to establish whether a request can be associated with the correct person.

Subject to the conditions set out by law, your rights include:

• Access to information about the processing and a copy of your personal data.
• Rectification of inaccurate data, erasure, or restriction of processing.
• Data portability where its legal conditions are met.
• Objection to processing based on legitimate interests on grounds relating to your particular situation.
• Withdrawal of consent with effect for the future; for Analytics, use Change cookie preferences.

We handle requests in accordance with legal requirements, generally within one month. If a legally permitted extension is necessary, we inform you within that period. Where data cannot be erased because it is still required for a purpose or because of a legal obligation, we explain the reasons. Removing the bot, signing out and withdrawing consent to Analytics do not replace a separate erasure of all existing data.

You can lodge a complaint with a data protection supervisory authority, particularly where you live, work or believe an infringement occurred. For our operator in North Rhine-Westphalia, this is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, email poststelle@ldi.nrw.de. Information and complaint form.

14. Retention without a general deletion period

The periods stated in the individual sections apply to the data identified there. Other records have no uniform automatic deletion based on their age. A session, link or cache entry reaching its expiry time is not a promise of complete deletion.

For personal data retained for longer, the relevant purpose and continuing necessity determine retention: long-term game statistics enable historical comparisons; quiz answers and result histories support transparent scoring and leaderboards. Configuration and association data support the administration of configured features. Operational and task records may be needed to investigate errors or misuse.

For contact enquiries, handling the enquiry and retaining necessary records of the correspondence are the relevant criteria. For backups, retention criteria depend on recovery needs, including correcting errors noticed only later, and the availability of suitable newer backups. There is no fixed automatic deletion period for these.

When we receive a corresponding request, we assess whether personal data is still needed in the individual case and whether rights to erasure or objection apply. Retaining statistics, quiz histories, logs and backups does not exclude these rights.