Illurant
Back

Privacy Policy

Last updated: 13 August 2026

1. Controller

Mustafa Ayar
Kornstraße 7
68649 Groß-Rohrheim
Germany
Email: info@illurant.com

2. Purposes and legal bases

  • Providing the game and your account — performance of a contract (Art. 6(1)(b) GDPR).
  • Payment processing (gems) — contract and legal obligations (Art. 6(1)(b) and (c) GDPR).
  • Reach measurement via the Meta pixel — your consent only (Art. 6(1)(a) GDPR). No pixel loads without consent; consent is revocable at any time.
  • Usage analysis via Microsoft Clarity — your consent only (Art. 6(1)(a) GDPR). Clarity records how pages are used (clicks, taps, scrolling, a pseudonymised replay of your session) so we can find confusing or broken screens; text content is masked. Nothing loads without consent; consent is revocable at any time.
  • Push notifications — your consent only (Art. 6(1)(a) GDPR). Only if you turn them on does your browser create a delivery address for that device; we store this address together with its technical keys, the device's timezone and your language, so notifications arrive at a sensible hour and in your language. Revocable at any time — Settings → Notifications or your browser's site settings — and the stored address is deleted when you disable them and when the account is deleted.
  • Server operation and security — legitimate interest (Art. 6(1)(f) GDPR).
  • Coarse statistics about new accounts — legitimate interest (Art. 6(1)(f) GDPR). When an account is created we store its country (a two-letter code, derived locally from the IP address, which itself is not stored for this purpose) and how the visit arrived — for example whether it followed an advertisement link. This tells us which countries and which advertisements our players come from; it is not used to profile individuals.

3. Recipients / processors

  • Stripe — payment processing. Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
  • Hetzner — server operation / hosting. Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
  • Meta — reach measurement, only after consent and only when the pixel is enabled. Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland.
  • Microsoft — usage analysis (Clarity), only after consent and only when Clarity is enabled. Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
  • Your browser's push service — delivery of push notifications, only after you enable them. Which service that is depends on your browser (e.g. Google for Chrome, Mozilla for Firefox, Apple for Safari); notification content is encrypted and readable only on your device.
  • DB-IP — IP-to-country lookup for shop currency selection and the account statistics above, performed locally against a downloaded database; your IP is not sent to DB-IP.

4. Transfers to third countries

Payment processing (Stripe) and — after consent — reach measurement (Meta) and usage analysis (Microsoft Clarity) may involve transfers to the USA, based, where applicable, on the EU-US Data Privacy Framework and/or the EU Commission's Standard Contractual Clauses. Push notifications you have enabled are delivered through your browser vendor's push service, which may likewise involve transfers to the USA on the same bases.

5. Retention

Account data is kept for the life of the account. Purchase records are retained for the statutory commercial and tax retention periods.

6. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection. Any consent (e.g. to the Meta pixel, Microsoft Clarity or push notifications) can be withdrawn at any time with future effect — via Settings → Appearance, Settings → Notifications or the cookie banner. You may lodge a complaint with a data-protection supervisory authority. Requests: info@illurant.com.

You can delete your account yourself at any time: log in, open Profile → Settings → Profile and choose "Delete Account". Details of what is deleted and what is retained: Account deletion.

7. Cookies and local storage

  • Session cookie — technically required for login and security.
  • coh.consent (localStorage) — your tracking choice (Meta pixel and Microsoft Clarity).
  • _clck / _clsk (Microsoft Clarity) — set only after you consent; they recognise the browser across page views for the usage analysis above.
  • coh.beta_notice (localStorage) — remembers the beta notice was dismissed.
  • coh_sound (localStorage) — sound preferences.
  • coh.push-nudge (localStorage) — remembers that the notification hint on the contract board was dismissed.