Coflnet

Published and last updated: 8 August 2026, 10:00 CEST

The protection of your personal data is important to us. We process personal data exclusively in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). This privacy policy explains what data we process, for which purposes, on which legal basis, how long we keep it and which rights you have.

At a glance

This overview is a reading aid; the full policy below is authoritative.

Who is responsible: Coflnet GmbH, Dorfstraße 27a, 84163 Marklkofen, Germany — reachable for all privacy matters, including data-subject requests, at [email protected] (section 1).
What we process: account, usage, purchase and support data, plus the product-specific data described in section 7 — generally only when you request the corresponding account, feature, contribution or purchase (section 3.1).
No selling, hardly any third-party tracking: we do not sell personal data. coflnet.com itself uses no analytics or tracking cookies; product analytics run on our own self-hosted instance and stay off until you enable them; advertising exists only on sky.coflnet.com behind a consent banner (sections 4.5, 7.6 and 17).
AI features: inputs are sent to an external AI provider only for the specific functions described in sections 4.3 and 7, and your content is not used to train models without a separate, revocable opt-in.
Where data goes: hosting is primarily in the EU; all recipients, regions and third-country transfer safeguards (DPF, SCC) are listed in sections 9 and 10.
How long we keep it: central logs at most seven days; invoices and tax records for the statutory periods; the product-specific periods are in sections 7, 8 and 11.
Your rights: access, rectification, erasure, restriction, portability, objection and withdrawal of consent — by email to [email protected], no login required — plus complaint to a supervisory authority (section 13).

1. Controller

For processing for which Coflnet determines the purposes and means, the controller within the meaning of Art. 4 (7) GDPR is:

Coflnet GmbH Dorfstr. 27a 84163 Marklkofen, Germany Email: [email protected]

For all data protection matters, including data-subject requests, you can also reach our dedicated privacy contact directly at [email protected]; the address above remains available, and requests received there are handled by the same designated internal privacy lead. We regularly review whether a data protection officer must be appointed (Art. 37 GDPR, § 38 BDSG); if one is appointed, we will publish that person’s direct contact details here without delay. Where another organization determines processing purposes or Coflnet processes customer content on documented instructions, responsibility follows the actual service arrangement and the applicable product or customer notice; this general policy does not itself assign those roles.

2. Services covered by this policy

This policy covers processing actually carried out through coflnet.com and the following available products, to the extent Coflnet is responsible for that processing or provides processing under a documented customer arrangement:

Spables (spables.app) – dialect audio transcription and validation platform
Advanced Notification Engine – ANE (ane.deals, ane.coflnet.com) – marketplace search, price analysis and notification service, including a browser extension and mobile app
Toduen (toduen.com, dash.coflnet.com) – business metrics dashboard
Prufi – CAD manufacturability analysis
CDM – container and waste logistics platform for business customers
IdleMine – Discord-controlled Minecraft bot and account hosting operated by Coflnet
Coflnet Minecraft hosting – Minecraft-account hosting operated by Coflnet
SkyCofl (sky.coflnet.com) – auction house tools for Hypixel SkyBlock
BazaarPro (pro.skyblock.bz, pro-api.skyblock.bz) – Hypixel SkyBlock market analysis, tracked-item alerts, personalized task suggestions and subscription access
Dia (dia.coflnet.com) – dialect recording and research apps, built on the Spables platform
Twt – “the women translator” (twt.coflnet.com) – AI-powered entertainment translation app
CTW – CollectTheWorld (ctw.coflnet.com) – gamified image-collecting app
Vereiner (vereiner.com) – club/association management platform
SongVoter (songvoter.party) – collaborative party song-voting app
Coflnet Discord bot – community and support bot on our Discord server

A product-specific or customer notice can provide additional information for the processing it identifies. Where a product is offered by another organization, that organization’s notice applies to processing for which it determines the purposes and means.

3. General legal bases

Depending on the processing operation, we rely on:

Art. 6 (1)(b) GDPR – performance of a contract or pre-contractual measures (providing our services to you);
Art. 6 (1)(f) GDPR – our legitimate interests (e.g. IT security, abuse prevention, service improvement), balanced against your interests;
Art. 6 (1)(a) GDPR – your consent, where we ask for it (e.g. optional integrations or a feature’s expressly identified optional training use);
Art. 6 (1)(c) GDPR – compliance with legal obligations (e.g. tax retention duties);
an applicable Art. 9 GDPR condition where a feature intentionally processes special-category data; we identify that condition in the relevant product notice.

You may withdraw any consent at any time with effect for the future. Consent for an optional purpose is requested separately, is not inferred from inactivity or preselected controls, and is not a condition for an unrelated service.

Accepting the Terms is an act of contract formation, not consent under Art. 6 (1)(a) GDPR. This privacy policy provides information; it is not a contract term that you must “accept”, and we do not record a separate general acceptance of it. Where we rely on consent, the relevant product requests a separate affirmative choice for the specified purpose. Statutory checkout declarations, including a request for immediate performance during the withdrawal period, are also recorded separately. The Terms notice and any declarations needed at the same step can be presented in one interface to avoid repeated prompts, but they remain legally and technically distinct records.

3.1 Required and optional data

Most data described in this policy is required only when you request the corresponding account, feature, contribution or purchase, not merely because you visit an accessible public page.

Whether data are personal and whether they are required for a requested purpose are separate questions: required data can still be personal, and optional data are not necessarily personal. Data are personal where they relate to an identified or identifiable person, including because a file or event is linked to an account even if its visible content names nobody. Reliably aggregated technical metrics without user, device, network or other linkable identifiers are not personal data. Public or pseudonymous data are not automatically anonymous.

Situation	Data required for the requested purpose and consequence if it is not provided	Optional data
Account and security	The authentication identifier, account identifier, required contact detail and session/security data are needed to create, secure and recover the account. Without them, we cannot provide an authenticated account.	Profile picture and product-specific profile fields not marked as required.
Requested product function	Inputs, settings and delivery identifiers that the selected function cannot operate without. If they are omitted, that function or notification cannot be performed.	Integrations, notifications and convenience settings that you do not select.
Public chat	Message content, the public account or player identifier, time and delivery metadata are needed to publish, distribute and moderate a message that you choose to send to a public chat. The content and public identifier remain personal data where they identify or can be linked to a person.	Posting is optional; merely reading public chat does not require a message contribution.
Support or contact	The message and a reply address or account reference are needed where we cannot answer or allocate the request without them. Names, addresses, message contents and identifiers are personal data where they relate to an identifiable person.	Information not needed to understand and answer the request, especially passwords, payment credentials and sensitive or third-party details.
Automatic security metadata	IP address, request/session identifiers, timestamps and comparable events are generated where needed to deliver and secure a request, investigate errors or prevent abuse. They are personal data while reasonably linkable to a person or account.	Non-essential analytics and advertising identifiers are not required security metadata.
Purchase or legal request	The order, payment, tax and contact/reference data required to complete and allocate a purchase, issue required records or process your declaration. Without the required fields, the purchase or request cannot be completed reliably.	Fields expressly marked optional, such as a reason where the applicable form does not require one.
Managed Friends Plan seat	The Subscriber’s account or profile identifier, tier and seat capacity, the seat assignment and the technical eligibility data needed to derive access are required to provide a seat. Where another account holder is invited, their account identifier, invitation and acceptance status, accepted agreement Root and applicable seat-notice version are also required. Without the applicable fields, the seat cannot be assigned.	Inviting or accepting a seat is optional. An invited person may reject it or later leave.
Reward program	A report may be submitted without a civil name. To attribute an approved report award, or a referral award designated as euro-denominated, to the separate ledger, we need an account or pseudonymous reporter identifier or stable case token, the report or referral reference, award amount and status. A payout additionally requires the payee, identity, address, country, tax and payout data stated in section 5; without them, we cannot make or document the payout. For a recipient under 18, it also requires either a legal representative’s approval record or the recipient’s recorded choice to wait until turning 18.	Evidence not needed to validate the report or referral; a report attachment unless the issue cannot reasonably be understood without it.
Data-contribution program	The active contribution path identifies the required data, contribution or batch reference, program/notice version, submission time and validation result. Where the program promises or later grants promotional Service use, the account reference, grant source, amount, original euro redemption value and delivery status are also required.	Participation, extra evidence and any public attribution are optional unless the displayed program expressly identifies them as an eligibility condition. Existing product data are not enrolled retroactively.
CTW contribution	Under the versioned flow in section 7.9, the account/contribution reference, challenge data, object label and image, upload time and contribution-purpose evidence are needed to receive, validate, store, quality-check, include in the disclosed CTW dataset and credit the contribution. Those account-linked records are personal data. A derived object-only sample is non-personal only after file and other linkable metadata and account linkage have been removed, a documented screening finds no person or other identifying detail, and re-identification is not reasonably likely.	A description and the public leaderboard name, avatar and visibility choice are optional. A legacy general “new services” choice or per-upload licence does not retrospectively enrol an earlier contribution or authorize unrelated reuse. Unrelated profiling, advertising, materially different training uses and intentional processing of special-category data require their own legal basis.
Optional consent purpose	Nothing beyond the data identified at the consent control is required. Refusal or withdrawal disables only that optional purpose.	Examples include optional training uses outside a product’s disclosed core purpose and non-essential analytics or advertising.

4. Visiting our websites

4.1 Server logs

When you visit our websites, our web servers automatically record access logs: IP address, date and time, requested URL, HTTP status, transferred data volume, referrer URL, browser type/version and operating system. We use this data to deliver the website, to detect and block abuse and attacks, and to bill infrastructure services. Legal basis: Art. 6 (1)(f) GDPR (secure and reliable operation). Depending on the service and error context, application logs or traces can also contain account or request identifiers and submitted content or database values included in diagnostic context. Centrally collected application and access logs and traces are retained for no more than seven days. Technical metrics may be retained for longer operational periods only where they are service-level measurements for availability, capacity or error rates and contain no account, device, network, request, session or trace identifier, IP address, message or file body, other user content or other reasonably linkable label. Aggregation alone is not treated as proof of anonymity; any metrics stream containing personal data follows the seven-day limit. The additional criteria in section 11 apply.

4.2 Hosting

Our websites and services are hosted by the infrastructure providers and in the regions listed in section 9. A product may involve processing outside the EU/EEA only subject to section 10.

4.3 Contact form, email and other contact channels

If you use the landing-page contact form, we receive your email address, message and any optional name you provide and use them to answer your inquiry. The submission is delivered as one email to our staffed support mailbox through the configured mail-delivery infrastructure described below; this route does not post your message to a chat platform. A durable delivery-queue record containing the submission exists only until delivery succeeds and is then deleted. The mailbox copy is handled like other support correspondence. Legal basis: Art. 6 (1)(b) GDPR for contract-related inquiries or Art. 6 (1)(f) GDPR for responding to other inquiries. The retention criteria in section 11 apply.

Other product feedback, support and error-reporting routes can keep the submitted content and account, product or diagnostic references in the relevant service database and/or copy them to a restricted Discord staff channel where this is stated at the point of collection. These routes are not the landing-page contact-form route and follow their stated purpose and the retention criteria in section 11.

Emails, support requests and other communications can contain personal information that you or another participant includes. We restrict access and delete or anonymize the communication when its purpose and the criteria in section 11 no longer apply. An erasure request cannot recall copies independently received, quoted or exported by another recipient or platform, and it does not override a statutory retention duty or the limited retention needed to establish, exercise or defend legal claims. Mail-provider copies and rotating backups disappear through their applicable deletion cycles rather than necessarily at the same instant as the active record. Please do not send passwords, payment credentials or unnecessary sensitive or third-party information.

To send transactional or legal email, such as account, service and security notices, purchase records, withdrawal or cancellation confirmations and notices concerning the Terms, we process the recipient address and locale, the relevant account, order or legal reference, the message content, dispatch time and status, and the delivery reference returned by the configured SMTP or mail-delivery system. This is not marketing. The legal bases are Art. 6 (1)(b) GDPR for contract administration, Art. 6 (1)(c) for required notices and records, and Art. 6 (1)(f) for secure delivery and proof of dispatch or receipt. The configured delivery infrastructure receives only the data needed to transmit the message; section 11 applies to Coflnet records, provider queues and copies.

The electronic withdrawal and cancellation functions process your name, the product and order, customer or subscription reference, and the email address needed for the receipt. For withdrawal, the part of the contract concerned is optional. For cancellation, the form additionally processes the selected termination type and requested end date; a reason is requested only for extraordinary termination. We store the declaration, its receipt time, a reference and the contact details supplied so that we can process it, confirm receipt and prove delivery. The function provides a durable confirmation immediately and also sends it by email. Access is limited to staff handling the request. Legal bases are Art. 6 (1)(b), (c) and (f) GDPR. The retention period is stated in section 11.

Calls to the number published in our imprint and withdrawal instructions are technically received and routed through Twilio. For this purpose, Twilio and the telecommunications providers involved process in particular the calling and called numbers, start time and duration, technical routing and connection data, and the audio signal transmitted during the call. Depending on the support workflow, the call may be connected live to a restricted Coflnet staff voice channel on Discord; in that case Discord processes the audio signal and technical data needed for the channel connection. An answered live call is not recorded as part of this routing workflow.

If a call is not answered, an announcement may offer the caller the voluntary option of leaving a voice message after the start signal. Before recording, the announcement discloses the recording, transcription, possible AI-assisted handling and the email alternative; a caller who does not want to be recorded can hang up. Only the message deliberately left afterwards is recorded by Twilio and made available to Coflnet for handling. We transcribe it on our own infrastructure. Where optional AI assistance is enabled, the transcript and support context necessary for the inquiry — not the audio recording — can be processed through the OpenAI API named in section 9 to classify the request and draft or automatically deliver an answer. An automated answer is identified as AI-generated. It does not make a legally significant decision, give a binding declaration concerning a contract or data-subject right, and identifies a route to human handling. The recording, transcript and answer are not used for general AI training. Raw audio is deleted after successful transcription and completion of handling, no later than 30 days; the support periods in section 11 then apply to the transcript and correspondence. Legal basis is Art. 6 (1)(b) GDPR for contract-related inquiries or pre-contract steps you request, otherwise Art. 6 (1)(f) GDPR (accessible and efficient support). Sections 9 and 10 describe the recipients, regions and transfer safeguards.

You can also communicate with us via a messenger, for example Signal or Discord, where you choose that channel or contact us there. For phone and messenger contacts, we process your phone number or messenger identifier and the content and time of the communication to handle your request. Business contacts and prospects are also handled through these channels, by email or by phone. We keep records of these contacts and of customer relationships — contact details, the chosen channel, the communication history and its contract or support context — in a CRM system that we operate ourselves on our own infrastructure; no external CRM provider processes this data for us. Legal basis is Art. 6 (1)(b) GDPR where the contact concerns a contract or steps you request before one, otherwise Art. 6 (1)(f) GDPR (managing our customer and business contacts); the retention criteria in section 11 apply. The respective communications provider additionally processes the communication under its own privacy notice.

4.4 Meeting scheduling (Calendly)

To let you book meetings with us, our website can embed the scheduling tool Calendly (Calendly LLC, Atlanta, USA). The widget is blocked until you choose to load it. Loading it can transmit your IP address, requested and referring URL, browser and device information, operating system, language, time zone or approximate location and online identifiers to Calendly and can allow Calendly to use cookies or local storage. If you book, Calendly also processes the name, email address, answers, chosen time and other details you enter. Legal basis for loading the third-party widget and its non-essential device access is your consent (Art. 6 (1)(a) GDPR and § 25 (1) TDDDG); legal basis for processing a booking you requested is Art. 6 (1)(b) GDPR. You can withhold or withdraw the loading choice and contact us by email instead. We retain booking details only while needed to arrange and follow up the meeting, unless they become part of a contract or legally retained business record. Calendly’s own notice describes its controller processing.

4.5 Cookies, local storage and analytics

The coflnet.com website itself does not use analytics or tracking cookies and does not embed advertising. Our products use cookies and browser storage (e.g. localStorage) primarily where strictly necessary to provide the service you request – in particular login sessions/authentication tokens and language preferences; such strictly necessary storage does not require consent under § 25 (2) TDDDG. Exceptions requiring consent (advertising and analytics cookies on sky.coflnet.com) are described in section 7.6 and managed via the consent banner shown there. Should we introduce further non-essential storage, we will ask for your consent first and update this policy.

If you sign up for a newsletter, we process your email address, chosen language and chosen product topics to send you news about our products — for example new features, new services and offers. Sign-up uses a double-opt-in process: you first receive a confirmation email, and we send the newsletter only after you confirm. We log sign-up, confirmation and unsubscription so that we can prove the consent. The legal basis is your consent (Art. 6 (1)(a) GDPR); keeping the proof is based on our legitimate interest (Art. 6 (1)(f) GDPR).

If you have bought something from us and Coflnet was the identified seller of that purchase (not a purchase concluded with a merchant of record under the Core Terms’ merchant-of-record clause), we may also send you email marketing for our own similar products without a separate consent (§ 7 (3) UWG). The legal basis for this processing is our legitimate interest in direct marketing to existing customers (Art. 6 (1)(f) GDPR, recital 47); you can object at any time with effect for the future (Art. 21 (2) GDPR), at no cost beyond basic transmission tariffs. We point this out when we collect your address and in every such email.

Every such email contains an unsubscribe link; you can also unsubscribe at any time via [email protected]. After you unsubscribe we send no further marketing; we keep only the proof of sign-up and unsubscription for as long as it is needed to demonstrate lawfulness. Delivery runs through the configured mail-delivery service named in section 9. Whether you open or click an individual email is analysed only if we said so at sign-up.

4.7 Crash reports and client diagnostics

If an app, extension or client crashes or hits an error, the client asks you first whether the report may be uploaded; nothing is transmitted without your confirmation. A report can contain error details, app version, device model and operating system, relevant settings and the most recent technical log lines. We use it only to investigate and fix the error. Reports are stored on our own infrastructure — as log or tracing data or, for larger volumes, as a file bundle in our object storage. Legal bases are your confirmation in the individual case (Art. 6 (1)(a) GDPR) and our legitimate interest in fixing errors (Art. 6 (1)(f) GDPR). The limit in section 4.1 applies to log and tracing data; we delete a file bundle once the reported error has been investigated, following the criteria in section 11. Usage analytics, where offered, run through our self-hosted Matomo instance (section 7.6); we do not use an external crash or analytics service.

5. User accounts and payments

Several products offer user accounts. Registration and login are handled via Firebase Authentication (Google Ireland Ltd. / Google LLC, USA), typically using your Google account or email address. We receive and store your user ID, email address, display name and, where applicable, profile picture URL. Legal basis: Art. 6 (1)(b) GDPR.

Where a Coflnet product asks you to accept a service agreement, that service records the internal user or contracting-party identifier, the exact agreement Root hash, its immutable descriptor and dependency versions, the selected contract language, server time of acceptance, source or channel, and the order or Service to which it applies. The one Root hash recursively identifies the exact shared and service documents; the accompanying evidence establishes who assented and how. These records administer contract formation and establish which text applied; they do not record consent to this privacy policy or to an optional processing purpose. Legal bases are Art. 6 (1)(b) GDPR and, for proportionate evidence and defence of claims, Art. 6 (1)(f) GDPR.

Paid plans and in-app purchases are processed by external merchants of record, app stores or payment processors. Depending on the product these include Lemon Squeezy, Patreon, Stripe, PayPal, Google Play and CoinGate. We do not receive or store full card or bank credentials; we receive transaction, subscription, tax-country and customer references needed to deliver the purchase, prevent fraud and meet accounting duties. The payment provider’s own notice applies to processing for which it is independently responsible. Legal bases: Art. 6 (1)(b) and (c) GDPR and, for proportionate fraud prevention, Art. 6 (1)(f) GDPR.

Where a service offers a free trial, promotion codes or plan switching, we also process the trial status (including to detect a repeated trial by the same person), redeemed codes and the plan and switch history. This serves contract administration (Art. 6 (1)(b) GDPR) and abuse prevention (Art. 6 (1)(f) GDPR).

Where you request immediate performance of a paid service or supply of digital content during a withdrawal period, we also record the exact declaration and wording version shown, your affirmative action and its server time, and the associated order, transaction and provider references and completion status. We use these data to perform the order and provide the legally required contract evidence (Art. 6 (1)(b) and (c) GDPR). This checkout record is separate from both agreement-Root acceptance and any optional privacy consent; the same screen can collect the required actions without turning them into one blanket acceptance.

Purchased CoflCoins and other customer-funded prepaid value do not expire under the Commerce and Programme Terms. Where its promotional-credit expiry schedule or the Core Terms’ inactivity-closure rule is operational, we process the last authenticated-login time, credit grant and use times, the recorded grant value and currency of promotional credit, active-service and unresolved-case status, notices sent, and any scheduled expiry or closure so that credit is not reduced and an account is not closed prematurely. We use these data to administer the contract, send the required notices, respond to objections and preserve evidence of the calculation. Legal bases are Art. 6 (1)(b) GDPR and, for orderly closure of unused free accounts, abuse prevention and defence of claims, Art. 6 (1)(f) GDPR. A timely login, pending Service gift or managed seat, pending or payable reward or applicable hold prevents a scheduled closure under those exact pinned terms.

If and when named-Service gifting under the Commerce and Programme Terms is enabled, we process the Purchaser’s and Recipient’s account identifiers; the selected Service and, where applicable, Expert, Config and licence version; CoflCoin price and recorded VAT-inclusive euro value; order, intended start and supply times; invitation, acceptance, rejection and expiry status and times; the agreement Root and service-specific licence version presented and any required Recipient acceptance; delivery and use status; notices; refunds, cancellations, payment reversals and chargebacks; and proportionate verification and fraud-review results. The early-performance declaration of a consumer Purchaser is recorded as described above. The order debits only the Purchaser’s balance. It neither credits CoflCoins to the Recipient nor creates a user-to-user balance-transfer record, because no balance transfer occurs.

The Purchaser selects an existing eligible Recipient account. Before acceptance or supply, processing of the Recipient identifier and invitation or Service notice is necessary to carry out the Purchaser’s order and is based on our, the Purchaser’s and ordinarily the Recipient’s legitimate interests in offering and securely delivering the requested gift (Art. 6 (1)(f) GDPR); the Recipient may reject an invitation that requires acceptance. Once the Recipient accepts or an already-agreed Service is supplied to that account, processing necessary to provide and administer it is based on Art. 6 (1)(b) GDPR. Processing required for invoices, tax and contract evidence follows Art. 6 (1)(c), and proportionate prevention of sham transactions, self-dealing, chargeback abuse and other fraud and the establishment or defence of claims follows Art. 6 (1)(f). The invitation or Service notice identifies the Purchaser and explains that Coflnet obtained the Recipient account selection from the Purchaser. Purchaser and Recipient receive only the other participant’s account display information and order status needed to identify and administer the gift. The Expert does not receive the Purchaser’s or Recipient’s contact details or account balance; transaction-linked information is disclosed only where necessary for a supported dispute, legal duty or claim.

Where a Friends Plan offers managed additional seats under the SkyCofl Service Terms, we process the Subscriber’s account identifier, plan, tier and seat capacity; the assigned profile or invited account identifier and the display information needed to identify it; the current invitation or assignment status and its creation, invitation-expiry and acceptance times; the agreement Root and seat-notice versions accepted by the invited person; and technical eligibility lookups needed to derive access from the Subscriber’s active tier. Before acceptance, the invitation and invited-account processing is based on the Subscriber’s and our legitimate interests in offering the requested private sharing function (Art. 6 (1)(f) GDPR); the invited person may reject it. After acceptance, processing needed to supply the seat to the participant and administer both accounts is based on Art. 6 (1)(b). Security, abuse prevention and defence of claims use Art. 6 (1)(f). The Subscriber sees only the participant’s account or profile display identifier and seat status, not the participant’s credentials, private settings, messages, purchased balance, payment data or individual usage. The participant sees the Subscriber’s display identifier and the plan information needed to understand the invitation and access. Access pauses while no qualifying tier covering the slot is active. An accepted assignment remains eligible to resume only during a seven-day renewal-continuity window and is due for automatic deletion when that window expires; scheduled cleanup or a relevant lookup removes it, and any cleanup delay does not restore access or permit later reactivation. Rejection, departure, owner revocation, refund, chargeback, final subscription termination or capacity loss deletes the affected assignment rather than retaining an inactive or automatically revivable seat.

For the euro-denominated referral, creator-code and report rewards described in the Commerce and Programme Terms, the separate reward ledger processes the recipient’s account or pseudonymous reporter identifier or stable case token; report-case or referral and qualifying-event reference; reward source; approved remuneration amount excluding VAT and before withholding; EUR currency, approval time, reviewer and reason; applicable payout threshold and claim or payout status; the settlement route chosen and its status (payout method or conversion into CoflCoins), the external provider fee displayed and deducted for a chosen payout method, and the euro value settled and CoflCoins credited by a conversion; immutable award and ledger identifiers; corrections and their reason; and any related notices or dispute. Each approved entry remains in the append-only ledger and is included in the period-end liability report regardless of whether the payout threshold has been reached; a later payout or correction is linked to that entry rather than replacing its award history. Where a referral programme uses this ledger, referral validation additionally processes the referring and referred account identifiers and the minimum status and timing needed to verify the disclosed conditions and prevent self-referrals or fabricated users. Where a creator-code programme uses this ledger, code validation additionally processes the creator’s account identifier and code and the minimum purchase reference, status and timing needed to verify the disclosed conditions and prevent self-purchases or creator-funded purchases. Report content and attachments are handled under sections 4.3 and 7 of this policy; submitting a report does not require the reporter’s civil identity, and no payee identity is collected merely because a report was received.

For an approved anonymous award, Coflnet gives the reporter a one-time private claim token and stores only its one-way hash with the award. The reporter or reporting channel must keep the plaintext token until it is used; Coflnet cannot recover it from the hash. Presenting the token links the award to the authenticated account and records the account and claim time. The token and hash are used only to prevent an unauthorized or duplicate claim and are removed once they are no longer needed for that purpose, including through the account-erasure cleanup path after a completed claim. The award and financial ledger entry follow their separate accounting retention rule. Staff or service actor identifiers and action times are recorded for approval, correction, tax review, rejection and payment so that each financial action is attributable and reviewable; staff-facing processing is also covered by the applicable internal personnel notice.

Only when a recipient requests payout do we process the legal name, address, country and tax residence, private or business capacity, tax identifier, VAT status and identifier where applicable, proportionate identity evidence, beneficial-owner information where required, invoice or self-billing data, payout destination and provider reference. The payout and accounting record also contains the approved remuneration, separately chargeable VAT, reverse-charge treatment, withholding type and amount, net cash amount, payment date and accounting reference. These data are used to administer the program and remuneration agreement (Art. 6 (1)(b) GDPR), meet accounting, tax, withholding and authority-reporting duties (Art. 6 (1)(c)), and proportionately prevent duplicate awards, fraud and unauthorized payout and establish or defend claims (Art. 6 (1)(f)). We cannot pay an anonymous recipient or proceed while legally required fields are missing. Payout onboarding data is not used to disclose a reporter’s identity publicly or to the referred user.

Where a recipient is under 18, the Commerce and Programme Terms let that recipient either have the required legal representative approve the payout or keep the approved award in the ledger until they turn 18. For the first route we process the representative’s name and contact details, their relationship to and authority for the recipient and the record of their approval, in order to verify contractual capacity and lawful payment (Art. 6 (1)(b) and (c) GDPR, and Art. 6 (1)(f) for proportionate verification and proof). For the second route we process only the recipient’s recorded choice and the date from which payout becomes possible. Representative data is used for that verification only; it does not make the representative the owner of the award and is not an optional data-protection consent.

Enforcement of measures and blocklist. Where an account is suspended or terminated for cause, or a new contract is refused, under the Core Terms’ fair-use and enforcement rules, we keep an internal blocklist record to enforce that measure and prevent its circumvention. It contains the account and authentication identifiers and email address concerned, payment-processor customer or transaction references and, where they formed part of the documented abuse, IP addresses and device or session identifiers, together with the measure, its documented ground and its date. We use these data only to enforce the measure, to check new registrations, orders and payments against it, to prevent fraud and abuse, and to establish and defend legal claims. Legal basis: Art. 6 (1)(f) GDPR — our legitimate interest in protecting our services, users and assets against abuse, fraud and the circumvention of enforcement measures. A blocklist entry is retained only for as long as it is needed to enforce the measure and is reviewed for continued necessity at least every twelve months; entries that are no longer necessary are deleted. A match does not by itself produce a final adverse decision: the affected person can use the human-review route in the Core Terms or object under Art. 21 GDPR via the contact in section 1, and a human reviews the documented basis.

6. Push notifications and messaging integrations

Where a product offers notifications, we process the delivery identifiers required for them: Firebase Cloud Messaging (FCM) / Apple Push (APNs) device tokens, Discord user/channel IDs and webhook URLs, or – if you actively connect them – WhatsApp or Telegram identities. Notifications are only sent for events you configured (e.g. saved search matches, bot status, transcription results). Legal basis: Art. 6 (1)(b) GDPR. You can disable notifications at any time in the respective product or your device settings.

7. Product-specific processing

7.1 Spables (audio transcription)

We process the audio recordings you upload or send in (including via WhatsApp/Telegram/Discord integrations), resulting transcripts, your email address and optional profile data (e.g. postal-code region for dialect features). Audio is stored encrypted in Cloudflare R2. Transcription is performed primarily on our own infrastructure. Where peak-capacity processing is available, RunPod Inc. can receive audio temporarily only after the required data-processing and international-transfer safeguards are in place for the selected region. Text post-processing may use the OpenAI API. OpenAI does not use API inputs to train its general models by default. Its default API abuse-monitoring logs can contain inputs and outputs and are ordinarily retained for up to 30 days, but OpenAI states that longer retention can occur where required by law or reasonably necessary to protect its services or a third party from harm; an approved shorter or zero-retention configuration can apply subject to its documented exceptions. See sections 9 and 10.

We use a recording, its transcript and coarse dialect-region data to develop, train, evaluate or retrain commercial German-dialect automatic-speech-recognition (ASR) models only after a separate, affirmative and documented account choice for future contributions. While it remains active, that choice applies to later contributions submitted through the supported contribution flow; we snapshot it on each accepted contribution, and you can change it before a later submission. That option also covers deploying the resulting ASR models through Coflnet-hosted services or APIs and licensing or delivering model software to customers for operation on their own or on-premises infrastructure, whether the offering is paid or temporarily free. Model customers receive the model software and documentation, not raw contributions, contribution-level audio or transcripts, or the contributor mapping. This permission does not cover speaker identification, text-to-speech or voice cloning, advertising, or training unrelated third-party models. Access to a free plan or an unrelated feature is not conditioned on training consent. Where a contribution reward program is offered, its participation agreement governs the reward and operational licence (Art. 6 (1)(b) GDPR); explicit consent remains the basis for any processing of special-category voice content. A contribution to this workflow may contain only the contributor’s own voice; the age rules in section 16 apply.

A prospective contribution accepted under this long-term training option has no arbitrary fixed calendar end date, but it is not retained without a purpose. We keep its identifiable raw and derived training records only while Coflnet actually trains or retrains the stated commercial German-dialect ASR models and the contribution remains necessary for that training operation or directly related evaluation. Merely maintaining or deploying an already trained model is not enough. We document necessity reviews at appropriate intervals and delete those records within 30 days after that purpose ends. You may withdraw training consent at any time through the supported account control or by contacting us. We then stop using the identifiable contribution for future training and delete its identifiable raw and derived training records within 30 days unless a legal duty independently requires a limited record. Withdrawal does not affect the lawfulness of processing before it. Training does not by itself make a model anonymous. If an affected model can still reasonably identify you or reproduce personal data from your contribution, we assess and implement measures appropriate to that risk, which can include excluding the dataset, restricting or filtering output, machine unlearning, retraining or deleting the affected artefact. Only parameters and statistics that a documented assessment shows to be anonymous fall outside a personal-data erasure request. We do not accept another type of training contribution unless it has an equivalent notice, receipt and withdrawal path.

A separate, unselected account control may allow you to publish future contributions submitted while that choice remains active in the public Dia word archive. We snapshot the active choice on each accepted contribution, and you can change it before a later submission. This public-purpose consent is independent of commercial ASR consent: you may choose either, both or neither, and withdrawing one does not by itself withdraw the other. A word page can make the recording, word or transcript, submitted meaning and coarse region publicly accessible worldwide. It does not display your email address, account identifier or exact postal code; a name or pseudonym is shown only after a further, separate attribution choice. A page without a displayed name is not necessarily anonymous because listeners may still recognize your voice. Public users can listen to and access the page, and search engines or other persons can technically copy, link to or cache public material. Coflnet’s public-page grant does not by itself permit third parties to use the recording for AI training, speaker identification, text-to-speech or voice cloning, and it is not an open-dataset licence. Any later download or broader third-party reuse option requires a separate, specific permission and licence. If you withdraw the public-purpose consent, we remove the material from the pages and future releases we control and delete public-purpose raw and derived records within 30 days, unless the same contribution remains lawfully and necessarily retained under your independent training consent or a legal duty. We take reasonable steps concerning recipients known to us where required, but cannot guarantee deletion of a copy independently made from a public page.

If the Dia project is transferred as an operating project to a corporate successor, the applicable project licence and the associated purpose, withdrawal and deletion duties may transfer only to the extent permitted by the contribution agreement and applicable law, and the successor may use a contribution only for the same purposes the contributor selected. We provide the required notice identifying the new controller, its contact details and material changes, and request renewed explicit consent where the change in controller, context or processing makes that necessary. The contribution control is not advance consent to an unidentified future controller, a new purpose or use of the raw contribution elsewhere in an acquirer’s business.

Important: Recordings can reveal special categories of personal data, such as health information mentioned in speech. Where Coflnet determines that processing, we separately request explicit consent under Art. 9 (2)(a) GDPR. Outside the training-contribution workflow, transcription of another person’s voice is permitted only where the uploader has an applicable legal basis and provides the required information; it is not treated as that person’s training contribution. Business customers may upload third-party recordings only under the Art. 28 DPA described in section 12.

Outside the contribution purposes above and the evidence-retention mode below, temporary audio is deleted no later than 90 days after upload; the stricter rule below applies to zero-retention mode. Export archives and download keys are deleted after 30 days, and case reports and ordinary training archives after 365 days. If you deliberately attach a recording to an error report, the submission path identifies the regression-test purpose and retention. The Core test-file clause then permits use only to reproduce the error, verify the correction and regression-test it while the affected function remains maintained. A separate, unselected choice may allow you to contribute the recording to the training workflow above; handling or fixing the report and consideration of a report award under COMMERCE-5 do not depend on that choice.

You may withdraw the test-file permission through the report or support channel. We then delete the sample once the error is resolved, no later than closure of the report; if it was also contributed for training, the request also withdraws that contribution. The rights in section 13 remain unaffected. Legal bases are Art. 6 (1)(b) GDPR for the report and requested test-file permission and, after correction, Art. 6 (1)(f) GDPR for regression testing; where special-category data can be revealed, separate explicit consent is obtained before retention. Existing recordings are not enrolled retroactively.

Content you deliberately retain remains until you delete it or the account, subject to the purpose-bound periods above and legal duties. Account deletion covers recordings, derived content, reports, exports, integrations and account metadata. For 90 days after completed deletion, Spables retains a keyed pseudonymous suppression marker and minimal deletion receipt to prevent stale writes from recreating the account; it then expires automatically. Processor-held copies and backups follow sections 9–11.

Planned table-related retention modes. With the planned release, Spables will offer two alternative modes for future table-related business recordings, selected before recording begins. Until release, a visible control does not create a retention commitment. In Zero Retention mode, Spables processes the recording and content derived from it only transiently to perform the requested transcription, structuring and delivery. On completion or abort, that content is deleted from server-side Spables processing and is retained neither as account content nor in backups. The client application may retain the recording locally on the device for no more than seven days so that the user can review the result and, on noticing an error, deliberately upload the recording with an error report for correction. The local copy is not transmitted to Coflnet automatically and is deleted when the seven-day period expires. Only submission of the error report starts the server-side processing disclosed there under the error-report rules described above. The mode will be enabled only when every processor used for that route also operates without content retention. “Zero Retention” does not cover this transient local copy, data stored by the recipient of a user-selected integration or necessary account, billing and content-free security metadata subject to the periods stated elsewhere.

In the alternative Evidence Retention mode, the recording, confirmed table entry and data needed to associate them and verify integrity are stored encrypted, access-restricted and protected against unlogged alteration for the preselected, documented period of up to ten years; corrections are appended traceably rather than silently overwriting the original evidence. The confirmed structured record is the primary record. The recording additionally documents the origin and content of the spoken declaration and, together with the associated record and time, identity and integrity data, can serve as supplementary evidence. It is not a qualified electronic signature and does not replace any legally required written, electronic or text form. Ten-year retention is not legally required for every recording: before choosing it, the controller must define the specific evidentiary purpose, legal basis and necessary period, inform every recorded person before recording begins and document the authority to record — ordinarily their prior agreement; covert recording is not permitted. Where processing is performed for a business customer, its documented instructions and the Article 28 DPA described in section 12 apply.

7.2 Advanced Notification Engine (ANE)

We process your account data, saved searches/filters, notification settings, subscription tier and match history to provide deal search and alerts. Product and listing data is analyzed with self-hosted language models; no listing content is sent to external AI providers for this purpose.

ANE indexes publicly available marketplace listings (e.g. eBay, Kleinanzeigen, Vinted). These listings can contain personal data of sellers (e.g. username, approximate location, contact details shown in the listing). We process this data as described in section 8 (“Data obtained from public sources”).

The optional browser extension contributes public marketplace data only after you actively enable crowd sourcing; it is off by default. It sends the public listing URL and the visible title, price, currency and condition needed to identify the listing. It does not send account or message pages, a browser-wide history or raw page content. A separate active mode can open disclosed marketplace task pages only after additional confirmation. You can switch either setting off at any time. The extension stores its login token locally (§ 25 (2) TDDDG – strictly necessary). The mobile app uses Firebase for login and push notifications.

The in-product ANE deletion function clears the ANE profile fields, saved searches and alerts, push-notification token and match history. The shared Coflnet authentication identifier and data held for another Coflnet service are outside that local function; send one request to the address in section 1 for erasure across additional Coflnet systems.

7.3 Toduen (business dashboard)

If you connect third-party services (e.g. Stripe, Google Analytics, YouTube, Shopify, GitHub or Patreon), we store the OAuth access and refresh tokens or API keys you grant and retrieve account metrics to display them to you. We protect these credentials, restrict access to the integration service and use them only within the scopes shown by the provider.

Disconnecting removes our local credential copy and the associated cached metrics. Where a provider supports automated revocation, we also attempt it. A failed or unavailable provider-side revocation does not prevent local deletion; instead, we tell you that you must revoke the connection or rotate the key in that provider’s security settings. This manual step can be necessary for API-key integrations and providers that do not offer a usable revocation function.

Account erasure removes the Toduen account, integrations, cached metrics, public shares and settings. Records held independently by a connected provider must be managed with that provider; backups and records subject to a legal retention duty follow sections 9–11. Legal basis: Art. 6 (1)(b) GDPR. We also process email address, locale, country and an IP-derived region for account security and localization.

7.3a Prufi (CAD manufacturability analysis)

When you request a Prufi analysis, we process the CAD file, its original filename, the material selection and the browser language needed to return the requested manufacturability checks. The analysis runs on Coflnet-controlled infrastructure; the CAD file is not sent to an external AI provider and is not used for model training. Legal basis is Art. 6 (1)(b) GDPR (providing the analysis you requested).

The upload is written under a random name to non-persistent temporary storage in the analysis container. Request cleanup deletes it after processing, including after an ordinary error; an hourly cleanup limited to Prufi files removes abandoned temporary files older than one hour. We currently retain neither the CAD file nor the result as an account record.

If you deliberately attach a CAD file or analysis to a bug report, the submission path identifies the test purpose and retention. The Core test-file clause and Prufi confidentiality rules permit us to keep it only to reproduce and correct the reported error and regression-test the correction while the affected check remains maintained. Any report award is decided separately under COMMERCE-5; deleting the optional file does not by itself reverse an approved award. Legal bases are Art. 6 (1)(b) GDPR for handling the report and requested test-file permission and, after correction, Art. 6 (1)(f) GDPR for regression testing. You may withdraw the permission through the report or support channel; we then delete the file once the error is resolved, no later than closure of the report.

Diagnostic logs can contain the random temporary filename and, after an internal error, analysis output, but not the original upload filename; section 4.1 states their period. Any future retention for another purpose, such as showing past checks or general improvement, will be disclosed before upload and remain subject to the pinned Core and Prufi confidentiality terms and section 11. A separately accepted enterprise or paid-plan rule can provide stricter retention or confidentiality. Infrastructure providers process request and connection data as described in sections 9 and 10.

7.4 CDM (container logistics)

CDM is intended exclusively for business customers. Coflnet activates an operational company workspace for customer-controlled personal logistics data only once the applicable versioned CDM order and service schedule, an Art. 28 DPA and the subprocessor information are in force; until then the workspace remains disabled for such data. Once activated on that basis, the customer determines the purposes and permitted use of site addresses and coordinates, orders, delivery photos, electronic signatures and signer/device/location evidence, and real-time driver or vehicle positions used for dispatch and arrival estimates; the customer is controller and Coflnet is processor for those data. If the customer configures Google Maps route calculation, start and destination coordinates are disclosed on its documented instructions.

Coflnet is controller only for its own CDM customer-account, billing, service-security and compliance processing, including the business contact, contract and invoice records needed to supply and secure CDM and meet applicable recordkeeping duties. Those purposes follow Art. 6 (1)(b), (c) and, for proportionate security and legal-claim evidence, (f) GDPR. Section 12 applies.

7.5 IdleMine

IdleMine is operated solely by Coflnet GmbH. Coflnet determines the purposes and means of this service and is the controller for its user data. IdleMine is a Coflnet brand, not a separate controller. Privacy requests concerning IdleMine can be sent directly to [email protected] or through the other contacts in section 1.

IdleMine processes your Discord user ID and roles, bot interactions, private Discord channel and webhook identifiers, the Minecraft account name, server address, version and settings you configure, instance and host status, assigned-host and proxy identifiers, and the Microsoft/Xbox authentication data needed to run the bot. If you enable chat or whisper forwarding, content visible to the bot is sent to your Discord channel and is subject to Discord’s controls.

Active configuration and authentication material are retained while required to run the instance. Instance deletion is recorded in a durable cleanup job before the service is changed. The job disables the instance, clears its Coflnet settings and connection authorizations, removes the primary instance record, instructs the assigned host to delete its configuration and Microsoft/Xbox caches, and retries until the host acknowledges completion. Its status remains pending while a step has not converged. Coflnet-controlled private channels or webhooks created solely for the instance are removed where ownership and safe deletion can be established. Discord resources outside Coflnet’s control, third-party webhooks, disconnected or former hosts, technical logs and backups can require documented manual follow-up; a third-party resource may also have to be revoked at its provider. Billing records, narrowly required security evidence and rotating backups follow section 11.

7.5a Other Coflnet-operated Minecraft hosting

Where a distinct Minecraft-account hosting product is ordered outside the IdleMine offer, Coflnet is also controller for that service. We process Coflnet and Discord account identifiers, Minecraft name and UUID, Microsoft/Xbox device-authentication and token-cache data, server and instance settings, assigned host and proxy identifiers and status, private-channel and webhook identifiers, subscription references and necessary security and technical logs. Chat or whisper content is processed only if forwarding is enabled. This is used to provide and secure the service (Art. 6 (1)(b) and (f) GDPR); billing records additionally follow Art. 6 (1)(c). Microsoft, Discord and the assigned infrastructure operator receive the data needed for their part of the service; depending on the assigned instance, processing can occur in the EU or USA under section 10.

Active configuration and authentication material are retained while required to run the instance. Instance deletion is recorded in a durable cleanup job before the service is changed. The job disables the instance, clears its Coflnet settings and connection authorizations, removes the primary instance record, instructs the assigned host to delete its configuration and Microsoft/Xbox caches, and retries until the host acknowledges completion. Its status remains pending while a step has not converged. Discord resources whose ownership cannot be established safely, third-party webhooks, disconnected or former hosts, logs and backups require documented manual follow-up; a webhook outside Coflnet’s control may also have to be revoked on Discord. Billing records, narrowly required security evidence and rotating backups follow section 11. The order or activation flow provides this product information before authentication data is collected.

7.6 SkyBlock tools (sky.coflnet.com, BazaarPro at pro.skyblock.bz and the SkyCofl mod)

Our SkyBlock services process publicly available game data of the Hypixel SkyBlock API (e.g. auctions, bazaar data, player UUIDs) to provide market analysis. In addition, the following applies to registered users:

Account: Login via Google (email address, name, profile picture); optional linking of your Minecraft account (UUID).
BazaarPro account and product data: BazaarPro supports email/password, Google or Discord login and processes the resulting email address, username, password hash or provider identifier, session and reset-token data, subscription, trial and promotion status, tracked items and alert settings, read status, dashboard preferences and a Minecraft UUID where you request player-specific tasks. Passwords and reset tokens are not disclosed to analytics. Task-method suggestions submitted through BazaarPro additionally contain the authenticated account/email reference, suggestion type, title, method details and observations that you deliberately provide. They are sent to Coflnet’s Feedback service for human review and possible inclusion in the task catalogue under the Core Terms’ feedback licence; do not include another person’s private data. Any contribution reward is governed by the versioned programme information shown at submission and the Commerce and Programme Terms, not by acceptance of this Privacy Policy. Legal bases: Art. 6 (1)(b) GDPR for the account, authentication, subscription, alert and task functions you request, including the review of a suggestion you submit; Art. 6 (1)(c) for the statutory billing and tax records of a subscription; and Art. 6 (1)(f) for proportionate abuse, fraud and security protection of the login, session and reset paths and for maintaining the task catalogue. BazaarPro displays Coflnet as provider and links the applicable agreement Root, this policy, the withdrawal and cancellation information and the imprint before an order is submitted.
Payments (CoflCoins, Premium): processed via Stripe, PayPal, Lemon Squeezy, Google Play or CoinGate; for VAT determination and fraud prevention we store your country, postal code and IP address together with the transaction (Art. 6 (1)(b) and (c) GDPR, statutory retention periods apply). Referral relationships (inviter/invited) are stored for the referral program.
Expert Config distribution and updates: if an admitted Expert publishes a SkyBlock configuration, we process the Expert’s Coflnet and Minecraft account identifiers, public Minecraft name, the configuration settings and filter criteria, name, price, version, change notes, publication and update times and listing status. The listing displays the Expert’s public Minecraft name and Config metadata. Paid acquisition is currently disabled: refusing a non-zero-price acquisition creates no payment or creator-fee transaction. For a Config made available for free, we record Recipient and Expert identifiers, acquisition and licence version and delivery/update status so the Recipient can receive the Config and supported updates. If the paid Expert Program is activated under the already-agreed Terms, onboarding also processes legal name, address, date of birth and identity evidence, tax residence and identifier, private or business capacity, VAT status and identifier, beneficial-owner and residence evidence where required, self-billing and payout details and the history of status checks. For a 16- or 17-year-old Expert, we also process each required legal representative’s or guardian’s identity and contact details, relationship to and authority for the Expert, approval records, confirmations of instructions, and any required business-registration, public-authority or court-approval evidence. The representative’s data is used to verify the minor’s contractual capacity and lawful participation, not as optional data-protection consent or to make the representative the owner of the Expert’s fee. For each activated paid acquisition, including an eligible Service gift, we record Purchaser, Recipient and Expert identifiers, Config and licence version, invitation and acceptance status where applicable, CoflCoin price and euro valuation, Net Receipts and VAT treatment, pending and available creator-fee calculations, invoices or self-billing statements, German or other withholding-tax treatment, set-off or payout instructions, refunds and reversals. The additional named-Service gift records and legal bases are described in section 5; no CoflCoins are credited or transferred to the Recipient or Expert. A configured identity, payout or self-billing provider receives only the data needed for its stated check or transaction; competent tax or other legally responsible authorities receive data where a filing, withholding, approval or disclosure duty applies. Reports can add moderation, fraud, security or intellectual-property evidence. We use these data to operate distribution, licensing, updates, onboarding, remuneration, support and remedies (Art. 6 (1)(b) GDPR), meet tax and other legal duties (Art. 6 (1)(c)) and proportionately verify capacity and representative authority, prevent abuse, secure the Service, moderate listings and establish or defend claims (Art. 6 (1)(f)). A Config must not contain access credentials, secrets or third-party personal data that is unnecessary or unlawful for its disclosed function. Public listing data is kept while the Config is offered; acquired versions and licence, delivery and update records are kept while needed for the Recipient relationship and afterwards only for applicable claims or legal duties; onboarding, representative-approval, creator-fee, withholding, payout, invoice and tax records follow the applicable statutory recordkeeping period.
Advertising: sky.coflnet.com shows advertising via NitroPay. NitroPay operates its own consent management platform (CMP) in which you choose whether personalized advertising and associated storage are allowed. Without consent, an ad may be shown only where it can be delivered without non-essential device access or personalized processing; otherwise the advertising integration remains blocked. Details: NitroPay privacy policy. Legal basis for personalized advertising and non-essential device access is your consent (Art. 6 (1)(a) GDPR and § 25 (1) TDDDG), revocable in the CMP at any time.
Analytics: SkyCofl and BazaarPro can use our self-hosted Matomo instance (track.coflnet.com, data stored on our servers in Germany, no disclosure to an external analytics provider) to understand aggregate page and feature use. Analytics is off until you approve it. No analytics request is sent before you enable the “Analytics” control; the control is unticked by default, and declining it or ignoring it keeps analytics disabled without any effect on the Service. If you approve it, the clients disable Matomo cookies, do not send an account identifier, email address, search text or item name, and limit events to the page/function and to non-personal categories or measurements needed for aggregate statistics; the Matomo server shortens IP addresses before analytics storage. Legal basis is your consent under Art. 6 (1)(a) GDPR, and § 25 (1) TDDDG for any storage of or access to information on your device that analytics involves. You can withdraw your consent at any time with effect for the future through the same control or the contacts in section 13; the withdrawal does not affect the lawfulness of processing before it. The control stores your choice locally so it can be honored — that storage is strictly necessary for the function you requested (§ 25 (2) no. 2 TDDDG) and happens whether you approve or decline. A configuration that would use device fingerprinting, a visitor identifier or otherwise identifiable analytics remains blocked until it has its own disclosed basis. The non-standardized “Do Not Track” header is not represented as an objection or consent-withdrawal mechanism; Global Privacy Control is addressed in section 17.
Mod data collection (SkyCofl): if you use our Minecraft mod, you control in the privacy settings which in-game data the mod transmits (e.g. inventory/chest contents, chat with filter, scoreboard, tab list). This data is associated with your Minecraft UUID to provide the analysis features you enable. You can disable each category in the settings. Account deletion covers supported SkyBlock services; payment and tax records and data required to honor an objection or defend a legal claim are retained only for the applicable period. Send one request to [email protected] for erasure across SkyBlock services.

The authenticated SkyCofl account-erasure function runs the supported downstream cleanup before removing the central account link. It removes linked player state and settings, Friends Plan seat assignments held as owner or participant, spent one-time reward claim-token hashes and referral relationships that have no reward-ledger link. Purchase and transaction records and reward-ledger or payout records remain only for the applicable remuneration, tax, accounting, compliance, dispute or legal-claim period. If a downstream cleanup connection is not configured or rejects the request, the response lists that data as not cleaned rather than claiming complete erasure; the contact in section 1 remains available for follow-up across further services.
Public Flipper Chat (SkyChat): messages intentionally sent to Flipper Chat are public to connected chat participants. They are additionally mirrored publicly to a channel on the Coflnet Discord server, where they can be read without using the mod. We store the message body, Minecraft UUID, sending client and timestamp to distribute and moderate the chat. Its two concise rules are “Be nice” and “Do not advertise something nobody asked for”. Until the account acknowledges the current rule notice, the mod displays both rules with each message; the account’s existing tutorial setting then stores the versioned rule-notice identifier. This is a service setting retained with the account, not acceptance of this Privacy Policy, optional privacy consent or general Terms acceptance. Selecting a message currently starts the generic diagnostic-report path. Its acknowledgment confirms only that diagnostic submission; it is not a durable SkyChat moderation-report receipt and does not mean that action was taken. A moderation outcome or action notice is not yet provided. Automated filters and human moderators enforce the rules; reports, mutes and proportionate abuse evidence are processed for moderation and security (Art. 6 (1)(b) and (f) GDPR). A mute initially contains the quoted message and free-text reason for short review; those two fields become due for redaction after 96 hours and are removed by the next successful ten-minute sweep; an outage can delay completion. The remaining sanction record contains the affected and acting player identifiers, time, duration, status and normalized rule used for the current repeat-sanction calculation and is still personal data; it becomes due for deletion when the sanction has been expired for 400 days and is removed by the next successful ten-minute sweep. SkyChat sends only the affected and acting player names—or their UUIDs if name lookup fails—normalized rule and duration through Coflnet’s event infrastructure to the restricted Discord moderation channel; it no longer includes the quoted message or free-text reason. These fields remain personal moderation data. The public Discord mirror is part of that public distribution: mirrored copies are not deleted automatically and remain in the mirror channel by default; they are removed when a verified deletion request covering them is processed. The current diagnostic records can include the message, account/player and request/session identifiers, settings and connection context. They are personal data where linkable and follow the seven-day limit in section 4.1. After a verified request, the account-facing service can invoke SkyChat’s protected deletion path for messages stored under the linked UUID; on request we also delete the account’s messages from the Coflnet-controlled Discord mirror channel. A message already delivered, quoted, screenshotted or independently retained by another participant or platform cannot necessarily be recalled. Other moderation evidence follows its separately documented schedule; the current SkyChat sanction row has no legal-hold override and is deleted under the 400-day rule. Do not post personal, sensitive or confidential information about yourself or another person.
Notifications: device push tokens (FCM), Discord webhooks you configure, and in-game notifications.
Leaderboards: from public auction data we compute weekly, publicly visible leaderboards (e.g. flipping profit, purchase speed) that show player name/UUID and the score. Entries expire automatically (typically within 20 days). Legal basis: Art. 6 (1)(f) GDPR (community and competition features based on already-public game data). You can opt out at any time – for the buy-speed board directly in-game via /cl buyspeedboard disable (this also removes current entries), or for any leaderboard via [email protected]; opted-out players are excluded from future boards.
AI support assistant (currently disabled): the gated implementation can process a question, submitted page path, recent conversation rounds and relevant read-only tool results to answer a voluntary support request. Coflnet separately uses an account-based or pseudonymous IP identifier for rate limiting and does not send that identifier to the model provider. The assistant will remain disabled until the exact provider and model, the parties’ GDPR roles and legal bases, any required data-processing agreement, every processing country and applicable Chapter V transfer safeguard, the provider’s training use, and definite provider retention/deletion terms have been documented. Ordinary support use will not activate a provider’s separate general-model training. If a selected provider uses submitted content for its own training, that purpose requires a separately lawful, transparent and genuinely optional design and a support route that does not require that training use. Before submission, the input will identify itself as AI and show the actual provider, model, processing country, content sent, training use and provider/local retention. While disabled, the routes neither call a model provider nor store a conversation. Coflnet’s eventual conversation storage remains capped at 24 hours. A deletion control and non-AI support route remain available. AI answers can be wrong and must not be the sole basis for an important decision.

7.7 Dia (dialect recording and research apps)

The Dia apps (e.g. long-form dialect transcription and the “HeOida” voice assistant) run on the same backend as Spables; section 7.1 applies accordingly. The contribution-specific commercial-ASR and withdrawal workflow, and where offered the independently optional public word-page control, apply only to authenticated dialect recordings submitted prospectively through those controls. Public-page consent does not turn a contribution into an open dataset. Corrected long-form transcripts and wake-word samples are not accepted for training or publication until they have an equivalent contribution notice, receipt and withdrawal path. Assistant conversations are processed to answer your request and are not treated as contributions.

7.8 Twt – “the women translator”

Twt is an entertainment and communication-aid service: it uses AI to suggest possible interpretations of messages you enter. The submitted text and a system prompt selected for the chosen language are sent to the OpenAI API; the Firebase account identifier and Coflnet conversation identifier are not included in that API request. OpenAI does not use API inputs for general model training by default; its default abuse-monitoring retention and exceptions are described in section 7.1. Coflnet stores the submitted text, generated options, language, pseudonymous user and conversation identifiers, timestamps and any selected option to provide prompt history. This history is retained for up to 24 months, and you can delete it sooner using the account deletion function. We also evaluate stored prompts, the generated options and which option was chosen in order to improve the quality of the suggestions. Identifiable raw prompts are evaluated for this purpose only within 90 days of submission; after that, the evaluation uses exclusively aggregated or otherwise de-identified derivatives, and derived records that no longer relate to a person can be kept after the underlying history is deleted. Prompt content is not used to train AI models and is not used for selection profiling; a training use would only be introduced with a separately stated legal basis and, where it relies on consent, with an active, revocable opt-in. Legal basis: Art. 6 (1)(b) GDPR for providing the service and the prompt history, and Art. 6 (1)(f) GDPR (our legitimate interest in improving the service) for the evaluation described above — you can object (section 13). Do not enter information that identifies another person. Interpretations can be wrong and must not be treated as facts or as the sole basis for important decisions.

7.9 CTW – CollectTheWorld

We process your account data (anonymous device credential or Google login; for a connected Google account: name, email address and locale), account and submission identifiers, object or challenge label, object photos and descriptions, necessary service-generated technical metadata, and challenge progress, streaks and leaderboard entries. CTW’s disclosed core purpose is gamified collection and quality-checking of object images and descriptions to develop and maintain machine-learning datasets. The account-linked submission, validation and progress records are personal data even where the photograph itself shows only an object. Before storage, the CTW server decodes and re-encodes an accepted image and thereby removes embedded source-file metadata, including EXIF location data. The normalized image file is stored on the configured S3-compatible object storage; its description and submission record are stored in the CTW application database. The current OpenAI validation receives only the object or challenge phrase embedded in an instruction prompt, to classify whether it is a photographable real-world object and assign language and category. It does not receive the image bytes, description, account identifier or submission identifier. OpenAI’s API handling is described in section 7.1. Please photograph objects, not people, and remove names, faces, addresses, documents and other identifying details from the frame and description.

Receiving, validating, storing, quality-checking and including the submitted object contribution in datasets for CTW’s disclosed core purpose are necessary to perform the CTW participation contract (Art. 6 (1)(b) GDPR). Before the first upload under a contribution-agreement version, CTW requires one affirmative acknowledgment of the localized contribution text and records its version, text hash, language and server time. This is evidence of the separately recorded CTW contribution contract and licence described in CTW-5 and COMMERCE-6, not acceptance of this Privacy Policy and not consent to optional processing. Advertising and non-essential tracking choices remain separate. No existing contribution is retrospectively enrolled by a later acknowledgment. The contractual basis does not extend to unrelated profiling or advertising, disclosure or licensing to an unrelated recipient, or a materially different later use. A separate optional purpose occurs only after the affirmative, specific choice required for its legal basis; withdrawal stops future consent-based use. Account deletion is available in the app and starts after the displayed three-day cancellation period. Processor-held copies, backups and legally retained evidence follow sections 9–11.

CTW’s leaderboard service keeps the internal account identifier, score and a leaderboard label for up to 30 days. Those records are pseudonymous personal data. The public CTW response never returns the internal identifier. Where a user has made no leaderboard-profile choice, the score is displayed as “Anonymous”; a chosen name and avatar are displayed only after the user affirmatively enables them. A separate visibility switch can suppress the entry, stop new leaderboard writes and request deletion of scores from the active 30-day window without disabling contributions, progress or rewards. We process this optional community feature on the basis of our legitimate interest in a privacy-preserving gamified leaderboard (Art. 6 (1)(f) GDPR); the separate switch and the contact in section 1 provide an objection route.

CTW re-encodes accepted images to remove source metadata, restricts image access to the uploader and authorized administrators, and does not provide a public image-browser endpoint. These safeguards do not guarantee that an image contains no personal data: the upload can still depict or describe another person, and the uploader’s contribution contract is not a legal basis for that person’s data. Such content must not be submitted. A depicted person or other affected person can report an image through the contact in section 1 without having a CTW account; after the minimum necessary verification, an authorized administrator can restrict or delete the identified image. When an incidental third-party image is identified or reported, we restrict and remove it from further use unless a separate legal basis and the safeguards required for that processing have been documented.

7.10 Vereiner (club management)

Vereiner is used by clubs and associations to manage their organization. Where a club determines how member data is used and Coflnet processes it only on the club’s documented instructions under an Art. 28 DPA, the club is controller and Coflnet is processor for that member data. Member data must not be uploaded before that agreement is in force. Data can include member contact and payment details, membership status, event registrations, club news and images and, if connected by the club, WhatsApp messages and calendar synchronization. Club administrators also have a Coflnet account (section 5). Members may direct requests to their club; we support the club where Coflnet processes the data on its behalf.

7.10a SongVoter (party song voting)

SongVoter (songvoter.party, Android app) lets groups collect and vote on songs for a shared party queue. We process your account data (Google sign-in: name and Google account identifier; alternatively an anonymous device credential or a Spotify sign-in with your Spotify account identifier and display name), the parties you create or join, invite codes, party memberships, song suggestions, up- and down-votes, playlists you create in SongVoter and the technical song metadata needed to display and play entries (title, artist, thumbnail, duration and the Spotify or YouTube identifier of a song). Legal basis: Art. 6 (1)(b) GDPR (providing the voting and playback function you request).

If you connect your Spotify account, we store the OAuth access and refresh token and use it only to execute the requests you or your party trigger: searching songs, retrieving track details and starting or controlling playback on your connected account. Those search queries and playback commands are disclosed to Spotify AB (Sweden), which processes them for your Spotify account as an independently responsible provider under your Spotify agreement and Spotify’s own privacy policy; connecting the account is your choice and can be undone at any time. We do not disclose party memberships, votes or other members’ identities to Spotify beyond what executing a triggered request requires. YouTube search and song metadata are retrieved through Google’s YouTube Data API without connecting your own YouTube account; section 9 applies to Google. Disconnecting an integration deletes our copy of its token immediately, and account deletion immediately removes the account record, its parties, memberships, votes and stored tokens.

7.11 Coflnet Discord server and bots

On our Discord server and during direct bot interactions, our bots transiently receive the data needed to execute commands and moderate messages visible to them. The development-update feed displayed on our website is written by Coflnet staff in a developer-only Discord publishing channel. To display and synchronize that feed, Coflnet copies the update text, the authoring staff member’s Discord name and account identifier for attribution, Discord channel and message identifiers, publication and synchronization timestamps, and attachment URLs into a separate database, and the published feed can display that author attribution. The copied author data is staff data processed to attribute a published update to its author (Art. 6 (1)(b) and (f) GDPR). The editorial text and attachments are otherwise not personal data where they identify no person. We treat the synchronization identifiers and timestamps conservatively as pseudonymous technical data while Coflnet can resolve them to a Discord source. The source channel remains restricted to product updates and must not be used for support or user messages. This is a website-publishing workflow, not persistent collection of user or ordinary Discord messages.

Direct messages, support or bug-report channels and their threads, ordinary server chat, and ordinary bot-command message bodies are not copied into the development-feed database, and the bots do not keep an additional permanent archive of those message bodies. Message content can remain stored on Discord under Discord’s controls. The landing-page contact form is delivered by email as described in section 4.3 and is not copied to Discord; the public Flipper Chat mirror follows section 7.6. Those paths can contain quoted chat content and account, message or moderation identifiers.

If a report submitted through Discord is approved for a reward, the separate ledger described in section 5 receives only the account or pseudonymous reporter identifier, report reference and award, status and accounting fields described there. This does not copy the Discord thread or attachments into that ledger. Discord remains the source for content left on that platform; a reporter who requests payout supplies identity and tax data through the designated private onboarding route, not in a public or ordinary Discord channel.

The Discord server and bots are moderated through automated checks and human moderators. Deliberately created reports, moderation actions and account-link records can contain personal information supplied by participants and can be retained while needed for the reported issue, rule enforcement or account link; this does not create a permanent Coflnet copy of ordinary message bodies. Account links are removed on unlinking or account erasure, with manual follow-up where necessary. A message already delivered, quoted, screenshotted or independently retained by Discord or another participant cannot necessarily be recalled. Messages remaining on Discord and issues deliberately created on GitHub follow those platforms’ retention and controls. You can request removal through [email protected] or the server moderators. Discord processes platform data under the privacy notice applicable to the user’s region. Legal basis: Art. 6 (1)(b) and (f) GDPR.

For ANE and our SkyBlock tools we collect data from publicly accessible sources (public marketplace listings and the public Hypixel API). This data may include personal data of persons who are not our users – for example a seller’s username, listing location or contact details published in a listing, or a player’s game UUID. Non-public page content contributed by an extension user is governed by section 7.2 and is not treated as public merely because it came from a marketplace domain.

Categories: listing content, price, seller identifier/username and location information contained in public listings; public game data.
Source: the respective public marketplace or game API.
Purposes: price comparison, market analysis, deal notifications for our users.
Legal basis: Art. 6 (1)(f) GDPR – our and our users’ legitimate interest in market transparency based on already-public information. We do not use this data for advertising directed at the data subjects and we do not enrich it with data from other sources to build profiles of sellers.
Retention: for ANE, full searchable listing snapshots are deleted by the current index lifecycle about 15 days after indexing; deletion occurs on the next lifecycle run after the 14-day rollover age is reached. Product-to-listing records are kept for up to 90 days and, once a listing is marked inactive, for 30 days. Derived product records are kept for up to 365 days after their last update and price-history points for up to three years where needed for price analysis. Aggregated price statistics that no longer relate to an identifiable person or seller — for example average, median or distribution values per product and period — are not subject to a fixed deletion period; we keep them for long-term price analysis and can reuse them, including to retrain price-estimation models. We treat such statistics as free of personal reference only after documented verification; where a segment is so thin that values could still be traced to an individual seller, the lifecycles above continue to apply. The product search index can retain derived fields, sample listing titles, image links and coarse location or country data while a product remains operationally relevant, but no longer than 365 days after its last update; it does not include direct seller identifiers or contact details, and we do not describe those records as anonymous unless anonymization has been verified. For SkyBlock public-market and player-linked history, retention is limited to the period for which the record remains necessary for the requested history, market-analysis, leaderboard, opt-out or moderation function described in section 7.6; direct identifiers are removed when no longer needed for that function or a documented objection or legal claim. The fixed leaderboard period in section 7.6 remains controlling.

Where we have contact details and no documented exception applies, we provide the Art. 14 information directly no later than the statutory deadline. For large-scale indexing of public listings, individual contact may be impossible or require disproportionate effort. In those cases we document that assessment, publish this notice prominently, minimize the data, provide search-engine-accessible objection information and do not contact the person for advertising.

If you are a seller or player and object, contact [email protected]. After verification, we remove data relating to you, including derived fields where they remain attributable to you, and prevent renewed indexing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims (Art. 21 GDPR). We retain the minimum record needed to honor the objection for as long as that protection is required.

Where substantiated reports or public marketplace information are used for fraud prevention, they are not the sole basis for a decision producing legal or similarly significant effects. You may contest the information through the contact in section 1; we review its source, accuracy and continued necessity.

9. Recipients and processors

The following providers receive data only for the products and choices described above. Independently responsible providers, such as payment services and platforms you connect, also process data under their own notices. The applicable provider entity and processing region can depend on the product, account and selected feature.

Provider or category	Purpose and when data is disclosed	Usual location
Hetzner Online GmbH	Hosting for Coflnet-operated services	Germany
Cloudflare Inc.	CDN, DNS and encrypted Spables object storage	EU/USA, depending on configuration
Google Ireland Ltd. / Google LLC	Firebase login and push, Maps, Google/YouTube connections and Google Play purchases	Ireland/USA
Apple Distribution International Ltd. / Apple Inc.	Push notifications and app-store purchases	Ireland/USA
OpenAI Ireland Ltd. (contracting processor under OpenAI’s current standard EEA terms, with its affiliates and subprocessors)	Text processing for enabled functions in sections 4.3 and 7, including AI-assisted classification and answer generation for voluntary telephone voice messages and classification of CTW object or challenge phrases; the telephone route sends only the transcript with necessary support context, not the audio recording; the CTW operation does not send the submitted photograph	Ireland; supporting processing can occur in other published subprocessor locations, including the USA, subject to section 10
S3-compatible object-storage processor configured for CTW	Storage of normalized contributed CTW images; descriptions remain in the CTW application database	Configured storage region; any third-country transfer follows section 10
SMTP or mail-delivery processor configured for the relevant service	Transactional, service, security and legal email described in section 4.3 and requested newsletters described in section 4.6	Configured delivery region; any third-country transfer follows section 10
RunPod Inc.	Temporary Spables audio processing, only where this capacity is enabled	Selected processing region; provider based in the USA
Lemon Squeezy, Patreon, Stripe, PayPal and CoinGate	Purchases or subscriptions selected for the relevant product	EU/USA, depending on provider
Further payment or distribution provider configured for a checkout	Only where checkout identifies the provider as payment path or seller before the purchase and the documentation described below this table is in place	Identified region; any third-country transfer follows section 10
Identity, payout or self-billing provider identified during reward or paid Expert onboarding	Only if the stated verification, statement or payout function is used	Region disclosed during onboarding; any third-country transfer follows section 10
Competent tax and customs authorities, including the German Federal Central Tax Office where applicable	Legally required registration, withholding, filing, audit or disclosure concerning reward or creator remuneration	Germany or the competent jurisdiction
Coflnet’s tax advisers, accountants and bookkeepers, and configured accounting or document-transfer platforms such as Lexware Office or DATEV	Bookkeeping, annual accounts, VAT/OSS/UK filings, reconciliation of purchased-credit, Service-gift, reward and creator-fee liabilities, legally required records and audit support. We provide aggregate or pseudonymous records where sufficient and account-, transaction-, payee- or tax-linked detail only where needed for that work.	Germany/EEA unless the particular engagement and any transfer safeguard documented under section 10 state otherwise
Calendly LLC	Meeting scheduling, only after you load or use the widget	USA
Twilio Ireland Limited (contracting provider for EEA customers, with Twilio affiliates and subprocessors under its DPA)	Receipt and routing of calls to the published telephone number; connection metadata and live audio, including a configured handoff to a restricted Discord staff voice channel, and, after prior announcement, recording voluntary voice messages for unanswered calls	Dublin, Ireland (IE1) for the configured regional Voice processing and storage rather than US1; Twilio support access, subprocessors and telecommunications providers involved may process in additional countries subject to section 10
Discord Netherlands B.V. / Discord Inc., as applicable to the user and processing	Discord bot, notifications, the public Flipper Chat mirror channel, SkyChat moderation channels, restricted telephone-support voice channels, and channels you use	EEA/USA
Microsoft Corp.	Minecraft account authentication for IdleMine and Coflnet-operated Minecraft hosting	USA
Assigned infrastructure operators for IdleMine or other Coflnet-operated Minecraft hosting	Processing on Coflnet’s instructions to operate the instance, host or proxy assigned to the requested service	EU/USA, depending on the assigned instance
Overwolf Ltd. (operator of Nitro) and partners shown in its consent interface	Advertising on SkyCofl where you make the corresponding choice	Israel and the countries shown in the consent interface
Meta, X and GitHub	Login or messaging where you select that provider	EU/USA
Spotify AB	Independently responsible provider: execution of the song search and playback requests you or your party trigger on the Spotify account you connect in SongVoter	Sweden (EU)
Providers you connect in Toduen, including Google/YouTube, GitHub, Patreon, Stripe and Shopify	Retrieval of the account metrics you request	Depends on the selected provider
WhatsApp, Telegram and Signal	Messaging where you choose the channel or integration	Depends on the selected provider

Where this table names a “configured” provider category rather than a legal entity, Coflnet records the actual provider entity, GDPR role and DPA, processing region and any Chapter V transfer safeguard before enabling that route. A route for which that record is incomplete must remain disabled.

The roles in the accounting row differ: a tax adviser or auditor engaged under its own professional and statutory duties acts as a separate controller for that mandate, whereas an accounting or document-transfer platform that only processes records on our instructions acts as a processor under an Art. 28 GDPR agreement. Coflnet records which role applies to each engagement before transferring records.

Corporate and project changes. We may reorganise a service, transfer it to an affiliate or buyer, merge entities, or undergo legal succession. This paragraph is information only; it is neither consent nor an independent legal basis to disclose personal data. We do not sell personal data as a standalone asset or permit its use for unrelated purposes. Before a transaction is agreed, professional advisers and a bona fide prospective successor may receive only the minimised data necessary for confidential due diligence, normally in anonymous or aggregated form; any disclosure of identifiable data requires a documented necessity and legal basis, generally a proportionate legitimate interest under Art. 6 (1)(f) GDPR. Before any disclosure or transfer, we identify the parties’ actual GDPR roles and legal basis, transfer only data necessary for the continued service or applicable legal obligations, and put required Article 26 or 28 arrangements and any Chapter V transfer safeguards in place. Data retained only to meet legal retention duties is segregated and may not be used for customer acquisition or other new purposes. If another entity becomes controller, affected users will receive a direct notice identifying that entity and its contact details, the effective date, affected data and purposes, legal bases, retention, recipients and transfers, and how to exercise their rights. For a planned material change, that notice is sent sufficiently before it takes effect; Article 14 deadlines and any required consent, objection period or approval of a contract transfer remain unaffected.

We disclose personal data to authorities only where legally required after review of the request.

10. Transfers to third countries

Some recipients in section 9 can process data outside the EU/EEA. A transfer is made only where the actual recipient and processing are covered by an EU adequacy decision, including the EU-US Data Privacy Framework (DPF) where applicable, or by another safeguard under Art. 46 GDPR, generally the EU Standard Contractual Clauses (SCC) together with any necessary supplementary measures. A user-selected integration or consent to a feature does not by itself replace the required transfer safeguard. A derogation under Art. 49 GDPR is used only in the exceptional cases permitted by that provision. You can request a copy of, or information about, the safeguard applicable to a particular transfer through section 1.

11. Retention

Retention is determined by the purpose, the product-specific periods in sections 7 and 8, statutory duties and the need to establish, exercise or defend legal claims. Where no fixed period is stated, we retain data only while one of those criteria applies and then delete or irreversibly anonymize it.

account master data and user content, and last-login time where inactivity closure is operational: while the account or requested service is active. Under the Core Terms’ inactivity rule, closure is considered only after every linked Service has ended, no usable or refundable credit, pending Service-gift or managed-seat invitation or acceptance, or pending or payable reward or creator licence fee remains and three full years have passed since the last authenticated login; advance notice and a reminder are sent before closure. Afterwards, data is retained only while needed to complete a supported export or deletion workflow, comply with law or address documented legal claims;
promotional-credit expiry and inactivity-closure fields described in the Commerce and Programme Terms and Core Terms, where operational: while the affected credit remains usable or disputed or the account or required notice remains active, and afterwards only for an applicable recordkeeping duty or legal claim;
named-Service gift order, invitation, acceptance, delivery, refund, reversal and fraud-review fields described in section 5 and, for Expert Configs, section 7.6: while an invitation is pending, the selected entitlement remains active or unprovided, or an order, refund, chargeback, creator fee or dispute remains unresolved; afterwards only for the applicable transaction, tax, compliance or legal-claim period. Rejected or expired invitations and participant display fields that are no longer needed are removed from active account views and deleted or irreversibly anonymized when those remaining criteria no longer apply;
managed-seat invitation, acceptance and assignment fields described in section 5: while an invitation is pending, the seat is active or its seven-day renewal-continuity window remains. Rejection, departure, owner revocation, refund, chargeback, final subscription termination or capacity loss deletes the affected assignment; an ordinary lapse removes access immediately and makes the assignment due for deletion when the seven-day window ends if no qualifying renewal occurs. It is removed by the next successful six-hour cleanup cycle or earlier relevant lookup; an outage may delay physical deletion but never access or later reactivation. The seat table does not retain a separate ended assignment or participant-display history. Any independently necessary security log, Terms evidence or legal-claim record follows its own purpose and retention rule in this policy and does not restore access;
data-contribution program records described in sections 3 and 7.6: identifiable contribution content while it remains necessary for the versioned purpose and period shown at collection; the program/notice receipt, contribution and validation reference, and promotional grant record while needed to administer or dispute participation and afterwards only for an applicable recordkeeping duty or legal claim. Rejected content that is unnecessary for a dispute is deleted under the program’s stated short review period; anonymous aggregate statistics can remain only after documented verification that they no longer relate to a person;
reward-program case, referral, award, correction, payout-onboarding and accounting fields described in section 5: report and referral validation fields while the case is being evaluated or an eligibility decision or dispute remains open; an approved ledger entry while the award is pending, payable or disputed; and after payout, expiry or correction only for the applicable remuneration, tax, accounting, compliance or legal-claim period. An unclaimed award’s one-time claim-token hash remains only while needed to permit and secure the claim. After a completed claim it is removed by the supported account-erasure cleanup endpoint, or earlier when the claim-protection purpose ends; it is not retained merely because the financial entry remains. Identity, tax and payout data collected for payout follow those same legal-record periods and are not retained merely to identify an otherwise anonymous report beyond them. A legal representative’s approval record for a payout to a recipient under 18, or a recipient’s choice to wait until turning 18, is retained while the award remains payable or disputed and afterwards only for the applicable remuneration, tax, accounting or legal-claim period;
Expert Config onboarding, representative approval, creator-fee, self-billing, withholding, set-off and payout fields described in section 7.6: while an onboarding status must remain verified or a creator-fee claim remains pending, payable or disputed, and afterwards for the applicable transaction-record, tax, compliance or legal-claim period;
integration and notification tokens: while the connection or notification function is active; our copy is deleted when you disconnect, subject only to a documented security incident or legal duty;
centrally collected application and access logs and traces: no more than seven days; technical metrics may be retained for longer operational periods only while they continue to meet the non-personal criteria in section 4.1;
ordinary contact and support inquiries, including phone contacts and landing-page contact-form messages delivered to our support mailbox: until the inquiry is concluded and afterwards only while a documented recordkeeping duty or legal claim requires it; Twilio and Discord connection metadata expire through the deletion cycles configured for the respective provider; a route that additionally copies or transmits content to Discord must state that fact and its deletion rules at collection;
voluntary voice messages for unanswered calls: raw audio until successful transcription and completion of handling, no later than 30 days after the call; the transcript, AI label and sent or drafted answer then follow the period for the related ordinary support inquiry;
customer-relationship (CRM) records described in section 4.3: while the customer or business relationship remains active and afterwards only while a documented recordkeeping duty or legal claim requires it;
transactional and legal email and dispatch evidence: while needed to administer the underlying account, transaction or notice and afterwards only for an applicable recordkeeping duty or related legal claim; provider queues and copies expire through the configured provider’s deletion cycle;
newsletter and marketing-email data: until you unsubscribe or object; afterwards only the proof of sign-up, confirmation and unsubscription for as long as it is needed to demonstrate lawfulness;
crash reports: log and tracing data per the limit in section 4.1; a report stored as a file bundle until the investigation of the reported error is complete, afterwards only for a documented legal claim;
development-update feed text, author attribution, attachment URLs and technical message/channel synchronization fields: while the published update archive is maintained;
public Flipper Chat messages, including their copies in the public Coflnet Discord mirror channel: while needed to operate and moderate the public chat; mirror copies remain by default until a verified deletion or objection request is processed, subject to any limited continued retention required for moderation evidence or legal claims;
SkyChat sanction free text and quoted message: due for redaction after 96 hours and removed by the next successful ten-minute sweep; the remaining normalized rule, player/actor identifiers, time, duration and status become due for deletion 400 days after the sanction expires and are removed by the next successful sweep. An outage can delay either cleanup;
withdrawal and cancellation declarations and confirmations: where they are received or sent commercial letters, for six years from the end of the calendar year in which they were received or sent (§ 257(1) nos. 2 and 3, (2), (4) and (5) HGB); technical references and delivery metadata are retained only while needed to prove receipt or dispatch, meet another applicable duty or address related legal claims;
meeting records: while needed to arrange and follow up the meeting, unless they become part of a contract or another legally retained business record;
agreement-acceptance evidence, including the Root hash, immutable descriptor and dependency versions and associated acceptance metadata: while the accepted agreement governs the account or contract and afterwards only while needed to establish the applicable contract text, demonstrate compliance or address related legal claims;
specific consent records, checkout declarations, DPA acceptances and objection evidence: for the applicable processing or contract lifetime and afterwards only while needed to demonstrate compliance or address related legal claims; no general privacy-policy acceptance record is kept;
contracts, invoices, payment and tax records: the applicable statutory period, ordinarily 6, 8 or 10 years depending on the record;
CDM signature and delivery evidence: the contract/evidence period selected by the customer, subject to applicable commercial, tax and limitation periods;
public-source data, audio, CTW content and product-specific records: the more specific periods in sections 7 and 8.

Backup copies follow the applicable system rotation period and are not used for ordinary product processing. An applicable erasure request and the criteria above continue to apply if a backup is restored.

12. Processing on behalf of business customers (DPA)

This section applies only where a service is expressly agreed to process third-party personal data on a business customer’s documented instructions, for example customer-controlled recordings or member records. For that processing, the customer determines the purposes and Coflnet acts as processor under an Art. 28 DPA. Do not upload that data before the DPA, including the applicable sub-processor information, is in force. Contact [email protected] if the agreement is not part of the order or onboarding. This role does not extend to Coflnet’s own account, billing, security or legal-compliance processing, and this section does not assign roles for a service where no such processing arrangement has been concluded.

13. Your rights

Where the respective statutory requirements are met, you have the right to:

access your personal data (Art. 15 GDPR);
rectification of inaccurate data (Art. 16 GDPR);
erasure (Art. 17 GDPR);
restriction of processing (Art. 18 GDPR);
data portability (Art. 20 GDPR);
object to processing based on legitimate interests (Art. 21 GDPR);
withdraw consent at any time with effect for the future (Art. 7 (3) GDPR).

To exercise these rights, email [email protected] or [email protected], or use our contact form. You do not have to log in. Where we have reasonable doubts about identity, we request only the additional information needed to verify that the request concerns you. We provide information on action taken without undue delay and in any event within one month of receiving the request. Where necessary because of the complexity or number of requests, that period may be extended by two further months; we will notify you of the extension and the reasons for it within one month of receiving the request (Art. 12 (3) and (6) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

14. Automated decision-making and AI

We do not use solely automated decision-making that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). Some products use machine-learning models (e.g. transcription, listing analysis, deal scoring) as assistive features; their outputs are suggestions and can contain errors. Where you interact directly with an AI system, we label it as such.

15. Security

We use technical and organizational measures appropriate to the risk, including encrypted transmission, access controls, encryption of sensitive credentials and content where appropriate, logging controls, backups and procedures for security incidents. Measures are reviewed in light of the data and service concerned and are updated where necessary.

16. Minors

As a product policy, Coflnet accounts are intended for people aged 16 or older; an individual contribution program may set a higher age. This is not a statement that 16 is the consent age or age of contractual capacity in every country. Where processing relies on a child’s consent, the age and parental-authorization rules of the applicable law apply. If we learn that a child supplied data or consent without the authorization required by that law, we stop the affected processing and delete the data unless retention is legally required. Where a reward recipient is under 18, we pay out only after a legal representative’s recorded approval or after the recipient turns 18, as described in section 5 and the Commerce and Programme Terms. Contact us if you believe this has occurred.

17. Your California privacy rights (CCPA)

This section applies only to the extent Coflnet meets the definition and thresholds of a “business” under the CCPA/CPRA. Providing this notice does not by itself mean that every Coflnet service is subject to the Act.

In the preceding 12 months, the services may have collected the categories described above: identifiers and account data; customer and commercial records; internet/network activity and device identifiers; approximate or precise location where a feature requests it; user-provided audio, images and messages; and inferences produced for the requested service. Sources are you, your device, integrations you connect, payment/app-store providers and the public sources in section 8. We use them for service delivery, security, support, payments, legal compliance, analytics and optional advertising or improvement choices. We disclose them to the recipient categories in section 9 for those purposes and retain them under section 11.

We do not sell personal information for money. If a user enables personalized advertising on SkyCofl, disclosure of online identifiers and internet activity to NitroPay or its advertising partners may constitute sharing for cross-context behavioral advertising under California law. We do not knowingly sell or share personal information of users under 16.

Where the CCPA applies, California residents may request access to categories and specific pieces, correction, deletion and portability; opt out of sale or sharing; limit use/disclosure of sensitive personal information where the statutory right applies; and exercise these rights without discrimination. Submit a verifiable request by emailing [email protected] or using our contact form. An authorized agent may submit a request with proof of authority. We verify only the information reasonably necessary for the request and respond within the statutory period.

For personalized advertising, use the NitroPay consent/opt-out controls on SkyCofl. Where the CCPA applies and our site receives a technically recognizable Global Privacy Control signal, we treat it as an opt-out request for that browser or known account; the CMP must not override it with a preselected choice. You may also use either request channel above. We do not treat the older “Do Not Track” header as the same standardized signal.

18. Changes to this policy

We update this policy when products, processing or the legal situation change. Before reusing existing data for a new purpose, we provide the information required by Art. 13 (3) or Art. 14 (4) GDPR. For a new collection, we provide the required information in the relevant product no later than when the data is collected. Merely updating this page does not expand a contract or consent. Your statutory rights remain unaffected.

Privacy Policy