Metin2 Helper

Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Niklas Friedrich
c/o Online-Impressum.de #3618
Europaring 90
53757 Sankt Augustin
Germany
E-mail: info@m2-helper.com

2. Overview

This website is a non-commercial fan and helper project for the game Metin2. The following principles apply to the handling of your data:

  • No cookies are set for tracking, analytics or advertising purposes.
  • No advertising profiles are created. Optional usage analysis with a self-hosted analytics system requires your consent (section 5a).
  • Personal data is only processed to the extent technically necessary, when you actively use a feature (e.g. the quiz login), or with your consent to optional usage analysis.

The website can be used without providing any personal data. Individual features (such as the quiz with Twitch login) require the data described in the respective sections.

3. Hosting and server log files

This website is hosted by Hostinger (Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus). In addition, a separate virtual server is operated for interactive features (e.g. quiz and real-time event pages). The virtual server used for optional usage analytics is located in Germany.

When you visit the website, the respective server automatically processes information transmitted by your browser (so-called server log files). This includes:

  • IP address of the requesting device
  • date and time of access
  • page or file accessed
  • amount of data transferred and access status
  • referrer URL (previously visited page)
  • browser type and operating system (user agent)

This data is technically required to deliver the website and additionally serves to ensure stable operation and to defend against attacks and misuse. It is not merged with other data sources and is not evaluated on a personal basis.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the secure and stable provision of the website). The log files are stored only as long as required for the purposes mentioned above and are then deleted or routinely overwritten by the hosting provider. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

4. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption (recognisable by "https://" and the lock symbol in your browser's address bar). This prevents third parties from reading data you transmit to the website.

5. Cookies and local storage (localStorage)

This website does not use any cookies for tracking, analytics or advertising purposes. Optional usage analysis requires your prior consent even without cookies. When enabled, you may allow or reject “Usage statistics including heatmaps” as a combined analysis (section 5a).

To provide individual features, information is stored in your browser's localStorage. Tool settings remain local. The quiz login token is sent to the M2-Helper server with authenticated quiz requests:

  • Language setting (German/English/Turkish), so the website is displayed in your language
  • Donation Guild: When you create or import a guild, its name, level, characters, management records (such as donations and guild runs), display settings and modification timestamps are stored under donation-guilds. Changes to these saved guilds are automatically saved locally.
  • Loot-Filter: When you create or import a filter profile, its name, filter selection and creation/modification timestamps are stored under loot-filter-setting-…. loot-filter-settings-list stores the profile list; loot-filter-active-setting remembers your selected profile. Changes to saved profiles are automatically saved locally.
  • Other saved tool settings, where you use the corresponding save feature.
  • Quiz login token, if you actively sign in to the quiz via Twitch (see section 7)

Saving and restoring the guilds and filter profiles you create serves the save feature you choose. Where storage is strictly necessary for the feature you explicitly request, it does not require additional consent under Section 25 (2) No. 2 TDDDG. Consent to usage analysis is not required for this feature.

Retention and deletion: Guilds and filter profiles have no automatic expiry and remain in this browser until you delete them in the relevant tool or clear the site's browser data. Stored data is restored when you return. These contents are not transmitted to a server or to the analytics system. File imports are processed locally; exports create a file on your device. Rejecting or withdrawing analytics does not delete guilds or filter profiles. With consent, analytics may record only that a feature was used successfully, such as an import, without its names or contents.

A single, technically necessary login cookie is used in the operator's password-protected administration area. Regular visitors of the website are not affected by this.

5a. Optional usage analysis and heatmaps

When analytics is enabled, your consent is requested before data is collected. Without consent, no visit-related analytics data is collected, no analytics identifier is created and no activity is buffered for later transmission. All tools remain usable without consent. When the feature is disabled, no optional visit-related analytics data is collected and no consent dialog is displayed. Anonymous total page views, described in section 5b, are separate.

Purpose and combined choice: “Usage statistics including heatmaps” analyses tool usage to make the tools easier to use and navigate. This includes examining how visits reach tools, which features are used and where usability could be improved. Statistics, visit paths and click/scroll heatmaps are parts of this combined analysis. Data is not used for advertising or linked to user accounts. Analytics is off by default. “Accept” gives consent to the described combined analysis; “Decline” keeps it off. Closing the banner, scrolling or continuing to use the site does not give consent.

Usage statistics: The analysis covers public page paths, page language, a broad device category, estimated country, browser family (such as Firefox or Chrome), predefined traffic source categories (such as Google, Discord or direct access) and selected tool actions, such as a completed calculation or Loot-Filter import. Random identifiers in sessionStorage connect page views within one browser tab. They are replaced after 30 minutes without recorded activity or at most 24 hours and removed upon withdrawal. They are not linked to quiz accounts. The separate daily identifier is described below.

Daily visitors: After consent to the updated analytics notice, an additional random daily identifier is stored in localStorage under m2_analytics_daily_browser. It counts the same browser once across tabs and multiple visits within the same UTC day, overall and per public page. It is not derived from IP addresses or device characteristics and is not linked to accounts or heatmap identifiers. It expires at the UTC day boundary; an expired entry is deleted or replaced on the next access, and removed immediately on withdrawal. It is sent to the private analytics system only with consent-based page views. The existing maximum retention of 90 days, including backups, applies there. The additional report contains only daily and per-page counts, no individual identifiers, and covers at most 82 UTC days. Older consent that does not yet include the daily identifier or the new country, browser-family and public expanded/collapsed information requires a new choice in the updated banner on the next page load. Statistics and heatmaps remain off until renewed consent. Choosing “Accept” permits the described analysis including daily counting, country, browser family and public expanded/collapsed states. Previously saved valid rejections remain in place without a new banner. After a new choice, the banner does not reappear on later visits within its validity period. Other devices, browsers or deleted website data may count the same person more than once; these are consenting browsers, not uniquely identified people.

Heatmaps: With the combined consent, click positions, scroll depth and page dimensions are collected. Forms, input fields and areas marked private are excluded. No text, input values, screen videos, DOM copies or session recordings are stored. Heatmaps and statistics use technically separate identifiers; consent covers both parts together. Fixed states of public expandable sections and selected public views are also collected to associate clicks with the matching layout. This includes a layout-version identifier, public-panel identifiers and viewport dimensions, without input values or saved profiles. The preview uses public default content. Non-reproducible result views may be excluded from heatmaps.

Data minimisation and recipients: Processing takes place in a self-hosted analytics system. No analytics data is transmitted to an external analytics provider. Hosting is described in section 3. Your IP address and browser headers are technically received by the collection server but are not stored as raw data or forwarded to the analytics system. After consent, a country is derived there from the IP address using a locally stored country database; only the browser family is derived from the browser header. Only these two broad values reach the statistics. The country-database provider receives no visitor IP addresses; only public mapping lists are downloaded. City, region, browser version and operating system are not collected. VPNs and proxies may indicate a different country, and browser information may be inaccurate. Full referrer URLs, unknown referring domains, URL parameters, fragments, search text, filenames and calculator inputs are not transmitted. Access logging is disabled for analytics endpoints. Analytics data is deleted within 90 days; this limit also applies to backups.

Consent and withdrawal: The legal bases are Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. You may withdraw consent to the combined analysis at any time by opening “Privacy settings” in the footer and choosing “Decline”. Withdrawal stops statistics and heatmaps, removes the local daily identifier, discards unsent data and aborts pending requests. Data already received by the server before withdrawal is not retrospectively deleted by that action. Processing before withdrawal remains lawful; your rights in section 12 continue to apply.

Your choice, timestamp and text version are stored without a user identifier as m2_privacy_v1 in localStorage. The choice is valid for 180 days; expired entries are removed on your next visit. This is used only to respect your choice (Section 25 (2) No. 2 TDDDG; Art. 6 (1) (f) GDPR). Rejection is not sent to the analytics system as an analytics event. Deleting website data resets your choice. When the described analysis is extended, older consent is requested again; saved valid rejections remain in place. No visit-related analytics data is collected until you consent. Previous choices are not automatically converted into new consent.

5b. Anonymous total page views

Regardless of the optional analytics choice, the web server counts deliveries of registered public HTML pages. Only the day (UTC), a predefined public page path including the page language and an accumulated count are stored. These counters contain no individual request records, visitor or session identifiers, IP addresses, browser information, traffic sources, URL parameters or input contents. They use no cookies or browser storage and trigger no additional requests or scripts in the browser. They are not linked to the optional analytics data.

The purpose is to understand which public pages and languages are requested most often overall. Anonymous daily totals are transferred from website hosting to the privately hosted reporting server in Germany and retained for at most 365 days. The report is available only to the administrator. Technical processing during a normal website request, including the IP address needed to deliver the page and hosting logs, is described in section 3 and is separate from these counters. The counters contain no personal data; this counting does not involve additional access to information on the device.

Reloads and automated requests may count. Browser or upstream caches may omit requests. Redirects, error pages, assets and private administration, player or overlay pages are excluded. The totals cannot identify individual visitors, visit paths or consent choices. Withdrawing optional analytics still stops the collection described in section 5a.

6. Externally loaded libraries (CDN)

For the design and functionality of the website, individual program libraries are loaded from third-party servers (so-called content delivery networks, CDN):

  • Socket.IO client (cdn.socket.io) – real-time library, only on individual event pages
  • Chart.js (cdn.jsdelivr.net) – charting library, only on an internal statistics page

When these files are loaded, the respective CDN operator technically receives your IP address and the usual browser information. No cookies are set in this process and no usage profiles are created by this website.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a functional and performant provision of the website). It is planned to gradually include these libraries locally so that no connections to third-party servers are required any more.

The fonts used are hosted locally. No connection to Google servers (Google Fonts) takes place.

7. Quiz with Twitch login

For the Metin2 quiz, you can voluntarily sign in with your Twitch account (OAuth procedure of Twitch Interactive, Inc., 350 Bush Street, San Francisco, CA 94104, USA – a company of the Amazon group).

When you sign in, the following data is received from Twitch and stored:

  • your Twitch user ID
  • your public Twitch display name
  • the URL of your public Twitch profile picture

In addition, your quiz progress (e.g. answered questions, streaks, achievements) is stored in order to display your progress and leaderboards. Your display name and profile picture may appear in public leaderboards; in the quiz settings you can set your profile to "private" at any time so that it is no longer shown in leaderboards. Profile pictures are technically loaded from Twitch servers; in doing so, Twitch receives your IP address.

The login token is stored in your browser (localStorage) and sent to the M2-Helper server to authenticate quiz requests. It is deleted when you log out. Your Twitch password is never transmitted to this website.

Legal basis: Art. 6 (1) (b) GDPR (provision of the quiz feature you request). When signing in via Twitch, data is transmitted to Twitch (USA); Twitch and Amazon are certified under the EU-US Data Privacy Framework. In addition, the Twitch privacy notice applies.

Your quiz data is stored for as long as your quiz account exists. You can request the deletion of your account and all associated data at any time by e-mail to info@m2-helper.com.

8. Real-time features (WebSocket)

Individual pages (e.g. quiz rooms and live event pages) establish a direct connection (WebSocket) to the M2-Helper server in order to update content in real time. In doing so, your IP address and the data required for the respective feature (e.g. quiz answers) are technically processed. No data is passed on to third parties. Legal basis: Art. 6 (1) (b) or (f) GDPR.

9. Forms and contact

Creator suggestions

On the creators page, you can suggest content creators (name, YouTube/Twitch link, description). This information is stored on the server and used exclusively to review the suggestion and, if applicable, add the creator to the creator list. Please only provide information that the respective creator has made public themselves. Legal basis: Art. 6 (1) (f) GDPR. Suggestions that are not accepted are deleted.

Loot filter requests

The loot filter tool allows reporting missing items. Only the entered item name is stored; no personal data is collected in this process.

E-mail contact

When making contact by e-mail, your details (e-mail address, content of the message) are processed to handle the enquiry and are not passed on to third parties. Legal basis: Art. 6 (1) (b) or (f) GDPR. The data is deleted as soon as it is no longer required for processing and no statutory retention obligations apply.

10. Event pages related to Twitch

Community event pages (e.g. hardcore event, mob hunt, awakening) display public Twitch channel names and links to Twitch clips of participating streamers. Participation in these events is voluntary; only publicly available channel information is displayed. Twitch content is not embedded, only linked – when you click a link, Twitch's privacy policy applies.

11. External links

This website contains links to external websites (e.g. Discord, Metin2 wikis, YouTube, Twitch). Their content and data processing are outside M2-Helper's control. When you open external links, the privacy policy of the respective provider applies.

12. Your rights

With regard to your personal data, you have the following rights:

  • Access to the data processed (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure ("right to be forgotten", Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR)
  • Withdrawal of granted consent with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, an informal e-mail to info@m2-helper.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence or the place of the alleged infringement. An overview of the German supervisory authorities can be found at bfdi.bund.de.

13. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

14. Updates and changes to this privacy policy

This privacy policy will be updated as soon as the functionality of the website or the legal situation changes. The current version published here applies. In the event of discrepancies between the language versions, the German version prevails.

Last updated: October 2026