Privacy policy

1. Controller

Yannick Kühnel
[Address to follow]
Email: contact@lagarto5.de

2. Hosting

SCR Companion runs on its own server (VPS). On every request the web server processes technically necessary connection data (including IP address, timestamp and the page requested) in order to deliver the site and protect it against attacks. These server logs are not linked to the statistics data described below.

3. Processors

For the database, login and user accounts we use Supabase as a processor. For sending confirmation and account emails we use Resend. A data processing agreement pursuant to Art. 28 GDPR is in place with, or is being concluded with, both providers. [Please check: add the server location/region of the Supabase project.]

4. Registration & account

When you register we store your email address, your (encrypted) password and an automatically assigned username. Alternatively you can sign in with Discord (OAuth) – in that case we only receive the basic data from Discord needed for login. Trips, depot details and active roles that you enter in the dashboard/depot are stored linked to your account. You can irreversibly delete your account yourself at any time under Account → Danger zone; all associated data is automatically removed with it.

5. Cookies

Technically necessary (no consent required): a session cookie from Supabase to keep you logged in, and a cookie that stores your cookie choice itself (scr-consent).

Statistics (only with your consent): if you choose "Accept" in the cookie banner, we set a random, anonymous identifier cookie (scr-stats-id, valid for 1 year) and record anonymously which pages are visited and whether the points calculator is used. There is no cross-site tracking and no linking to your user account. You can change your choice at any time via "Cookie settings" in the footer.

Local storage (not a cookie, no consent required): if you start a tour in the route planner, your browser stores the running tour (train, segments, confirmed arrival times) using localStorage. This data never leaves your browser, is not sent to our server, and is discarded automatically after at most 24 hours.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection regarding your personal data. To exercise these rights, contact the address given above. You also have the right to lodge a complaint with a data protection supervisory authority.

7. Leaderboard

The leaderboard is optional and off by default. Only once you switch it on under Account do your username, your points, the number of your journeys and the number of routes and trains you have unlocked become visible to every visitor of this site, including visitors who are not signed in. Your email address, individual journeys and notes are never published. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the same switch; your entry disappears immediately, and no stored data is lost.