Privacy Policy

Summary

• No trackers, no analytics, no ads. We do not sell or share any data.
• An account is optional. Everything works without one; your progress then stays in your browser only.
• Sign-in only via Roblox. We never see your password and never ask for your email, age or real name.
• No direct contact with Roblox or Discord. Our server fetches images and numbers, so your browser does not connect to their servers. The site is hosted in Germany and protected by Cloudflare.
• Fonts are served from our own server. No Google Fonts, no third-party scripts.
• Everything can be deleted. You can delete your account and saved progress yourself at any time on the My account page.

Controller

The controller responsible for data processing on this website is:

If you have any questions about privacy, just send us an email.

Hosting, Cloudflare and server logs

The website runs on a rented server in a data center in Germany: Zigelski & Weith GbR / Roeth & Beck GbR, Kleinkirchenbirkig 33, 91278 Pottenstein, Germany. When you open a page, your browser necessarily sends data to the server, mainly your IP address, date and time, the requested address and your browser identifier (user agent). No page can be delivered without this data.

The server sits behind the Cloudflare network (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). All requests pass through Cloudflare encrypted: it protects the site from attacks and overload and connects it securely to our server. In doing so, Cloudflare processes your IP address and technical request data. Cloudflare is certified under the EU-US Data Privacy Framework; the EU Commission's Standard Contractual Clauses also apply. More: Cloudflare privacy policy.

Our own application does not write access logs. It keeps IP addresses briefly in memory only, to block excessive sign-in attempts (abuse protection); they are gone after about 20 minutes at most. If the upstream web server writes access logs, we delete them after 7 days at most.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in secure and stable operation.

Cookies

We only set cookies that are technically necessary, and only when you want to sign in. Without signing in, our website does not set a single cookie. (Cloudflare may set a technically necessary cookie such as __cf_bm for at most 30 minutes to protect against bots.) All cookies are httpOnly (not readable by scripts) and SameSite=Lax; online they are only sent over encrypted connections.

Legal basis: Section 25(2) no. 2 TDDDG (strictly necessary for the sign-in you requested) and Art. 6(1)(b) GDPR.

Storage in your browser

Your progress on the website (discovered pets in the index, favorites, your rebirth level, the egg hunt and the mini-game save) is stored in your browser's local storage (localStorage, entries start with ste:). Guest progress and account progress are kept separately. There are also small settings such as filters and a short marker for the page transition effect (sessionStorage).

This data stays on your device and is not sent to us, unless you are signed in, in which case we sync it with your account. You can delete it at any time via your browser's site data settings.

Legal basis: Section 25(2) no. 2 TDDDG, storage is necessary for the features you use to work.

Account and Roblox sign-in

An account is optional. It saves your progress across devices. There are two ways to sign in:

Sign in with Roblox

You are redirected to roblox.com and confirm there that we may recognize you. The Roblox privacy policy (opens in a new tab) applies on roblox.com. We only request the openid and profile permissions and receive only your Roblox user ID, username, display name and avatar image. The access token Roblox gives us is used for exactly this one request and immediately revoked; we do not keep it. We never see your password and never act on your behalf on Roblox.

Connect with a code

You enter your Roblox username. Our server looks up your Roblox user ID, display name and avatar via Roblox's public API and shows you a code. You add it to your profile yourself; our server then reads your public Roblox profile (the “About” field) to find the code. You can remove the code afterwards. The pending request is valid for 15 minutes and deleted about one hour later at the latest.

Roblox is a company based in the USA. In both cases our server only sends Roblox what is necessary: your username or Roblox user ID, and for the Roblox sign-in the one-time authorization code.

What is stored in your account

• Roblox user ID, username, display name and the address of your avatar image
• sign-in method (Roblox sign-in or code) and the time of creation and last sign-in
• your sessions, as a hash only, with expiry date
• your progress: discovered pets, favorites, rebirth level, egg hunt and the mini-game save, each with the time of the last change
• your best mini-game score, if you submit one

Legal basis: Art. 6(1)(b) GDPR, you use the account and we provide it.

Mini-game leaderboard

If you submit a mini-game score while signed in, we store your best score. If you are in the top ten, your display name, username, avatar, score and time appear publicly on the leaderboard on this website. Deleting your account also removes your entry.

Legal basis: Art. 6(1)(b) GDPR.

Discord bot check

In the community Discord you can verify your Roblox account with our bot. If this is set up, our server checks the bot's database read-only to see whether your Roblox user ID is verified there, and shows you a yes or no on “My account”. No Discord data is transferred to the website and nothing in the bot database is changed.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in showing you your link status.

Images and live numbers

Avatar images, game graphics and the Discord banner are hosted on Roblox and Discord servers. So that your browser does not have to connect to their servers (and they do not see your IP address), our server loads these images and serves them from our own address. It caches them for up to 24 hours.

Likewise, our server fetches public numbers such as player count, visits, group and Discord members directly from Roblox and Discord. No data about you is transmitted.

Fonts, links, no tracking

All fonts, scripts and graphics come from our own server: no Google Fonts, no CDNs, no embedded videos, no social media plugins, no analytics or advertising tools.

Links to Roblox, Discord, YouTube, TikTok, Twitch, Instagram or X are ordinary links. Only when you click one does your browser connect to that site, where its own privacy policy applies.

Retention

Export and deletion

On the My account page you can at any time:

• export your data: everything we have stored for your account, as a JSON file,
• sign out: your session is ended,
• delete your account: account, sessions, progress and mini-game score are deleted from our server immediately and completely.

You can also revoke the website's access at any time in your Roblox settings under “Authorized Apps”. Your Roblox account itself is of course not affected.

Your rights

Under the GDPR you have the right at any time to

• AccessArt. 15 GDPR
• RectificationArt. 16 GDPR
• ErasureArt. 17 GDPR
• RestrictionArt. 18 GDPR
• Data portabilityArt. 20 GDPR
• ObjectionArt. 21 GDPR

You can do much of this yourself on the My account page. For anything else, write to anakin.schwenke@gmail.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Changes

If the website or the law changes, we update this policy. The version published here always applies. A German version is available at savetheegg.de/datenschutz.