Last updated: 30 July 2026.
This Policy explains what data Vast (the “Service”) collects when you create an account and play, why, and what choices you have about it. “We” / “us” / “the operator” refers to Marvin Böcker, trading as “RandM Games”, the controller for the Service within the meaning of Art. 4 (7) GDPR.
Marvin Böcker
trading as “RandM Games”
Rechener Str. 4a
44787 Bochum
Germany
Email: marvin.boecker@pm.me
We have not appointed a data protection officer; we are not required to do so under Art. 37 GDPR / § 38 BDSG, as we neither employ the requisite number of persons engaged in automated processing nor carry out processing that requires a data protection impact assessment as our core activity.
Account & authentication data. Your login identity is managed by our identity provider (Keycloak, at auth.galaxies-beyond.muwiflix.com) under the vast realm. We hold a mirror-native account record (no separate user database) containing your login identifier and the account metadata the simulation needs to run. Legal basis: Art. 6 (1)(b) GDPR — performance of the contract of use between you and us.
Gameplay data. In-game actions (orders, trades, fleet movements) are recorded as part of the persistent simulation state itself. Legal basis: Art. 6 (1)(b) GDPR.
Technical data. Standard web server logs (IP address, user agent, requested URL, timestamp) are written by our reverse proxy. Legal basis: Art. 6 (1)(f) GDPR — our legitimate interest in operating the Service securely and defending against abuse, attack, and overload. You may object to this processing under Art. 21 GDPR on grounds relating to your particular situation.
Aggregate public counts. The landing page’s /public/summary endpoint reports aggregate, non-personal figures (players online, active accounts, and a public standings table). The standings table deliberately contains no commander or player name — only empire names — so it identifies no individual. This is not personal data within the meaning of Art. 4 (1) GDPR.
We use this data to operate and maintain the persistent simulation, to authenticate you, to prevent abuse and cheating, and — where legally required — to comply with lawful requests. We do not sell personal data, we do not use it for advertising, and we carry out no profiling or automated decision-making producing legal effects within the meaning of Art. 22 GDPR.
The landing page (this site) sets no cookies and runs no analytics or tracking scripts — its only network call is a same-origin fetch of aggregate counts. No consent banner is shown because there is nothing to consent to.
The game client (play.galaxies-beyond.muwiflix.com) stores a session with your identity provider (Keycloak) and holds authentication tokens in your browser’s session storage. These are strictly necessary to provide the service you have requested and are therefore exempt from the consent requirement under § 25 (2) No. 2 TDDDG.
Because the simulation has no database, gameplay and account state exist as an in-memory world model, periodically snapshotted to local files roughly every 60 seconds; up to about a minute of the most recent activity can be lost on an unclean shutdown, by design.
We retain account and gameplay data for as long as your account remains active. On deletion, your account record and its associated gameplay state are removed from the world model without undue delay, and disappear from the file snapshots as those are superseded. Server logs containing IP addresses are retained for at most 7 days and then deleted, unless a specific log is required longer to investigate a concrete security incident.
Authentication is delegated to our identity provider (Keycloak), which we operate ourselves on our own infrastructure — your credentials are not passed to a third-party identity service. Our hosting provider, OVHcloud, processes data on our behalf as a processor under Art. 28 GDPR (see § 11 for the hosting location). We do not share personal data with advertisers. We may disclose data where required by law, or to a successor entity in the event of a merger or acquisition, subject to this Policy.
We apply appropriate technical and organizational measures under Art. 32 GDPR to protect account data, including TLS for all traffic in transit and authentication delegated to a dedicated identity provider. No system is perfectly secure, and we cannot guarantee absolute security.
You have the right to obtain access to your personal data (Art. 15 GDPR), to have inaccurate data corrected (Art. 16), to have your data erased (Art. 17), to restrict processing (Art. 18), to receive your data in a portable format (Art. 20), and to object to processing based on our legitimate interests (Art. 21). Where processing is based on consent, you may withdraw that consent at any time with effect for the future.
To exercise these rights, write to marvin.boecker@pm.me. We will respond within one month, as required by Art. 12 (3) GDPR; that period may be extended by two further months where a request is complex, in which case we will tell you within the first month.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority competent for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestr. 2–4
40213 Düsseldorf
Germany
The Service is not directed at children under 16, matching the eligibility requirement in our Terms of Service and the threshold in Art. 8 (1) GDPR in conjunction with § 6 (1) TDDDG. We do not knowingly collect personal data from children under that age. If you believe a child under 16 has registered, contact us and we will delete the account.
The Service runs on a single virtual server hosted by OVHcloud in a datacenter located in Germany. Our identity provider (Keycloak) and its account database run on that same server; no part of the Service is hosted elsewhere.
All processing therefore takes place within the European Union. No personal data is transferred to a third country outside the EU/EEA, so the additional safeguards under Chapter V of the GDPR (Art. 44 ff.) do not apply. OVHcloud acts as a processor on our behalf under Art. 28 GDPR.
We may update this Policy from time to time; material changes will be reflected in the “Last updated” date above.
Privacy questions or requests: marvin.boecker@pm.me. Full provider details are in our Imprint.