Privacy Policy

Last updated: March 2026

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is the operator of the website DartsStar (accessible at https://darts-star.com).
Contact: info@darts-star.com

2. Overview of Data Processing

The following information provides an overview of what happens to your personal data when you use DartsStar. Personal data means any data that can be used to personally identify you (e.g. email address, IP address).

3. Legal Basis

We process your data on the following legal bases:

Art. 6(1)(b) GDPR (Performance of contract) – Processing is necessary for the provision of the game and your account (registration, login, save data, league and match system).
Art. 6(1)(a) GDPR (Consent) – Processing based on your explicit consent (newsletter, optional push notifications). Consent may be withdrawn at any time.
Art. 6(1)(f) GDPR (Legitimate interest) – Processing based on our legitimate interest in security, abuse prevention, cheat detection and technical error analysis.

4. Data Collected During Registration

We collect the following data during registration:

Data	Purpose	Legal Basis
Username	In-game identification, display in league, chat and rankings	Performance of contract
Email address	Account verification, password reset, contact	Performance of contract
Password	Authentication – stored exclusively as a secure hash (bcrypt), never in plain text	Performance of contract
Newsletter opt-in	Voluntary consent to receive the newsletter	Consent
IP address	Security logging, abuse prevention	Legitimate interest

After registration, a verification link is sent by email. The associated token is valid for 24 hours and is deleted after successful verification.

5. Authentication & Session Data

DartsStar uses no HTTP cookies for authentication. Instead, a cryptographically secure bearer token is generated at each login and stored in your browser's LocalStorage.

The following data is stored per session:

Session token (random 32-byte hex value)
IP address and user agent of the device used
Expiration time (30 days after login)

A maximum of 3 concurrent sessions per account are allowed. On logout, the associated token is deleted server-side.

6. Game Data

To provide the game, the following game-related data is stored on our servers:

Save data: Your complete game progress (player attributes, equipment, venue, finances, competition status) is stored as a JSON object. Auto-saving occurs every 15 seconds.
Player attributes: Scoring, checkout, mental, experience, skill, form, energy and in-game currency.
Player statistics: Matches won/lost, darts thrown, points, checkouts, 180s, highest skill, current division.
Match data: Results and detailed data (leg by leg) of your played matches.

6a. Ranked System

In Ranked mode, additional data is stored to ensure fair matchmaking and leaderboard operation:

Data	Purpose	Legal Basis
MMR (Matchmaking Rating)	Ranking on the leaderboard and opponent selection	Performance of contract
Peak MMR	Display of your personal all-time high on the leaderboard	Performance of contract
Ranked match history	Result, MMR delta, opponent ID and timestamp per match	Performance of contract
Ranked statistics	Number of wins, losses and total matches in Ranked mode	Performance of contract

Your username, MMR and rank are visible to other users on the public leaderboard. When your account is deleted, all ranked data is completely removed.

7. Communication Features

7.1 Global Chat

In the global chat, your username and message are stored. Messages can be deleted by the administrator (soft delete). A rate limit of 5 messages per minute applies.

7.2 System Messages

Administrators can send you system messages (e.g. announcements). These are stored linked to your user ID.

7.3 Bug Reports

When you report a bug, the title, description and reproduction steps are stored together with your user ID in order to process the issue.

7.4 Push Notifications

DartsStar supports optional web push notifications. When you enable them, a push subscription (Web Push Protocol / VAPID standard) is stored on our server. It contains:

A device-specific endpoint URL (provided by the browser vendor)
Cryptographic keys for end-to-end encryption of the messages

Push notifications are sent exclusively for game-related events (e.g. cup round available). Consent can be withdrawn at any time in your browser or device settings. After withdrawal, the subscription is deleted server-side. Legal basis: Consent (Art. 6(1)(a) GDPR).

8. Newsletter

If you opt in to the newsletter during registration, we use your email address to send the DartsStar newsletter. Emails are sent via the server's PHP mail service from the address info@darts-star.com.

Unsubscribe: You can unsubscribe from the newsletter at any time – either via the unsubscribe link in every newsletter email or by sending a message to info@darts-star.com. Unsubscriptions are recorded in a newsletter log.

9. Email Communication

We send emails exclusively in the following cases:

Email verification: One-time confirmation link after registration (token valid for 24 hours).
Password reset: Password reset link on request (token valid for 1 hour). For security reasons, no feedback is given for non-existent email addresses.
Newsletter: Only with given consent (see Section 8).

No emails are forwarded to third parties or sent through external services.

10. Logging & Security

To protect against abuse and to ensure game integrity, we log certain events in an event log:

Login, logout, failed login attempts
Registration, email verification, password changes
Save data storage, cheat detection (e.g. implausible attribute jumps)
Chat actions, bug reports
Theme changes, newsletter changes

Each log entry contains the user ID, event type, associated event data (JSON), the IP address and a timestamp. This data is used exclusively for security and abuse prevention (legal basis: legitimate interest, Art. 6(1)(f) GDPR).

10a. Anonymous Visitor Statistics

To analyse usage, we collect anonymised page views. No IP address is stored. Instead, a non-traceable hash value is generated (SHA-256 from the IP address and a daily rotating salt). This hash is used solely to count the number of unique visitors per day.

Data collected:

Date of visit
Anonymised visitor hash (not traceable to individuals)
Page visited (e.g. “main”)
Number of views per day

No cookies, no device fingerprints and no personal data are collected. Data is automatically deleted after 90 days. Legal basis: legitimate interest in statistical analysis of site usage (Art. 6(1)(f) GDPR).

11. Local Browser Storage

DartsStar uses no tracking or advertising cookies. The following data is stored locally in your browser:

Storage	Key	Purpose
LocalStorage	authToken	Authentication token for the session
LocalStorage	userId, username	Quick access to account information
LocalStorage	isAdmin	Admin permission status
LocalStorage	dartsstar_theme	Selected colour scheme (Dark/Light)
SessionStorage	dartsstar_build	Build version number
Cache (Service Worker)	–	Caching of static files for offline use

This data does not leave your browser and is not transmitted to our server (with the exception of the authToken, which is sent as a bearer token with API requests).

12. Hosting

DartsStar is hosted by Hostinger. When you visit the website, the web server automatically collects technical access data (server log files), including:

IP address of the requesting device
Date and time of access
Page / file accessed
HTTP status code
Browser type and operating system
Referrer URL

This data is collected by the hosting provider and processed in accordance with its privacy policy. We have no influence over the type and scope of server-side logging by the hosting provider.

13. No Third-Party Data Sharing

Your personal data is not sold, rented or otherwise shared with third parties. No external analytics, tracking or advertising services (e.g. Google Analytics, Facebook Pixel) are used.

Data is only disclosed if we are legally required to do so (e.g. by order of a public authority or court).

14. Data Security

Passwords are hashed with bcrypt (cost factor 12) – decryption is not possible.
All communication between browser and server is encrypted via HTTPS (TLS).
Session tokens are generated cryptographically securely (32 bytes of randomness).
Password reset tokens are limited to 1 hour; verification tokens to 24 hours.
Rate limiting protects against brute-force attacks and spam.
Cheat detection identifies and logs implausible save data changes.

15. Retention & Deletion

Your data is retained as follows:

Account and game data: As long as your account exists.
Session data: Up to 30 days after login, then automatically invalidated.
Verification tokens: 24 hours after creation; deleted immediately upon successful verification.
Password reset tokens: 1 hour after creation.
Event log: Log data is retained for security analysis and regularly cleaned up.
Chat messages: Stored permanently; the most recent 200 messages are displayed.

When your account is deleted, all associated data is completely removed (cascading deletion from all 11 affected database tables).

16. Account and Data Deletion

You have the right to request the complete deletion of your DartsStar account and all associated personal data.

How to Delete Your Account

Option 1 – Self-service (immediate):

Open DartsStar and sign in
Go to ⚙️ Settings (via the menu in the top right)
Scroll down to the “Danger Zone” section
Click “Delete Account” and confirm with your password
Your account and all data will be immediately and permanently deleted

Option 2 – Via email:

Send an email to info@darts-star.com with the subject “Delete Account”
Include your username and the registered email address
We will confirm deletion within 7 days

What Data is Deleted?

Upon deletion, all of your personal data is irrevocably and completely removed:

Account data (username, email, password hash)
All active sessions / session tokens
Save data and game progress
Player attributes and player statistics
Match data and results
Chat messages
Bug reports
Activity logs (event logs)
Newsletter settings
System messages
Ranked match data and leaderboard statistics
Push notification subscriptions

Retention After Deletion

No data is retained after deletion. All data is immediately and permanently removed from our database. Recovery is not possible.

Exception: Server log files of the hosting provider (Hostinger) may technically still contain IP addresses for a short time – these are subject to the hosting provider's retention policies and are not controlled by us.

17. Your Rights Under the GDPR

Under the GDPR, you have the following rights:

Right of access (Art. 15 GDPR): You can request information about the personal data we store about you.
Right to rectification (Art. 16 GDPR): You can request the correction of inaccurate data.
Right to erasure (Art. 17 GDPR): You can request the deletion of your data, provided no statutory retention obligations apply.
Right to restriction of processing (Art. 18 GDPR): You can request the restriction of processing of your data.
Right to data portability (Art. 20 GDPR): You can request to receive your data in a commonly used, machine-readable format.
Right to object (Art. 21 GDPR): You can object to the processing of your data at any time, provided the processing is based on legitimate interest.
Withdrawal of consent (Art. 7(3) GDPR): Consent given (e.g. newsletter) can be withdrawn at any time with effect for the future.
Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority.

To exercise your rights, contact: info@darts-star.com

18. Children & Youth Protection

DartsStar is intended for users aged 13 and above. We do not knowingly collect personal data from children under 13. Should we become aware that data from a child under 13 has been collected, it will be deleted immediately.

19. Android App (Google Play Store)

DartsStar is available as an Android app via the Google Play Store. The app uses Trusted Web Activity (TWA) technology and accesses the same web application. The same privacy policy applies as for the web version.

Additional notes for the app:

No additional permissions beyond internet access are required.
No device identifiers (e.g. Advertising ID, IMEI) are collected.
The app contains no advertising and no in-app purchases.
No data is transmitted to Google or other third parties through the app (except for the standard connection data of the Play Store itself).

20. Changes to this Privacy Policy

We reserve the right to amend this privacy policy as necessary, e.g. in the event of changes to the legal situation or changes to the service. The current version is always available on this page. In the event of significant changes, we will inform registered users by email or system message.