Privacy policy

This policy covers the website cartillery.com (also reachable as cartillery.de) and the data the game Cartillery: Haulers Wanted can send to us (“telemetry”, section 9).

In short

• The website sets no cookies, stores nothing in your browser and uses no tracking.
• Other services are contacted only when you ask for it: when you sign up for the newsletter and when you play the trailer.
• The game sends data only if you agree to it in the game, and you can withdraw that at any time.

1. Who is responsible

Björn Kaup
Boelckestr. 8a
31535 Neustadt am Rübenberge, Germany
Email: hello@cartillery.com

No data protection officer has been appointed, as there is no legal obligation to do so. For any privacy question, write to the email address above.

2. Hosting and server logs

The website and the telemetry server run on a server rented from STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which processes the data on our behalf under a data processing agreement (Art. 28 GDPR). The processing takes place mainly in the European Union and the EEA; where STRATO involves service providers outside them, it ensures the safeguards of Art. 44 ff. GDPR.

For every request the web server logs: your shortened IP address (IPv4 without its last octet, IPv6 with only its first three blocks), date and time, the address requested, the HTTP status, the amount of data sent, the page you came from (referrer) and your browser’s identification (user agent). Your full IP address is not stored. The logs serve the secure operation of the site and troubleshooting (Art. 6(1)(f) GDPR) and are deleted after 14 days. The server’s error logs can occasionally contain a full IP address; they are deleted after 7 days.

All connections are encrypted (TLS / HTTPS).

3. No cookies, no tracking

The website sets no cookies and stores no data in your browser (no local storage, no session storage). There are no analytics or advertising services. The fonts are served from our own server; your browser does not contact Google or anyone else for them. The “hauler number” shown on the page is calculated from today’s date alone and has nothing to do with you.

4. Newsletter

If you sign up for the newsletter, we process your email address to send you news about the game (such as the demo and the release). The legal basis is your consent (Art. 6(1)(a) GDPR).

Sign-up uses double opt-in: you receive an email with a confirmation link, and only once you open it are you added. As proof of your sign-up, the times of sign-up and confirmation and the IP address used for each are stored.

The newsletter is sent through MailerLite, Inc., 548 Market St, PMB 98174, San Francisco, CA 94104, USA, which processes your data on our behalf under a data processing agreement (Art. 28 GDPR). MailerLite stores the data in data centres in the European Union (Germany and the Netherlands, run by Google Cloud EMEA Ltd, Ireland) and also works with Vercom S.A., Poland, a company of its group. As MailerLite, Inc. is based in the USA, your data can be accessed from there; this transfer is covered by the EU Standard Contractual Clauses in the agreement and by MailerLite’s certification under the EU-US Data Privacy Framework.

We do not record whether you open a newsletter: there is no tracking pixel. Links in the newsletter lead through MailerLite, which counts which link was clicked and when, so that we can see what interests our readers; this is covered by your consent to the newsletter. If you do not want this, unsubscribe; the newsletter cannot be received without it.

You can unsubscribe at any time with the link in every email or by writing to us; your address is then removed from the list. This does not affect the lawfulness of the processing before you withdrew.

5. Trailer (YouTube)

The trailer is a YouTube video. It is not loaded automatically: until you press play we show only a preview image from our own server, and your browser has no contact with YouTube. Only when you press play is the player loaded from youtube-nocookie.com. YouTube then receives data such as your IP address, your browser’s identification and the address of this page, and may store data in your browser.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. The legal basis is the consent you give by pressing play (Art. 6(1)(a) GDPR, § 25(1) TDDDG). See Google’s privacy policy: policies.google.com/privacy.

6. Links to other websites

The site links to Steam, Discord and Bluesky. These are contacted only when you follow a link, and from then on their privacy policies apply. The links to Steam carry a note of which button you came from (such as utm_source=website), so that Steam’s statistics show us which buttons are used. The note contains nothing about you.

7. Contact by email

If you write to us, we process your address and your message to deal with your request (Art. 6(1)(b) or (f) GDPR) and delete them once it is settled, unless we are obliged to keep them. Our email is hosted by Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland, as our processor; the European Commission has recognised Switzerland as ensuring an adequate level of data protection.

8. Press downloads

The files in the press kit are ordinary files on our server; section 2 applies.

9. Telemetry in the game (“Share run data”)

The game can send information about your runs, its performance and its errors to our server. This information is pseudonymous: it is linked to a random ID, not to your name or any account. We use it to balance the game, to find crashes and to see what hardware it runs on.

Only with your consent

Sending is voluntary and off by default. On first start, the main menu asks whether you want to share run data (“Share run data” or “No thanks”; “No thanks” is preselected). Without your agreement, nothing is sent. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time in the game’s settings under Share run data.

What is sent

With every upload:

• a random installation ID, created when you switch sharing on. It is not derived from anything that identifies you, and it is deleted whenever you switch sharing off; switching on again creates a new, unconnected ID;
• the game’s version and build, and whether it is the demo.

Per play session:

• start and last activity (rounded to the minute), how the session ended (normally, interrupted, crashed), time in the menu and in runs, number of runs, clicks on “Wishlist”;
• hardware: operating system and major version, CPU maker and core count, graphics card model, memory in GB, screen size class and aspect ratio, and whether it is a Steam Deck.

Per run:

• time, map seed, chosen cart and starting weapon, outcome, round reached, duration, frame rate;
• per round: purchases, offers, upgrades, loadout, damage, hits, enemies, distance travelled, frame times;
• input device (keyboard and mouse, gamepad or Steam Deck), the steering setting, and two counts from your save (runs finished, hauler number).

On errors and crashes:

• the kind and first line of the error message, part of its stack trace, how often and when in the session it happened; after a crash, the last lines of the game’s log file.
• Before sending, your Windows user name, your computer’s name, the path of your user folder and any email addresses are removed from these texts. Other paths, such as a game folder on another drive, can remain.

Not collected: your name, your email address, your Steam ID or Steam account name, your language and region. Your IP address is neither stored nor analysed by the telemetry server; it is held briefly in memory only, to protect the server against overload. It can occasionally appear in the server’s error logs (deleted after 7 days).

Transfer and storage

The game first keeps the data on your computer (at most 30 days, 50 files or 5 MB) and, when it has a connection, sends it encrypted (HTTPS) to telemetry.cartillery.com, our own server at STRATO (section 2). There it is stored in a database that only the person responsible (section 1) can access. There are no other recipients.

Individual records are deleted 12 months after they arrive. Before that they are summed up into monthly totals that contain no IDs and no error texts, which are kept without a time limit. In case of data loss we back up the database daily on the same server; each backup is deleted after 14 days.

Withdrawing and deleting

• Switching it off in the settings stops sending at once and deletes the ID and any data not yet sent from your computer. Data already sent stays until its deletion date, but can no longer be linked to a new ID.
• “Delete my data” in the settings also deletes all data stored under your ID on our server, and switches sharing off.
• Or email us the ID shown in the settings (there is a copy button), and we delete the data stored under it.

The game’s “Wishlist” button opens the game’s Steam page with a note of where you came from, as in section 6, whatever this setting is.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7(3)). Write to the email address in section 1. For data from the game, please include the ID from the settings; without it we cannot tell which data is yours.

You can also complain to a data protection authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, lfd.niedersachsen.de.

11. Date

8 November 2026. We update this policy when the website, the game or the law change.