Privacy Policy

Last updated: 21 October 2026

1. Controller

The controller responsible for processing personal data on https://ninelives.beastyrabbit.com is:

Tobias Heer
c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen
Germany

E-mail: datenschutz-ninelives@heerlab.com

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

This policy explains which personal data is processed when you use Nine Lives, for what purposes, on which legal basis, and for how long. Nine Lives is a private, non-commercial project. Nine Lives is a role-playing game that runs in the browser. You can play as a guest without an account; your save then stays only in your own browser. If you sign in, your save is also stored on the server.

Personal data is not sold and not used for advertising. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

3. Hosting and delivery

Nine Lives runs on the controller's own server infrastructure in Germany. Requests from the internet reach the application through a reverse proxy on a virtual server operated by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany (data center in Nuremberg). netcup processes the data as a processor under a data processing agreement pursuant to Art. 28 GDPR. The connection is TLS-encrypted up to the reverse proxy and forwarded from there to the controller's infrastructure through an encrypted tunnel.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the secure and reliable provision of the website.

For data protection against loss, backup copies are made regularly within the operator's own infrastructure; they are overwritten once their retention period expires.

4. Server log files

For every request, the reverse proxy automatically stores the following data:

The Cookie and Authorization headers are redacted. URL paths and query parameters are logged.

This data is used to operate the site, analyse errors, and defend against attacks and abuse. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the stability and security of the service. Log files are deleted automatically after 14 days.

In addition, the reverse proxy and the application keep short-lived technical logs, such as request, connection and error logs as well as attack-detection alerts (see section 5). They may contain the IP address, the time and the requested address and serve the same purposes on the same legal basis. They are deleted after 30 days at the latest.

5. Protection against attacks (CrowdSec)

To protect against attacks, the security software CrowdSec automatically analyses the server log files and blocks IP addresses that are clearly the source of attacks (for example mass login attempts or scanning for vulnerabilities). When CrowdSec detects an attack, the IP address, time and type of attack are sent to CrowdSec SAS, 20 rue Maurice Arnoux, 92120 Montrouge, France. CrowdSec uses these reports for a shared blocklist that protects many servers. No data is sent to CrowdSec during normal browsing.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is protecting the website and its users from attacks.

According to CrowdSec, the controller and CrowdSec are jointly responsible for this processing (Art. 26 GDPR): CrowdSec is responsible for operating its central services and blocklists, the controller for its use on this server. You can exercise your rights against either of them; CrowdSec can be reached at dpo@crowdsec.net. CrowdSec may pass the reported data on to members and partners of its network. According to CrowdSec, transfers to countries outside the EU are based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Full IP addresses are generally retained for no more than three months and then progressively generalised. CrowdSec describes exceptions of up to one year before anonymisation for certain attack analyses and training purposes. Details: crowdsec.net/privacy-policy.

6. User account and saves

When you sign in, Nine Lives stores a player record with your account identifier and your saves (game progress, settings, play time and names assigned in the game) on its own server in Germany. Nine Lives does not store your e-mail address or password. The purpose is to make your save available across devices. The legal basis is Art. 6(1)(b) GDPR.

When you play as a guest, your save stays only in your browser (see section 10) and is not transferred to the server.

The data on the server is stored for up to 10 years. On request to datenschutz-ninelives@heerlab.com, the controller deletes it earlier.

7. Sign-in with Clerk

For sign-in, Nine Lives uses Clerk, a service provided by Clerk, Inc., 660 King Street, San Francisco, CA 94107, USA, as a processor. Clerk is loaded only when you sign in or are already signed in; it is not loaded when you play as a guest. Clerk processes your account data (e-mail address, user name, password in encrypted form), your IP address, and device and session data. The same account also applies to BeastyPage (beastyrabbit.com). The purpose is secure sign-in; the legal basis is Art. 6(1)(b) GDPR. Sign-in is technically necessary to link your save to your account. Clerk is certified under the EU-US Data Privacy Framework. Account data is stored until the account is deleted, for up to 10 years at most. Details: Clerk privacy policy.

During registration, Clerk uses Turnstile, a service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, to protect against automated registrations (Art. 6(1)(f) GDPR; Cloudflare is certified under the EU-US Data Privacy Framework; privacy notice). If you sign in with a Discord, GitHub or Twitch account instead, the respective provider sends your account identifier and e-mail address to Clerk; the provider is independently responsible for its own processing (Discord, GitHub, Twitch).

8. Usage statistics, error reports and consent

Umami and GlitchTip run on the controller's own servers in Germany.

With your consent, Umami collects usage statistics, custom game events and performance values to help improve the game. It also creates session replays and heatmaps of the page, with all text and inputs masked. The game canvas is not recorded. Umami runs only after you opt in to analytics. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Analytics data is retained for up to 10 years. You can withdraw consent at any time via Cookie settings. Withdrawal reloads the game to stop the recording and does not affect the lawfulness of processing before withdrawal. When Nine Lives is embedded on BeastyPage (beastyrabbit.com), the game shows no consent banner of its own and follows the analytics choice you make in BeastyPage's cookie settings; you can change or withdraw it there.

GlitchTip receives error reports and technical diagnostic data from the browser and server to help find and fix faults. Personal data is not intentionally collected; identifying details are filtered and IP addresses are scrubbed. GlitchTip stores nothing on your device. Events are kept for 90 days. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is a stable and reliable game.

The consent banner stores your choice in the first-party cookie nl_consent for 180 days so it can remember and apply your settings. This storage is technically necessary under Section 25(2) no. 2 TDDDG. The legal basis for processing your choice is Art. 6(1)(f) GDPR; the legitimate interest is respecting and documenting your privacy choices.

9. Contact by e-mail

If you contact us by e-mail, your e-mail address, the content of your message and the technical details of the e-mail are processed to answer your request. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is being able to answer requests.

The mailboxes are hosted by Fastmail Pty Ltd, PO Box 234, Collins Street West, VIC 8007, Australia, as a processor. Data may be transferred to countries outside the EU, in particular Australia, the USA and India. For these transfers, Fastmail uses the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Details: Fastmail privacy policy, data processing agreement and Standard Contractual Clauses. You can obtain a copy of the safeguards by writing to datenschutz-ninelives@heerlab.com.

The controller deletes messages after dealing with the request unless retention remains necessary. Fastmail may subsequently retain backup and log data under its published deletion rules.

10. Cookies and local storage

Nine Lives stores your saves, settings and a random guest identifier in your browser (local storage and IndexedDB) until you clear the website data in your browser. When you sign in, Clerk sets cookies and local entries for the sign-in session with a duration of up to one year. This storage is technically necessary for the game and sign-in (Section 25(2) no. 2 TDDDG); consent is not required. The consent banner also stores your choice in the nl_consent cookie for 180 days. Umami runs only after analytics opt-in, as described in section 8. No advertising cookies are set.

11. Your rights

You have the following rights regarding your personal data:

Right to object (Art. 21 GDPR): Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

To exercise your rights, simply send a message to datenschutz-ninelives@heerlab.com.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

12. Obligation to provide data

You are not obliged to provide personal data. However, the website cannot be delivered without the technically necessary connection data. Without an account, you can play as a guest; your save is then stored only in your browser.

13. Changes

This privacy policy is updated when the website or the legal situation changes. The version published here applies.