Privacy policy
This policy explains what personal data we process when you visit smilestone.games or write to us, why we process it, and what rights you have. It is written under the EU General Data Protection Regulation (GDPR) and German data protection law.
Last updated: 3 September 2026
Who is responsible
The controller responsible for data processing on this website is: Niklas Tomkowitz, smilestone games Schönhauser Allee 182A 10119 Berlin, Germany Email: hello@smilestone.games We have not appointed a data protection officer, as we are not required to do so.
The short version
We collect as little as possible. This website sets no cookies for visitors, uses no analytics or tracking, and loads no fonts, scripts or content from third parties. Personal data is processed only in two situations: technical server logs when you visit the site, and your message when you write to us.
Hosting and server logs
This website is hosted by Railway Corp., San Francisco, USA ("Railway"). Our servers and our database are located in the European Union (Amsterdam, Netherlands). When you visit the site, the web server automatically records technical data in server logs: your IP address, the date and time of the request, the page requested, the HTTP status code, the amount of data transferred, the page you came from (referrer), and your browser and operating system (user agent). This data is necessary to deliver the website to your device, to keep the site secure and stable, and to investigate misuse. The legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in operating a secure and reliable website. Log data is kept by our hosting provider for a limited period (no longer than 30 days) and then deleted. We do not combine log data with any other data about you. Railway processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Where Railway, as a US company, could access data from outside the EU (for example for support or maintenance), this is safeguarded by the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). Railway's privacy policy: railway.com/legal/privacy
Writing to us
You can write to us through the letter form on this website or by email to hello@smilestone.games. Letter form: when you send a letter, we process the name you enter, your email address, your message, the time it was sent, your IP address and your browser's user agent. We use your data solely to read and answer your message. The legal basis is Art. 6 (1) (b) GDPR where your message concerns a contract with us or a request you make to us, and otherwise Art. 6 (1) (f) GDPR — our legitimate interest in communicating with people who contact us. Your IP address and user agent are stored to protect the form against misuse (see "Spam protection"). Messages are stored in our database in the EU. If email delivery is enabled, a copy of your message is also delivered to our mailbox through the email service Resend (Resend, Inc., San Francisco, USA), which acts as our processor under Art. 28 GDPR; the transfer of your name, email address and message to the US is safeguarded by the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). Resend's privacy policy: resend.com/legal/privacy-policy Email: if you email us directly, we process your email address, the content of your message and any details you choose to include, for the same purposes and on the same legal basis. We delete letters and emails no later than twelve months after the conversation has ended, unless we are legally required to keep them longer.
Spam protection
To keep the letter form free of automated spam we use two measures that involve no third parties: a hidden form field that only automated programs fill in, and a limit on how many letters can be sent from one IP address within a short period. For this purpose your IP address is processed briefly in the server's memory. The legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in protecting the form against misuse.
Cookies and similar technologies
This website does not set cookies for visitors and does not store or read any other information on your device. The only cookie used on this domain is a login session cookie for the site's administrator while signed in to edit content; it is strictly necessary for that function (§ 25 (2) no. 2 TDDDG) and is never set for visitors. Because we use no cookies or tracking, no consent banner is shown.
Links to other websites
This website links to external sites, in particular the Steam store (operated by Valve Corporation) and our media kit on Google Drive (operated by Google Ireland Limited). These are plain links: no content from those providers is loaded into this website, and no data is sent to them by merely visiting our site. Once you follow a link, the privacy policy of the respective provider applies.
Team platform
Our team platform is a separate, login-protected application used by members of our team. It is not accessible to visitors of this website, and the members using it receive the information about its data processing directly from us.
Your rights
Under the GDPR you have the following rights regarding your personal data: • Access (Art. 15 GDPR): to learn whether we process data about you and to receive a copy of it. • Rectification (Art. 16 GDPR): to have inaccurate data corrected. • Erasure (Art. 17 GDPR): to have your data deleted where we have no reason to keep it. • Restriction of processing (Art. 18 GDPR). • Data portability (Art. 20 GDPR): to receive the data you provided in a structured, commonly used, machine-readable format. • Objection (Art. 21 GDPR): where we process your data on the basis of legitimate interests, you may object at any time for reasons arising from your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. To exercise any of these rights, email hello@smilestone.games. There is no charge. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, www.datenschutz-berlin.de — you may also contact the authority of your own place of residence.
Automated decisions, security and changes
We do not use automated decision-making or profiling. Providing personal data is voluntary: you can use this website without giving us any data beyond the technical log data described above, and we only need your contact details if you wish to write to us. All connections to this website are encrypted (TLS). We will update this policy when our processing or the legal requirements change; the current version is always available on this page.