Privacy Policy

1. Who is responsible

Pixel Perfect UG, Stettiner Str. 41, 61348 Bad Homburg, Germany. Managing director: Patrick Rousselet. Commercial register: Amtsgericht Bad Homburg, HRB 14301. EUID: DEM1202.HRB14301. Support, privacy and legal notices: support@onhatch.gg.

Pixel Perfect UG is responsible for personal data processed to operate Hatch. Contact support@onhatch.gg for privacy questions or requests.

2. Account, library and publishing data

Hatch stores your account identifier, email, password hash, public profile, preferences, roles, library ownership, publisher memberships and content you submit. Registration is open and requires email verification. Verification, recovery and email-change links are single-use; stored token records contain digests. Outgoing mail temporarily contains the link needed to complete your request.

Authenticator secrets are encrypted separately. Session tokens are stored as hashes and expire after seven days; password changes and recovery revoke existing sessions. Terms receipts and upload declarations record document versions, content hashes, timestamps and account identity. Connection information and limited security events help prevent abuse and investigate account access.

3. Public and social information

Published games, reviews, community-room messages and public profiles are visible through the corresponding platform features. Private messages are available only to authorized participants and permitted administrative processes. Messages are not end-to-end encrypted; authorized operators can access stored content for support, moderation and legal duties.

Public player counts and sharing online or named-game status with friends are separately controlled by your privacy settings and default off. Account-linked heartbeats support the choices you enable. Public totals do not expose a player roster. Accepted friends see shared activity only while the relevant preference allows it. Blocking and privacy changes affect subsequent authorized reads.

4. Purposes and legal bases

We process information needed for accounts, libraries, publishing and requested communication to perform the service contract (GDPR Article 6(1)(b)). Security, abuse prevention and limited operational records serve our legitimate interests in protecting users and operating a reliable platform (Article 6(1)(f)). Processing required by law relies on Article 6(1)(c). Optional analytics and activity sharing rely on consent (Article 6(1)(a)); you may withdraw those choices without closing your account.

Providing the information necessary for an account is required to use account features. Optional profile information and optional analytics are not required for browsing or a core account. Hatch does not use your submitted games or messages for model training or advertising profiles. Discovery rankings use game activity and other platform signals; they do not make decisions with legal or similarly significant effects about you.

5. Device storage and recipients

Hatch uses Netcup for application and database hosting, Cloudflare for DNS and private game-object storage, and Brevo for transactional email. Mail sent to the published contact address is forwarded by Cloudflare to the operator's Proton mailbox. These providers receive the data needed to supply their respective services. Public content is also available to people who visit or use Hatch. Game developers may process data independently when you run their games; read their own notices.

Some providers use international infrastructure or subprocessors, so processing is not confined to Germany. Contact support@onhatch.gg for information about the providers and applicable international-transfer safeguards. The operator must maintain the relevant provider agreements and transfer documentation; this notice does not certify those arrangements.

The website uses a necessary HttpOnly session cookie for up to seven days and stores cookie choices for 180 days. The desktop client holds its login session in memory and stores installed game files, installation records, preferences and caches on your device. Optional analytics is described separately below.

6. Retention and current limitations

Active game reports stop contributing after 90 seconds without a valid heartbeat and are pruned after 24 hours. Idle online status expires after 60 seconds without a valid heartbeat. Expired sessions and authentication records are removed by scheduled cleanup. Authentication tokens are removed one day after expiry; sent email payloads are cleared after delivery, and remaining outgoing mail is removed within one day. Cleanup requires the worker to run.

In-app notifications and resolved support requests are retained for up to 180 days. Direct messages are retained for up to 365 days unless an open report or appeal requires preservation. Blocking or signing out does not delete earlier messages. Account and publisher records remain while needed to provide the service. Eligible account deletion removes live personal content; publisher obligations and open disputes can require a reviewed deletion request.

Moderation, upload, agreement and security evidence is retained as needed for incident handling, legal duties or the establishment, exercise or defence of claims. These records do not all have automatic expiry. Retained recovery copies, where present, are not edited by live account deletion. Contact support@onhatch.gg for a review of information retained about you. Aggregate analytics remain until removed by the operator; they are not linked to your Hatch account.

7. Your choices and rights

Account settings provides profile changes, personal-data export, password and email changes, privacy controls and account-deletion requests. You may also contact support@onhatch.gg to exercise applicable rights of access, rectification, erasure, restriction, portability or objection. Requests may require proportionate identity confirmation. Rights have statutory conditions and exceptions; withdrawing consent does not change the lawfulness of earlier processing.

You can complain to a data-protection supervisory authority, including the Hessian Commissioner for Data Protection and Freedom of Information (https://datenschutz.hessen.de), or the authority responsible for your place of residence or work.

The beta is for adults aged 18 or older. The age declaration is not identity or age verification. Contact the operator if you believe a child is using Hatch or has submitted personal information.

9. Optional website analytics and cookie settings

With your permission, Hatch uses cookieless Plausible analytics hosted at moon.guesstherank.org for public-page visits and client-download link clicks on onhatch.gg. Requests include your IP address and browser information for processing. Hatch does not attach account names, emails, search queries, private account routes or recovery links. Download-click events include platform and client version; they do not prove a completed download or installation.

Analytics remains off until you allow it in the cookie banner. Cookie settings in the footer lets you withdraw permission to stop future events. This does not erase aggregate statistics already collected. No advertising tracker is configured. Local development and private staging do not send website analytics.

Desktop online-status sharing is controlled separately in account or client privacy settings. Hatch administrators can see an aggregate count of active accounts that share online status through a recent valid desktop session. Multiple sessions count once. This count stays in Hatch and is not sent to Plausible or connected to website visitor identities.