Privacy

Alexander Wüst, Abt-Christoph-Str. 5, 94486 Osterhofen, Germany
E-mail: hello@kybeia.de
Versefiles is a Kybeia project; the imprint covers this site too.

• Reading needs no account. Writing needs one - display name, e-mail address, password.
• No ads, no ad trackers, nothing is passed to third parties for advertising.
• Visit statistics run without cookies on our own server; IP addresses are truncated.
• Fonts, images and videos are served from this server. Only embedded YouTube videos load after a click.
• The server is hosted in Germany; we keep no access logs with IP addresses.
• The Versefiles Companion sends your game journal only if you give it a key - without handle, ids, IP addresses or other players' names, and you can delete it any time.
• The companion asks for a newer version - without a key or an identifier - and installs only what we signed.
• When you accept a contract, the companion asks for information about it for its overlay - nothing of that is stored.

The site runs on a virtual server operated by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, in a data centre in Germany. The reverse proxy in front of the application keeps no access logs; we do not store readers' IP addresses. Since 23 September 2026 the application itself logs every request without the IP address - time, method, address, status code and the caller's user agent; IP address, cookies and access keys are dropped deliberately. The purpose is to see whether search engines fetch the pages (Art. 6(1)(f) GDPR); the file rolls over at 8 MB and the oldest of three is overwritten. Your IP address is processed only while a request is answered (Art. 6(1)(f) GDPR, running the site). The hosting provider processes connection data inside its infrastructure under its own rules; a data processing agreement is in place.

Everything - stylesheets, fonts (Chakra Petch, JetBrains Mono), images and videos - is delivered from this server. Simply opening a page connects you to no Google server, no CDN and no other third party.

Only strictly necessary cookies are set (§ 25(2) no. 2 TDDDG), which need no consent:

• versefiles-session - the session, for sign-in and forms; expires after two hours without activity.
• XSRF-TOKEN - protection against forged form submissions; lives as long as the session.
• sprache - your chosen language, one year. Only set when you switch the language.
• kanal - the chosen game channel (LIVE/PTU), one year. Only set when you switch the channel.
• remember_web_… - only if you tick “Remember me” when logging in: keeps you logged in beyond the session. Lifetime five years; logging out removes it.

There are no advertising or tracking cookies, and therefore no cookie banner.

To learn which missions people look for and whether the site is found at all, we use the open-source software Matomo on a server run by the operator (stats.webmug.de). Nothing is sent to Matomo the company or any other third party.

Matomo runs without cookies. Your IP address is truncated by its last two bytes before storage (203.0.113.42 becomes 203.0.0.0) and the browser's "Do Not Track" setting is honoured. Recorded are the page viewed, the referrer, browser type, screen size, approximate country and time. Signed-in users are not counted. With no cookie and no full IP address, you cannot be recognised across days.

The MCP endpoint is counted separately. Calls to versefiles.com/mcp come from a program, not from a browser; since 16 October 2026 they count into a Matomo site of their own. Recorded per answered request: time, the tool called, the game channel, whether the request could be answered, how long the answer took, and the calling program's identification. No IP address and no search terms or other arguments - what was looked for is neither stored nor reported. The rows go to Matomo once an hour and are booked there under our own server's address; after 90 days they are deleted.

Legal basis is our legitimate interest in minimal statistics (Art. 6(1)(f) GDPR). If you still do not want to be counted, enable "Do Not Track" in your browser.

Reading needs no account. To write walkthroughs or notes, sight missions or upload game data, you register with a display name, e-mail address and password. The password is stored only as a bcrypt hash. Optionally you can add your RSI handle in the profile. Until the address is confirmed no account exists: display name, address, password hash, the IP address of the request and its time are kept in a table of their own meanwhile. If the confirmation link is never used, the request expires and is deleted.

For e-mail confirmation, password reset, address change and account deletion we send links by e-mail. For each such request we store the IP address it came from, so that abuse (mass-triggering mails to other people's addresses) can be traced. These entries are deleted once the link expires, at the latest after 30 days.

Your list and the blueprints you mark as yours are stored with your account. Only you can see them; you can change them at any time, and they are deleted with the account.

Legal basis is performance of the user agreement (Art. 6(1)(b) GDPR); for abuse prevention, our legitimate interest (point (f)).

Deletion: You can delete your account yourself in the profile; the deletion is confirmed by e-mail. Account and e-mail address are then removed. Published contributions stay under the display name so walkthroughs do not vanish mid-run (see the terms); on request we anonymise them.

Walkthroughs, notes, sightings and feedback are published with your display name, the time and the game build they were written on. Every save of a walkthrough keeps the previous version; that history is tied to your account too.

Uploaded images are re-encoded and downscaled for display; that delivered version carries no embedded metadata (EXIF, such as the camera or a location) any more. The uploaded original stays on the server next to it - with its metadata - and can be fetched under the random address it was given; nothing links to it. Videos are stored unchanged. Remove metadata beforehand if that matters to you. Images and videos sit on the same server and are delivered without third parties.

Take care not to show other people's personal data in screenshots (player names in chat, account details) that are not part of the mission.

With a key an admin allowed to upload game data - since companion 0.15.1 that is your companion key, before it was an import key of its own -, the Versefiles Companion (up to its version 0.8.0 a Windows tool of its own, the QuestGuide Uploader) reads the game data from your game install and uploads it. Only the extracted game data and the build number are transmitted - no account data, no file paths, nothing about your machine. With this key the companion also reports which build the channels of your install have (channel, build number, game version) - at start, then with every new build, and when you rescan or upload in the “Game data” view - so it can tell you whether the site has it yet. For this we store, per build, how often and by which account it was last reported.

For each former import key we store the time of last use and the IP address of the last upload, so you can tell in your profile whether a token has leaked. The IP is overwritten with every upload and removed when the key is revoked (Art. 6(1)(f) GDPR, security of your account).

Versefiles Companion. The companion follows the game's log file (Game.log) on your computer and keeps a journal there. Only if you create a companion key in your profile and enter it in the companion does it send that journal to us: game sessions from LIVE and HOTFIX (channel, build, server region, start and end) and the events in them, each with its time - contracts accepted, completed and abandoned, blueprints received, rewards, purchases, sales and rentals with prices, travel destinations and locations, med bed treatments and deaths. Not transmitted are sessions from PTU and the Tech Preview, your RSI handle, account and character ids, IP addresses and the names of other players; the server keeps only the fields it knows and discards the rest. For a companion key we store the time of last use, but no IP address. With the key, the companion also asks for the display name of the account it belongs to and whether the key may upload game data, and shows that in its window, so you can see where your journal goes; this request gives out no other account data.

We use this data for your own log (My log and your dashboard, visible only to you), to tick steps on your list, and - aggregated, without names and only once at least three accounts have contributed - for figures on mission pages: which blueprints a contract actually hands out, how long it takes from accepting to completing, and at which step players gave it up. Those aggregates are computed from the stored events on every request; whatever is deleted no longer counts.

Reasons for giving up. For an abandoned contract you can say on My log or your dashboard why you gave up, if you want to: one of five given reasons and, optionally, a short note. The reasons are counted on the mission page without names once at least three accounts have given up that contract. An editor reads a note first; only once approved does it appear there, also without a name. If you do not want to answer at all, you can dismiss the question; all that is stored then is that you no longer want to see it - the abandon itself stays as an event from your game log and keeps counting. You can change reason and note at any time, and they are deleted with your companion data.

Steps in the game. For fixed contracts (not for procedurally generated ones) the mission page shows the steps as the game displayed them - the game's objective texts, without names, dates or the number of players. The sequence may come from a single recorded run; how many runs and players stand behind it appears only from three accounts on. Procedural contracts are left out because their objective texts can contain other players' names.

Overlay. When you accept a contract in the game, the companion asks versefiles.com/api/v1/companion/mission - in every game channel and without a key too - for what the site knows about that contract, and shows it briefly over the game. Only the channel, the contract's title and its contract names from the game log are sent; with a key also the key, so that your own record and your blueprints can be shown. Nothing of this request is stored - no contracts from PTU or the Tech Preview either - and like every request it is logged without an IP address (section 1). Switch the overlay off in the companion under “Settings”. The legal basis is our legitimate interest in providing the feature you use the companion for (Art. 6(1)(f) GDPR).

Updates. The downloaded companion keeps itself up to date: at start, every six hours and after the game closes it asks versefiles.com/api/v1/tools whether there is a newer version and downloads it if so. This happens without a key too. Nothing is sent but the request itself: the user agent names only the program and its version, no key and no identifier, and like every request it is logged without an IP address (section 1). Only a version signed by us is installed; the companion checks that on your computer. Switch it off in the companion under “Settings”. The former Windows tool asks the same way one last time and replaces itself with a version that only points to the companion. The legal basis is our legitimate interest in keeping the programs secure and working (Art. 6(1)(f) GDPR).

The legal basis for sending the journal is your consent (Art. 6(1)(a) GDPR), given by creating the key. You can withdraw it at any time: revoke the key in your profile and delete the stored data on My log. Deleting your account deletes the companion data as well.

Confirmation and notification mails are sent through Mailjet (Mailjet SAS, 4 rue Jules Lefebvre, 75009 Paris, France) on our behalf under a data processing agreement. Mailjet receives your e-mail address and the content of the respective mail. We use no open or click trackers. Processing takes place within the EU.

Some missions link videos on YouTube. They are not loaded automatically: you first see only the title, a preview picture and a button; the picture is served by our own server (we fetched it from YouTube once), your browser does not contact Google for it. Only when you click does your browser connect to YouTube (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) in privacy-enhanced mode (youtube-nocookie.com); Google then learns your IP address and Google's privacy policy applies. The click is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) and covers that one video only. A transfer to the USA is possible; Google is certified under the EU-US Data Privacy Framework.

Links to robertsspaceindustries.com (including the referral link) and buymeacoffee.com are ordinary links. Their privacy rules apply once you open them; nothing is sent there from this site until you click. The Star Citizen server status is fetched by our server, not by your browser.

What you submit through the feedback form (text, optionally an e-mail address, the account if signed in, the page concerned, a shortened browser string) is kept for handling. For rate limiting the IP address is stored only as a keyed hash, never in clear. Twelve months after receipt we remove everything that points at a person (e-mail, account link, browser string, IP hash); the text itself stays. If you write to us by e-mail, the mail is kept as long as handling it requires (Art. 6(1)(b) or (f) GDPR).

The only recipients of personal data are our processors (hosting: netcup GmbH; e-mail: Mailjet SAS). A transfer to a third country happens only when you start a YouTube video yourself (section 8). Data is neither sold nor shared for advertising.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Consent you have given can be withdrawn at any time with effect for the future.

Write to hello@kybeia.de. You may also lodge a complaint with a data protection supervisory authority; the one responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

When the site changes, this notice changes with it. The date above says which version you are reading; we announce material changes to signed-in users by e-mail.