Privacy Policy

Effective date: 2026-07-12 · Last updated: 2026-07-12

1. Data Controller

With respect to the processing of personal data on this site, the controller is the site operator; The operator’s identity and contact details are set out in our Impressum.

Whether a Data Protection Officer (DPO) must be appointed depends on the nature and scale of the processing activities: No Data Protection Officer is appointed. The operator does not meet the thresholds under Art. 37 GDPR or § 38 BDSG (it is not a public authority, does not carry out large-scale regular monitoring or large-scale processing of special-category data, and does not have the statutory number of persons constantly engaged in automated processing).

2. What Data We Collect

We collect data only to the extent necessary to provide the services of this site. Specifically, this includes:

• Email & login code: When you sign in with an email one-time code, we collect your email address and send a one-time login code to it to verify your identity; to prevent abuse we record send counts and security events, but we do not store the code itself.
• Sign-in provider (third-party login identifiers): When you sign in via Epic or Google, we receive the unique account identifier from the respective provider, along with the basic profile information you authorize them to share (typically your email address and display name). We do not receive or store the passwords you use with those providers.
• Learning progress: The lessons you have completed, your quiz answers and scores, the stars you have earned, and preferences such as the "Blueprint / C++" explanation mode, used to synchronize your learning records across devices.
• Purchase records: The items you purchased, the amount, currency, and time, as well as the transaction identifier and status returned by the payment service provider. We do not receive or store your full card number or payment credentials — these are processed directly by the payment service providers listed below.
• Technical logs: Information generated automatically when you visit this site, such as IP address, browser type and version, device and operating system information, time of access, pages requested, and referring pages, used for service operation and troubleshooting.
• Security logs: Login attempts, authentication events, unusual or suspicious access, and related records used to prevent abuse and fraud.

3. Why We Use This Data (Purposes of Processing)

• To provide account registration and third-party sign-in, and to identify you and maintain your signed-in state.
• To save your learning progress and preference settings and synchronize them across devices.
• To process your purchases, deliver the purchased content, and retain the necessary transaction records.
• To keep the service and your account secure, and to prevent, detect, and respond to abuse, fraud, and unauthorized access.
• To monitor and troubleshoot issues, and to maintain, optimize, and improve the site's features and experience.
• To comply with legal obligations where required by applicable law (e.g., record retention for tax and accounting purposes).

4. Legal Bases for Processing

We process personal data on the basis of Article 6 GDPR. The correspondence is as follows:

• Performance of a contract (Art. 6(1)(b)): Providing accounts and sign-in, synchronizing learning progress, and processing your purchases, as necessary for the performance of the service agreement with you.
• Legitimate interests (Art. 6(1)(f)): Security logs, abuse and fraud prevention, and basic technical operation and troubleshooting. The legitimate interests relied upon are securing the service and user accounts, preventing abuse and fraud, and ensuring basic technical operation and troubleshooting; these have been weighed against your interests, rights and freedoms.
• Legal obligation (Art. 6(1)(c)): Retention of transaction records for tax and accounting purposes. e.g., § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB), which generally require retention of tax- and accounting-relevant records for approximately 6, 8, or 10 years, depending on the type of document.
• Consent (Art. 6(1)(a)): At present no processing relies on consent: only strictly necessary storage is used and no marketing/newsletter communications are sent. Should consent-based processing be introduced later, consent will be obtained beforehand and a means to withdraw it at any time will be provided.

5. Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes described above, or for any longer period required by law. The applicable periods are as follows:

• Account and learning progress: Retained for the life of the account; deleted or anonymized within 30 days after account deletion, unless a longer retention period is required for tax, accounting, fraud-prevention, or legal-dispute reasons.
• Purchase and transaction records: Retained for the applicable statutory tax/accounting retention period. approximately 6, 8, or 10 years depending on the type of document (per § 147 AO / § 257 HGB).
• Technical logs: Retained for 14 days, then deleted or anonymized.
• Security logs: Retained for 90 days; where a security incident is involved, retention may be extended until the incident has been resolved.

6. Deletion and Anonymization Rules

Once the retention period expires, the relevant personal data will be deleted or irreversibly anonymized so that it can no longer be linked to a specific individual. Data held in backups will be overwritten or purged within the normal backup rotation cycle. You may also actively request deletion under the rights described below; where the law requires continued retention (for example, transaction records still within a statutory retention period), we will restrict the processing of such data until it can be lawfully deleted.

7. Data Recipients

To operate this site, we entrust necessary data to, or interact with, the following service providers (data processors). We do not sell your personal data to third parties for marketing purposes. The recipients and their roles are as follows:

Data processing agreements (DPAs) compliant with Article 28 GDPR are concluded with each data processor: Data processing agreements pursuant to Art. 28 GDPR are in place with each processor on the basis of their respective standard data-processing terms.

8. Possible International Data Transfers

Some of the recipients above are located in countries or regions outside the European Union / European Economic Area (EEA), primarily the United States. When your personal data is transferred to these regions, the local level of data protection may differ from that of the EU. For such transfers, we will rely on one or more of the following safeguards:

• The Standard Contractual Clauses (SCCs) adopted by the European Commission; or
• An adequacy decision for the relevant country/mechanism (where applicable); or
• Other appropriate safeguards under Article 46 GDPR.

Where personal data is transferred outside the EU/EEA — for example to Cloudflare and Resend (Plus Five Five, Inc.) in the United States, and to Stripe (which may involve US-based group companies and sub-processors) — we apply appropriate safeguards under Art. 44 et seq. GDPR, such as the European Commission’s Standard Contractual Clauses (SCC), an applicable adequacy decision, or another lawful transfer mechanism. Our database (Supabase) is hosted within the EU (Frankfurt, Germany) and therefore does not constitute a third-country transfer. You may use the contact details below to request a copy of the safeguards we rely on or to learn more about them.

9. Your Rights

To the extent provided by applicable law, you have the following rights with respect to your personal data:

• Right of access: To learn whether we process your data and to obtain a copy of the relevant data.
• Right to rectification: To request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): To request deletion of your data where the conditions are met.
• Right to restriction of processing: To request suspension or restriction of the processing of your data in specific circumstances.
• Right to object: To object, on grounds relating to your particular situation, to processing carried out on the basis of legitimate interests.
• Right to data portability: To receive the data you have provided in a structured, commonly used, machine-readable format, or to have it transmitted to another controller.
• Right to withdraw consent: For processing based on consent, you may withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the competent data protection supervisory authority. Competent authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany; https://www.ldi.nrw.de.

To exercise any of the above rights, please contact us using the details below. We will respond within a reasonable period as required by law.

10. Contact

If you have any questions or requests regarding this privacy policy or your personal data, please contact us via the contact details in our Impressum.

11. Cookies and Local Storage

This section explains what Verse Wiki stores in your browser, why we store it, and how you can clear it. Our principle is simple: in this first phase we keep only what is strictly necessary for the site to function — no analytics, no advertising, no cross-site tracking.

We Use Only "Strictly Necessary" Storage

The storage items below keep login, progress and reading mode working. They are part of the site's core functionality — without them we cannot preserve your login state or learning progress.

Why Is There No "Accept All" Banner?

Because in this first phase there are no analytics, no advertising and no third-party tracking. Full-screen cookie consent banners exist to obtain consent for non-essential, tracking-type cookies — and we currently use none of them.

Under most EU/German legal interpretations, "strictly necessary" storage (maintaining your login, remembering your preferences, completing actions you actively initiate) may generally be used without prior consent; consent is required for analytics, advertising and tracking storage. Since we only use the former, there is no need for an "Accept All" button asking for permission we do not need to request.

If We Add Analytics in the Future

Should we later introduce analytics, performance measurement or any storage that is not strictly necessary, we will deploy a genuine consent management system before enabling it:

• No non-essential scripts are loaded by default until you have expressly consented;
• Equally prominent "Accept" and "Decline" options are provided, and declining does not affect your normal use of the lessons;
• Every storage item then in use is clearly listed, together with its purpose and retention period;
• You can change or withdraw your consent at any time.

Until then, this page describes everything — strictly necessary storage and nothing else. The exact mechanism and wording will be those of the version deployed at that time (currently only strictly necessary storage is used and no consent-management platform is deployed).

How You Can Clear This Data

• Clear local progress: on the home page, open "My Progress" and click "Reset Progress" to clear the progress and stars stored in this browser.
• Sign out: the login session cookie is invalidated when you sign out.
• At the browser level: you can also delete this site's cookies and site data in your browser settings, or visit in an incognito/private window (in which case the data is not retained long-term).

Please note: after clearing localStorage, any local progress that has not been synced to your account cannot be recovered.

About This Site

Verse Wiki is an independently produced educational project and is not affiliated with, sponsored by, endorsed by, or otherwise associated with Epic Games. Epic Games, Unreal Engine, UEFN, Fortnite, Verse, and related marks are trademarks or assets of their respective owners. This site offers Epic account sign-in solely as an optional third-party authentication method; this does not imply any endorsement of this site by Epic Games.