Privacy Policy
Updated 2 November 2026
1. Controller and contact
The controller is Efe Guener, Silcherstrasse 12, 74405 Gaildorf, Germany. For privacy requests contact support@propplanets.com. Our legal notice contains the operator details.
2. What we process and why
| Feature | Data and purpose | Legal basis |
|---|---|---|
| Website delivery and security | IP address, request time, requested URL, browser and error information needed to deliver pages, investigate faults and prevent abuse. | Art. 6(1)(f) GDPR: reliable, secure operation of the website. |
| Accounts and requested account features | Email, authentication credentials handled by Supabase Auth, user ID, chosen display name, favorites, preferences, XP and activity needed for the features you use. | Art. 6(1)(b) GDPR: providing the account services you request. |
| Voting and free XP spins | User ID, vote/session or spin request, result and timestamp. These allow one vote per applicable period and six free spins per UTC day, consistent saved scores and protection against duplicate requests. Public voting results contain totals; individual voting records are not published. | Art. 6(1)(b) GDPR for the requested feature; Art. 6(1)(f) for abuse prevention and integrity. |
| Contact and corrections | Name, reply email, subject, message and any source link you supply, to answer your request and review corrections. The form uses a keyed IP hash to limit automated messages; raw IP addresses are not stored in that limiter table. | Art. 6(1)(f) GDPR: answering inquiries and maintaining accurate information; Art. 6(1)(b) where the request concerns your account service. |
| Giveaways, when open | Confirmed account ID, campaign ID and entry time to administer participation. The account email can be used to contact an entrant about that campaign. Each campaign must publish its own prize, dates and terms before opening. No giveaway entry is created merely by visiting. | Art. 6(1)(b) GDPR: administering the participation agreement. |
| Firm reviews and private trading evidence | Account ID, display name, selected firm, star rating, review title/text, timestamps, moderation status/reason and a redacted trading-history screenshot to check that a review relates to the reviewer’s own trading experience. Approved reviews publish the display name, firm, rating, text and review dates. Email, account ID, moderation notes and screenshots are not public. Only authorized website administrators can inspect the private screenshot. We record evidence access and moderation decisions to protect the integrity of the process. | Art. 6(1)(b) GDPR: providing the optional review and evidence-checking service you request. Art. 6(1)(f) GDPR: preventing manipulation, protecting private data and keeping a consistent moderation record. |
Registration and participation are optional. Required account or form fields are needed to provide that particular feature; you can browse comparisons without an account. Reviews require a private trading-history screenshot, not an identity document. Remove account numbers, balances, contact/payment details, access tokens and third-party information before uploading. We never ask for trading passwords. Screenshots are used only to check the submitted experience, not to contact the trading firm or for marketing. A purchase receipt alone is not sufficient. The browser prepares a JPEG and strips image metadata before submission. Do not upload sensitive documents or information that is unnecessary for this check.
3. Browser storage and analytics
Necessary local or session storage keeps your sign-in session, requested preferences and favorites, privacy-settings state and feature caches. “Remember me” stores the session across browser restarts; otherwise it is kept in session storage. Signing out removes authentication state. You can clear remaining local data in your browser; this may reset settings or sign you out. Storage needed for a service you explicitly request is used under § 25(2)(2) TDDDG, with the GDPR bases described above.
If you enable website statistics in Cookie preferences, we use Umami Cloud (Umami Software, Inc.) to understand visits, page views, traffic sources and clicks on partner links. Umami receives limited page and referral information, approved campaign labels and technical information such as browser and device data. Partner click events contain the destination domain. The tracker does not use analytics cookies. We use your consent under Art. 6(1)(a) GDPR. You can withdraw consent for future collection at any time from Cookie preferences in the footer. We store your choice locally for up to 180 days. Marketing tracking is disabled. React, the Supabase SDK, styles, Inter font and existing catalog logos are served locally rather than loaded from script or font CDNs.
4. Providers and external links
- Vercel hosts pages and the contact endpoint and processes technical request data. Vercel privacy information.
- Supabase provides authentication and the database for accounts, favorites, preferences, votes, XP, campaigns and community counts. Your browser connects to our Supabase project when these services load. Supabase privacy information.
- Zoho Mail handles messages sent to our support mailbox. Zoho privacy information.
Community member counts are refreshed centrally from Discord; visitors do not need to contact Discord to load those counts. Clicking a Discord invitation, an official source or a firm offer opens the external provider. Affiliate offers can include a referral code identifying PropPlanets; those providers may process referral and purchase information under their own policies. We do not submit your account email to a firm merely because you click Visit.
Providers and their subprocessors may process data outside the EEA, including in the United States. Transfers require an applicable adequacy decision or appropriate safeguards such as EU standard contractual clauses, as relevant to the provider and processing. Provider privacy and subprocessor information describes their arrangements; you can request information about the safeguards applicable to your data from us. The use of a provider is not a claim that all processing takes place exclusively in Germany.
5. Retention
- Reviews: text, rating, display name, account link and moderation/access records remain while the review exists. You can remove your review and its associated evidence in the firm profile; account deletion also removes them. Submitted review content cannot be edited. Reviews can be removed from My Galaxy or the firm profile.
- Private review evidence: removed from the active database within 30 days of each submission, plus up to one hour for scheduled cleanup, or earlier when you remove the review or delete the account. Pending reviews with expired evidence cannot be approved and require a fresh submission. Approved reviews keep their evidence-check date after screenshot deletion. Provider backups may retain prior copies until the provider’s backup retention expires; these copies are not used for new review checks. Submission-limit records are removed after at most three UTC calendar days.
- Accounts, preferences and favorites: while you maintain an account, then removed on an applicable deletion request unless retention is legally required or necessary for a specific dispute. Authentication records are handled as part of account deletion.
- Voting records and scores: while the account is maintained to preserve voting limits and your account history. On account deletion, monthly votes and account-linked reward records are deleted; daily votes may remain with their user ID removed.
- Spin request history: automatically removed after 90 days. This history is separate from the saved total XP score.
- Contact rate-limit records: removed after one day. Support correspondence is kept for the inquiry and necessary follow-up or dispute handling; legally required business correspondence may need to be retained longer.
- Giveaway participation: for the campaign, fulfillment and necessary objection/dispute period described in its terms; an account-deletion request is reviewed in light of any ongoing fulfillment.
- Hosting and operational logs: for delivery, fault investigation and security, subject to the hosting provider’s configured log windows. Logs needed for a specific security incident may be retained until that incident is resolved.
- Browser data: session storage normally ends with the tab/session; local settings and caches remain until cleared, replaced by the relevant feature or removed on sign-out where applicable.
6. Your rights
You can request access, correction, deletion, restriction and portability where the legal conditions apply. You can object to processing based on legitimate interests, including on grounds relating to your particular situation. If processing is based on consent, you can withdraw it for the future. We may need to verify your identity before fulfilling a request. Contact support@propplanets.com; please do not send a password or unnecessary identity documents.
You may complain to a supervisory authority, including the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg: baden-wuerttemberg.datenschutz.de.
7. Automated decisions and updates
We do not use your data for automated decisions producing legal or similarly significant effects. Automatic vote limits, spin outcomes and XP calculations are site features, not assessments of creditworthiness or trading ability. We update this policy when the actual services or processing change.