Privacy Policy

This policy covers the website fifthacecasino.com and the feedback dialog inside the game “Fifth Ace Casino”. Last updated: 30.09.2026. The German version (Datenschutzerklärung) is the legally binding one; this English text is provided for convenience.

1. Controller

The controller under the General Data Protection Regulation (GDPR) is the company of which the studio Waldersee Games is a division:

We have not appointed a data protection officer because we are not legally required to. Please send privacy requests to the e-mail address above.

2. Summary

• The website sets no cookies, uses no analytics or tracking tools and stores nothing on your device.
• Fonts and images are served from our own server; no third-party content is loaded when you open a page.
• A YouTube video is only loaded after you explicitly click on it.
• The game sends data only when you click “Send” in the feedback dialog yourself. There is no background telemetry.

3. Website hosting and delivery via Cloudflare

The website is delivered through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”), which acts as our host and content delivery network and protects the site against attacks such as DDoS.

When you visit the website, Cloudflare necessarily processes connection data: your IP address, date and time, the requested URL, the amount of data transferred, your browser identification (user agent) and, where applicable, the referring page. Without this data the page cannot be sent to your browser. We do not analyse this data ourselves; logging of the Worker application is switched off. Cloudflare keeps security and operational logs only for a short time under its own rules.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure, fast and error-free delivery of the website. Technically necessary access to your device is permitted without consent under Section 25(2) no. 2 of the German TDDDG.

We have a data processing agreement with Cloudflare under Art. 28 GDPR (Cloudflare Data Processing Addendum, DPA). Cloudflare operates data centres worldwide, so processing outside the EU, in particular in the USA, is possible. Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46(2)(c) GDPR). Cloudflare's privacy policy: cloudflare.com/privacypolicy.

4. No cookies, no tracking

We use no cookies, no local browser storage, no audience measurement, no advertising networks, no social media plugins and no external fonts. The image gallery runs entirely in your browser.

5. Trailer video (YouTube, click to load)

If a trailer is embedded from YouTube, we first show only a preview image from our own server. Only when you click “Play trailer” is the YouTube player loaded in privacy-enhanced mode (youtube-nocookie.com). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. At least your IP address, the address of our page and technical browser data are then sent to Google, and YouTube may store or read information on your device during playback. A transfer to the USA is possible; Google is certified under the EU-US Data Privacy Framework.

The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The consent applies to that single page view only; nothing is loaded automatically on your next visit. Google's privacy policy: policies.google.com/privacy. If the trailer is instead served as a video file from our own server, no data goes to third parties.

6. Links to Steam

The “Wishlist on Steam” buttons are plain links to the game's Steam page. We do not load any Steam content into our pages and do not send any data to Valve. Only when you follow a link do you leave our website; from then on the privacy policy of Valve Corporation, PO Box 1688, Bellevue, WA 98009, USA applies: store.steampowered.com/privacy_agreement. Your browser sends at most the address of our home page as the origin (referrer policy “strict-origin-when-cross-origin”).

7. Contacting us by e-mail

If you e-mail us, we process your address and the content of your message in order to answer it. The legal basis is Art. 6(1)(f) GDPR (answering enquiries) or Art. 6(1)(b) GDPR where a contract is concerned. We delete the message once it has been dealt with, unless statutory retention obligations apply.

8. In-game feedback dialog

In the game you can open a “Feedback & Bug” dialog from the system menu or with the F8 key. Data is only transmitted when you click “Send” there. The game does not send usage or crash data in the background. If there is no internet connection when you send, the game stores the report locally on your computer and transmits it at the next start; only what you sent yourself is transmitted.

What is transmitted

• Your report: its type (bug, idea, praise, other) and your text.
• Optionally your e-mail address, if you want us to be able to reply. The field may be left empty.
• Optional attachments (one checkbox, ticked by default, can be unticked before sending): a screenshot of the game at the moment before the dialog opened, an excerpt of your current save game, and the last lines of the game and engine logs. Your Windows user name is redacted from the logs before sending.
• Technical data: build and version number, operating system, graphics card, game language and game context (casino, in-game day, demo yes/no, game speed).
• IP address: it is necessarily transmitted for the connection but not stored in plain text. Only a salted hash (SHA-256, truncated) is stored, from which the IP address cannot readily be recovered. It serves exclusively to prevent abuse: at most 10 reports per connection are accepted within one hour. The hash is deleted automatically after 24 hours; after that, the report can no longer be linked to a connection.

Purpose and legal basis

We use the data solely to find and fix bugs, improve the game and reply to you if needed. The legal basis for the report, e-mail address and attachments is your consent given by voluntarily sending them (Art. 6(1)(a) GDPR). The technical data and the IP hash are processed on the basis of our legitimate interest in analysing errors and preventing abuse (Art. 6(1)(f) GDPR). You can withdraw your consent at any time with effect for the future by writing to contact@fifthacecasino.com, ideally with the approximate date and time of the report or the report number the game shows after sending.

Storage location, recipients and retention

Reports are received by a service on the Cloudflare platform (feedback.fifthacecasino.com) and stored with Cloudflare: the report text and technical data in the Cloudflare D1 database, which Cloudflare has assigned to its “Eastern Europe” region (EEUR), and the attachments in Cloudflare R2 storage, whose location Cloudflare chooses automatically. Cloudflare does not contractually guarantee storage exclusively within the EU; the data may be stored in or processed from data centres outside the EU. Cloudflare acts as our processor under its Data Processing Addendum (see section 3); the safeguards listed there apply to transfers to third countries (EU-US Data Privacy Framework, supplemented by standard contractual clauses). Only the development team has access to the reports. We do not pass the data on to third parties or use it for advertising.

Reports including attachments and e-mail address are deleted automatically after 180 days (a daily deletion run in the database plus an expiry rule in the attachment storage), or earlier on request. The IP hash is already deleted after 24 hours.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw consent at any time (Art. 7(3)).

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement.

There is no automated decision-making, including profiling. You are not obliged to provide us with data; without connection data, however, the website cannot be displayed.

10. Changes

We update this policy when the website, the game or the law changes. The version published here applies.