Your privacy

Privacy policy.

Last updated: 19 October 2026

1. Controller and scope

This policy covers visits to anvilanddragon.com and enquiries sent to us. Individual games and external distribution platforms may have separate privacy information.

2. Hosting and technical access data

This site is hosted by World4You Internet Services GmbH, Wolfgang-Pauli-Straße 2, BT3, 4020 Linz, Austria. Delivering a page requires processing your IP address. Access and error logs may also contain request time, requested address, status code, transferred data volume, browser and operating system details and the referring page where supplied by your browser.

The purposes are website delivery, troubleshooting and protection against misuse. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in reliable, secure operation. Hosting providers receive the data needed to supply these services. See world4you’s privacy information.

According to World4You, web server and mail log files are retained for two weeks and then automatically deleted. These logs support operational security and troubleshooting; web server logs are also used for technical access statistics. This period concerns technical logs, not the content of emails or enquiries.

3. Email and phone enquiries

We process the contact details, message and communication metadata you provide to respond to your enquiry. Providing information is voluntary, but without sufficient information we may be unable to reply. Email and telecommunications service providers may process the data needed for delivery.

The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual enquiries, or Article 6(1)(f) GDPR for our legitimate interest in answering other enquiries. Contact details and enquiries are retained for six months to handle the enquiry and possible follow-up, then deleted unless statutory retention duties or the establishment, exercise or defence of legal claims require retention. In those cases the applicable statutory period or relevant limitation period determines retention.

4. Cookies, language and WordPress administration

Language versions are managed by Polylang within this WordPress website. The language is reflected in the page path and can be changed using EN/DE. Polylang may remember the last chosen language in the functional cookie “pll_language”, with a default lifetime of one year. It contains a language code and supports language selection, not analytics or advertising. You can delete it in your browser.

The current studio site does not use analytics or advertising cookies. Visiting the login screen and authorised administration may involve technically necessary WordPress cookies for testing cookie support, securing login sessions and remembering language or settings. Reading the public studio pages does not require a visitor account.

Session cookies expire with the session. Persistent login and preference cookies remain until expiry or deletion; duration depends on the “Remember Me” choice and WordPress settings. The legal basis for personal-data processing is Article 6(1)(f) GDPR, reflecting our interest in secure, usable administration. You can delete or block cookies in your browser, which may prevent login.

5. Page-view statistics, content and external services

Statify

We count page views using Statify within our WordPress installation. Date, source and destination page, plus a technical record ID, are stored for 90 days; older records are automatically cleaned up. Statify uses no cookies, stores no IP addresses, creates no visitor profiles and sends no statistics to external analytics providers. It counts page views, not individual visitors. Logged-in users are excluded. See Statify’s privacy information.

Studio images and font files are served from this website’s server. The current studio site does not use Google Analytics, advertising pixels, newsletter signup, payment processing, contact forms, or embedded YouTube, social-media or Steam widgets. The studio and game pages do not offer comments.

External services are linked through ordinary links. Opening a link connects you to that provider, whose privacy information then applies; this may include processing outside the EEA. Our current studio site does not initiate additional third-country transfers to analytics or advertising providers. Hosting subprocessors and any necessary transfer safeguards are governed by the applicable service documentation.

6. Recipients, security and deletion

Data access is limited to people and service providers who need it for the stated purposes, and recipients where disclosure is legally required. We do not sell visitor data. This website uses HTTPS encryption. Processing on our behalf must comply with Article 28 GDPR. Data is deleted when its purpose ends, subject to legal retention duties and necessary legal defence. We do not use visitor profiling or solely automated decisions producing legal or similarly significant effects.

7. Your rights

Subject to the legal requirements, you may request access, rectification, erasure, restriction and data portability. Where processing relies on consent, you may withdraw it prospectively without affecting the lawfulness of earlier processing.

Objection: You may object to processing based on legitimate interests on grounds relating to your particular situation. Please use the controller’s contact details above.

You may complain to a competent supervisory authority. In Austria: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at.

8. Updates

We update this notice when website functionality or processing changes. Future analytics, newsletter, video or shop features are not covered in advance. Last updated: 19 October 2026.