Privacy Policy

Last updated: 20 September 2026

This Privacy Policy explains what personal data KLANS collects, why we collect it, how long we keep it, who it is shared with, and what rights you have under the EU General Data Protection Regulation (GDPR) and comparable laws.

1. Who is responsible for your data

KLANS (klans.net) is operated by two private individuals, who are joint controllers for your personal data within the meaning of Art. 26 GDPR:

We jointly decide why and how your data is processed on KLANS, and we have agreed between us who fulfils which obligation — in particular who answers your requests and who informs you about processing. Regardless of that arrangement, you may exercise all of your rights (Section 10) against either of us, and the simplest route is to write to contact@klans.net. The essential terms of our arrangement are available on request at that address.

We have not appointed a Data Protection Officer; one is not mandatory for a service of this size and nature. If that changes, the contact details will be published here.

2. What data we collect

2.1 Account data

When you register we store your username, display name, email address, and a securely hashed password (hashed with a modern one-way algorithm — we never store or can recover your plain-text password). We also store your registration date, last login time, and account status (active, suspended, banned).

2.2 Sign-in with an external provider (social login)

If you choose to sign in using Google, Discord, Twitch or Steam, that provider sends us a limited set of data so we can create or recognise your account:

• Google — your Google account ID, name, email address and profile picture.
• Discord — your Discord user ID, username, avatar and email address.
• Twitch — your Twitch user ID, display name, profile image and email address.
• Steam — your SteamID and public Steam profile information only. Steam's sign-in does not give us your email address, so if you register this way we ask you separately for an email address for account recovery and service notices.

We never receive your password with any of these providers, we request only the minimum permissions needed to sign you in, and we do not post anything on your behalf. You see the exact permissions you grant at the moment you connect the account, and you can disconnect a provider later in your settings — provided you have set a password or another sign-in method first, so you don't lock yourself out. You can also revoke our access from your account settings at the provider itself. Your relationship with the provider is governed by its own privacy policy.

2.3 Profile data

Anything you add to your profile — avatar, banner image, bio, country/region, followed games and genres, linked game or platform handles — is stored so it can be shown to other members according to your profile's visibility settings.

2.4 Content you create

We store the content you create on the platform so it can be shown to the people it is meant for:

• posts, comments, likes, bookmarks and shares on personal walls and clan walls
• clan membership, clan roles, invitations and join requests
• events you create or join, your RSVP status, and any answers you give to an event's custom signup questions
• "Looking For Play" (LFP) posts and their contents
• direct messages you send and receive
• reports you submit about other members or content

Event signup questions are written by the members who create events, not by us. Please do not enter sensitive information (health data, religious or political views, and similar) into them, and if you organise events, do not ask for it.

2.5 Uploads

Images you upload as an avatar, banner, post attachment, clan image or event attachment are stored on our servers, together with basic file metadata (file name, size, type, upload time). Uploads are accessible to anyone who can view the profile, post, clan or event they belong to. Where technically possible we strip embedded metadata such as EXIF location data from uploaded images, but you should assume any image you upload may be seen and downloaded by other members.

2.6 Technical and log data

To operate the service securely we automatically record limited technical data, including your IP address, browser and device information, referring page, and access timestamps. This is written to server logs and to internal security records used for login protection, rate limiting, abuse prevention, ban enforcement and troubleshooting. It is not used to build advertising profiles.

2.7 Moderation and administration records

Where we act on a report, a rule violation or a security incident, we keep a record of the action (for example: content removed, warning issued, account suspended or banned) together with the reason, the timestamp and the account involved. Administrative actions are written to an internal audit log. These records exist so moderation is accountable and consistent, and so bans can be enforced.

2.8 Notifications and emails

We store your notification preferences, and we send essential service emails (such as password resets and important account notices) and, only if you opt in, optional announcement emails.

2.9 What we do not collect

We do not ask for or store payment card details, government identification, or precise location data, and we do not collect special categories of data (such as health, religion or political opinions) about you.

3. Cookies, your choices and bot protection

3.1 Strictly necessary cookies

These are required for KLANS to work: your session cookie (keeps you logged in), a CSRF token (protects forms against cross-site request forgery), and the consent cookie that remembers the cookie choice you make below. They cannot be switched off without breaking the site, and they are set on the basis of our legitimate interest in delivering a working, secure service.

3.2 Optional cookies and storage — your choice

Everything that is not strictly necessary is switched off until you turn it on. On your first visit KLANS shows a cookie banner with two equally easy answers — accept everything, or refuse everything optional — and a third option to choose category by category. We do not treat closing, ignoring or scrolling past the banner as agreement, and refusing is remembered for just as long as accepting is, so the banner does not come back to wear you down.

The optional categories are:

• Preferences — local storage in your browser that remembers a small interface choice you already made, such as dismissing the "Install KLANS" prompt. Nothing here identifies you and nothing is sent to our server.
• External media — permission for the video players described in Section 4 to load with the page. Without it, those players are replaced by a placeholder and your browser does not contact YouTube, Dailymotion or Twitch at all until you click one. You can still watch everything; you just decide one video at a time.

Changing your mind is as easy as the original choice. Cookie preferences — linked in the footer of every page — shows what you currently allow and lets you withdraw any of it. Withdrawal takes effect immediately and does not affect the lawfulness of what was done beforehand. Your choice is stored in your browser for 12 months, after which we ask again; we also ask again if we add a category or a provider, because consent given for one purpose is not consent for a different one. Legal basis: your consent (Art. 6(1)(a) GDPR, and Art. 5(3) of the ePrivacy Directive for the storage itself).

3.3 Advertising and analytics

We do not run web analytics, advertising trackers, or any third-party measurement on KLANS. There is no Google Analytics, no advertising pixel, and no profiling cookie. If that ever changes, we will ask for your consent before setting anything — it would appear as a further category in the banner described above — and this section will say what was added and why.

3.4 Bot protection (Google reCAPTCHA)

Registration and other public forms are protected by Google reCAPTCHA, which decides whether a submission comes from a person or an automated script. To make that decision Google receives your IP address, information about your device and browser, and how you interacted with the page, and it may set its own cookies. Provider: Google Ireland Ltd. / Google LLC. This runs only on the pages that carry a protected form, not across the site.

Legal basis: our legitimate interest in preventing automated abuse and protecting the platform and its members (Art. 6(1)(f) GDPR). Google's own handling of that data is governed by its privacy policy and terms of service. You can object to this processing under Section 10.

4. Embedded content and external links

4.1 Video embeds (YouTube, Dailymotion, Twitch)

KLANS displays videos embedded from YouTube, Dailymotion and Twitch, both in content we publish and in posts added by members.

Embedded players are loaded click-to-load unless you have allowed the External media category described in Section 3.2: nothing is requested from those platforms, and no cookies from them can be set, until you actively click to play an embed. Once you do, the relevant platform (Google/YouTube, Dailymotion, or Twitch/Amazon) receives your IP address and may set its own cookies and record your viewing activity under its own privacy policy. This happens outside our control. Where the platform supports it, we use privacy-enhanced embedding (for example youtube-nocookie.com).

If you do allow that category, the players load with the page they appear on, which means the platform receives your IP address and browser information as soon as the page renders — whether or not you press play. That is the trade you are making when you accept it, and you can withdraw it at any time from Cookie preferences.

4.2 Member-submitted embeds and links

Members can add other third-party links and embeds to their posts. These come from our members, not from us. Any external site you click through to is governed by that site's own privacy policy, and we are not responsible for its data practices.

4.3 Official game news feeds

Game pages show official news headlines sourced from publisher feeds. The feeds are fetched by our server on a schedule and cached — your browser does not contact the publisher when the page loads, so the publisher does not see your IP address unless you click through to an article.

5. Why we process your data (legal bases)

Where we rely on legitimate interest, we have weighed our interest against your rights and concluded the processing is limited to what members would reasonably expect from a social platform. You can object to any of it — see Section 10.

6. Who can see your data

This is a social platform, so some of your data is visible to other people by design:

• Visitors who are not logged in (and search engines): your username, display name, avatar, banner, bio, followed games and clan memberships, plus a preview of your two most recent public posts. Beyond that preview, visitors must register to see more of your activity. Because this preview is publicly reachable, search engines can index it and it may appear in search results and in search engine caches even after you change or delete it.
• Logged-in members: your full public profile and activity, subject to your visibility settings.
• Nobody, if you choose so: you can set your entire profile to private at any time in your settings, which removes it from the public preview and from search engine indexing going forward.
• Clan members: clan wall posts, clan media, clan events and discussions inside your clan.
• Event participants and organisers: your RSVP, participant role, and your answers to that event's signup questions.
• The recipient only: direct messages.
• Administrators and moderators: account data, content and moderation records, where needed to operate the platform, investigate reports and enforce our Terms.

Your email address is never shown to other members.

7. Service providers we share data with

We do not sell member data and we do not share it with advertisers or data brokers. We use the following processors and third parties:

Service emails are sent from our own mail server (smtp.klans.net) running on that hosting infrastructure. We do not use a third-party transactional email service, so your email address is not passed to any additional provider for that purpose. Note that once an email leaves our server, your own email provider receives and stores it under its own policy.

We may also disclose data to law enforcement or public authorities where we are legally required to do so, and to a successor entity if KLANS is ever transferred, sold or merged — in which case active members would be notified in advance.

8. International data transfers

Our servers and databases are hosted with Namecheap Inc. in a US data centre (RadiusDC, Phoenix, Arizona). Your account data, profile, posts, messages and uploads are therefore stored and processed in the United States, outside the European Economic Area.

Transfers to the United States are made on the basis of appropriate safeguards under Chapter V GDPR:

• Namecheap Inc. — the Standard Contractual Clauses approved by the European Commission, incorporated into Namecheap's Data Processing Addendum, which we have accepted. Namecheap is not, as far as we are aware, self-certified under the EU–U.S. Data Privacy Framework, so the Clauses are the mechanism we rely on.
• Google LLC — the EU–U.S. Data Privacy Framework, under the European Commission's adequacy decision of 10 July 2023, supplemented by Standard Contractual Clauses in Google's data processing terms.

You can request further information about these safeguards at contact@klans.net.

9. How long we keep your data

When we say data is anonymised rather than deleted, we mean it is stripped of anything that identifies you (for example, a comment left in a thread may remain but be attributed to a deleted user), so it can no longer be linked back to you.

10. Your rights

If you are in the EU/EEA — and in many other jurisdictions with equivalent laws — you have the right to:

• Access — obtain confirmation of whether we process your data, and a copy of it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted ("right to be forgotten"), subject to legal retention obligations.
• Restriction — have processing limited in certain circumstances.
• Data portability — receive the data you provided in a structured, machine-readable format, or have it transmitted to another provider where technically feasible.
• Object — object at any time to processing based on legitimate interest, including any profiling based on it.
• Withdraw consent — withdraw consent (marketing emails, push notifications) at any time, without affecting the lawfulness of processing before withdrawal.
• Complain — lodge a complaint with your national data protection supervisory authority. You can always turn to the authority in the country where you live or work. Because we are established in Germany and the Netherlands, the authorities responsible for us are the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) in Germany and the Autoriteit Persoonsgegevens (AP) in the Netherlands.

As joint controllers, you may address any request to either of us; we will coordinate internally so you only have to ask once. To exercise any of these rights, contact contact@klans.net. We respond within one month, as required by Art. 12(3) GDPR; where a request is complex we may extend this by up to two further months and will tell you if we do. We may ask you to confirm you control the account in question before acting on a request.

11. Your controls inside KLANS

Much of the above you can do yourself, without contacting us:

• Settings — edit or remove your avatar, banner, bio, followed games and genres, and your email address.
• Profile visibility — control who can see your profile and activity.
• Blocking — block another member so they cannot contact you or interact with your content.
• Notifications — choose which notifications and emails you receive.
• Cookie preferences — Cookie preferences, linked in the footer of every page, shows what you currently allow and withdraws any of it in one click. It works without an account, because the choice belongs to your browser rather than to your profile.
• Content deletion — delete your own posts, comments, LFP posts and uploads.
• Data download — Settings → Your data gives you everything we hold about your account as one machine-readable JSON file, immediately and as often as you need it. Passwords and connected-service tokens are credentials rather than data about you, and are the only things left out.
• Account deletion — Settings → Your data deletes your account yourself, without asking us and without waiting. You can also email contact@klans.net and we will process it for you. Either route carries out the deletion described in Section 9: your profile, email address, uploads, galleries, connected logins, devices, preferences and relationships are erased, while posts, comments, guides, organised events and sent messages stay in the threads other members took part in, attributed to a deleted member.

12. Automated decision-making and profiling

We use automated systems for spam and abuse detection, rate limiting, and ranking or suggesting content (such as feeds, event and game recommendations).

Because automated systems make mistakes, this is subject to the following safeguards:

• Every soft suspension is entered into our internal report system and reviewed by a human at least once a day. If the restriction was wrong, it is lifted.
• You can ask for a review immediately by writing to contact@klans.net. You have the right to obtain human intervention, to explain your side, and to contest the decision.
• Permanent bans and account deletions are never issued automatically — they always require a human decision.

We do not otherwise make decisions about you by purely automated means that produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR.

13. Children's privacy

KLANS is not directed at children under 16, and by registering you confirm you are 16 or older. We do not knowingly collect data from children under this age. If you believe a child has created an account, contact contact@klans.net and we will review it and delete the account where appropriate.

14. Data security and breach notification

We take reasonable technical and organisational measures to protect your data, including password hashing, HTTPS/TLS for all traffic, CSRF protection, server-side authorisation checks on every action, rate limiting, restricted administrative access, validation of uploaded files, and regular backups. No system is completely secure and we cannot guarantee absolute security.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required (Art. 33 GDPR) and inform affected members without undue delay where the risk is high (Art. 34 GDPR).

15. Changes to this policy

We may update this policy as KLANS changes. The "Last updated" date above reflects the latest revision. For significant changes we will notify active members by email or an in-app notice before the changes take effect.

16. Contact