Privacy
Last updated: 16.10.2026 · This is a convenience translation. The German version is legally binding.
holygods.net is built on privacy by design: no tracking, no advertising cookies, no analytics tools, and all fonts and scripts are served from our own server. Below you'll find exactly which data we process and why.
1. Controller
Andreas Bilke, Merkenicher Str. 161, 50735 Köln, Deutschland
E-mail: contact@holygods.net
2. Hosting and server logs
The service runs on a server in Germany (hosting provider: netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Deutschland, under a data processing agreement pursuant to Art. 28 GDPR). The web server logs IP address, date/time, requested URL, status code, transferred bytes, referrer and user agent for security and stability purposes (Art. 6(1)(f) GDPR). Logs are deleted after 14 days at the latest.
3. Cookies
We only use strictly necessary cookies (§ 25(2) no. 2 TDDDG), so no consent banner is needed: __Host-hg_sess (session, login, CSRF protection; until browser close or 12 h of inactivity), hg_remember ("keep me logged in", only if selected; 30 days), hg_lang (your chosen language; 1 year).
4. No third parties on page load
Fonts, styles and scripts are self-hosted. Images from external platforms (Discord/Steam avatars, game covers, Twitch thumbnails) are delivered through our own image proxy/cache, so your IP address is not disclosed to those providers when you browse the site.
5. Account
For e-mail registration we process your handle, e-mail address, password (Argon2id hash only) and language; your e-mail is confirmed via double opt-in. Optional profile data (display name, avatar, bio, playstyle, roles, online times, age group, country/region, spoken languages, platform IDs, game library, ranks) is processed only if you provide it. Legal basis: Art. 6(1)(b) GDPR. When you delete your account, your data is deleted or anonymised within 30 days unless statutory retention applies.
6. Login protection
Login attempts are stored with a hash of the entered e-mail and the IP address for 30 days to prevent brute-force attacks (Art. 6(1)(f) GDPR). New passwords are checked against known breaches using the k-anonymity method of "Pwned Passwords": only the first 5 characters of a SHA-1 hash are sent — never your password or e-mail. Optionally, Cloudflare Turnstile (Cloudflare, Inc., USA; EU-US Data Privacy Framework) protects the sign-up form against bots.
7. Discord, Steam and Twitch
Only at your request, we link your Discord (ID, username, display name, avatar, verified e-mail; "guilds.join" adds you to our community server), Steam (SteamID64, profile name, avatar and — if your profile is public — game library, playtime and achievements) and Twitch account (ID, channel name and, while live, title, game, viewer count and thumbnail, which are shown publicly on our homepage). If you link Diablo3Stats (diablo3stats.de) with a one-time code, we receive your BattleTag and Diablo III stats (total playtime, paragon, seasons, heroes, kills, best Greater Rift) to show your verified playtime in your library; the sync repeats regularly while the link exists. Tokens are stored encrypted and deleted when you unlink. Legal basis: Art. 6(1)(b) GDPR; transfers to the USA happen at your request (Art. 49(1)(b) GDPR) or under the EU-US Data Privacy Framework where the provider is certified.
8. Discord bot and voice
If your Discord account is linked, our bot processes your Discord ID, server roles and voice state (channel, muted/deafened, streaming) to create temporary match channels, sync roles and show voice presence on the site. Audio is never recorded or processed. Completed voice sessions (start, end, duration — used for XP) are kept for 90 days.
9. Matchmaking and lobbies
Public lobbies (title, game, language, time, participants' handles, avatars and karma) are visible to everyone. Our algorithm suggests groups based on your games, playtime, languages, region, skill, karma, online times and roles (profiling without legal or similarly significant effect — you decide whether to join). Legal basis: Art. 6(1)(b) GDPR.
10. Karma
After organised matches, players can rate each other; the resulting karma score is shown on your profile and affects matchmaking. Comments are only visible to moderators; individual reviews are kept for 12 months. Repeated negative reviews from different players can trigger an automatic, temporary LFG restriction; you may request human review, express your view and contest the decision at any time (Art. 22(3) GDPR) via a support ticket or contact@holygods.net.
11. PRO subscription and payments
Payments are processed by Stripe Payments Europe, Ltd. (Dublin, Ireland). We never receive your card data — only customer/subscription IDs, status, amount, currency, country and invoice data. Invoices are retained for 10 years (Art. 6(1)(c) GDPR with § 147 AO, § 257 HGB).
12. E-mails, overlay, moderation
We only send transactional e-mails from our own mail server (newsletters only with your consent). The in-game overlay receives a read-only token (90 days, stored hashed, revocable). Reports, warnings and bans (account, e-mail, Discord ID, SteamID or IP) are stored for the duration of the measure; staff actions are recorded in a tamper-evident audit log (staff IPs removed after 90 days); application error logs are deleted after 14 days (Art. 6(1)(f) GDPR).
13. Recipients
We never sell your data or share it for advertising. Recipients are limited to our hosting provider, Stripe, and — only when you use the respective feature — Discord, Valve (Steam) and Twitch.
14. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and may withdraw consent at any time (Art. 7(3)). Contact contact@holygods.net. You may also lodge a complaint with a supervisory authority (Art. 77 GDPR).
15. Minimum age and security
holygods.net is intended for users aged 16 and over. We protect your data with TLS/HSTS, Argon2id password hashing, encrypted tokens, strict Content Security Policy, CSRF and brute-force protection, role-based staff access and tamper-evident logging (Art. 32 GDPR).