Privacy policy

Last updated:

On this page

This policy explains what happens with your data when you visit www.fs-studios.com.

In short: this website uses necessary cookies when you log in to your Fire Sword account. It shows no consent banner. We count visits anonymously with our own analytics. Videos from YouTube load only when you click them. If you email us, we use your message only to answer you.

Who is responsible

Fire Sword Studios GmbH, Bergmillergasse 4, 1140 Vienna, Austria. Email: contact@fs-studios.com. More company details are in the imprint.

Hosting and server logs

This website runs on our own server, located in a data center in the EU.

When you open a page, your browser automatically sends technical data to our server, such as your IP address and browser details. Our server records only a small part of it in its logs:

  • your IP address, shortened so that its last part is removed,
  • the date and time of the request,
  • the page or file requested, without any query parameters,
  • whether the request worked (status code) and how much data was sent.

We need this data to deliver the website and to keep it secure, for example to detect attacks and errors. The legal basis is our legitimate interest in a working, secure website (Art. 6(1)(f) GDPR). We keep these logs only as long as we need them for this purpose, then we delete them.

Anonymous statistics

We count visits with Umami, an analytics tool that we run ourselves at analytics.fs-studios.com on our own server. No data goes to a third party.

  • Umami sets no cookies and does not store anything on your device.
  • Umami does not store your IP address. To tell visits apart, it creates an anonymous session ID from a hash of your IP address and browser details combined with a secret value that changes regularly, so visits cannot be linked over a longer time.
  • It records the pages you view, the website you came from (referrer), your browser, operating system, device type, screen size, language and approximate location (country, and where available region and city). The location is worked out from your IP address at the time of the visit; the IP address itself is not stored.

We use these statistics to see which pages are useful and to improve the website. The legal basis is our legitimate interest in anonymous visitor statistics (Art. 6(1)(f) GDPR). You can block the analytics script with any content blocker; the website works the same without it.

We keep the statistics as long as we need them to improve the website. Encrypted backups of the statistics database are stored in the EU and kept for up to 18 months.

Cookies and data stored in your browser

While you are not logged in, this website sets no cookies and stores nothing in your browser, except when you choose to play a YouTube video (see below).

When you start a Fire Sword account login, the account service uses these necessary cookies on www.fs-studios.com:

Cookie Purpose Lifetime
__Host-fss_account_login Connects the login you started to your browser 10 minutes
__Host-fss_account_sid Keeps you logged in; we store only a hash of the random session identifier Until logout, at most 24 hours without activity and 14 days in total
__Host-fss_account_hint Contains only “1”, so the website can avoid account requests for visitors who are not logged in Same as the session

These cookies are limited to this website, sent only over encrypted connections, and are not used for tracking or advertising. Our sign-in page at auth.fs-studios.com also uses the cookies needed for sign-in. The websites at www.fs-studios.com and www.perfecttower2.com (opens in a new tab) keep separate sessions.

If you open an email-change confirmation link while logged out, its one-time code waits in that tab’s session storage while you sign in. It is removed when used and expires there after 30 minutes.

These cookies and temporary storage are necessary for the login and account functions you request, rather than advertising or analytics (� 165(3) TKG 2021 (opens in a new tab)).

Fonts and images

All fonts, images and scripts on this website come from our own servers. We do not load fonts or scripts from other companies.

YouTube videos

Some game pages, such as Herdles, show a trailer from YouTube. At first you only see a picture from our own server. The video loads only after you click it, from youtube-nocookie.com, YouTube’s privacy-enhanced mode.

Once it loads, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which runs YouTube, receives your IP address and browser details, and YouTube may store cookies or similar data in your browser. Google may also process this data in the USA. The legal basis is your consent, given by clicking the video (Art. 6(1)(a) GDPR). Google LLC is certified under the EU-U.S. Data Privacy Framework, so the transfer to the USA is based on the European Commission’s adequacy decision for certified companies (Art. 45 GDPR). You can check the certification at dataprivacyframework.gov (opens in a new tab). Google’s privacy policy (opens in a new tab) applies to the video.

When you email us

If you email us, for example through the contact section of our software page, we receive your email address, your name if you include it, and your message. We use them only to answer you and to handle your request.

If your message is about a project or another contract with us, the legal basis is taking the steps you asked for before a contract, or the contract itself (Art. 6(1)(b) GDPR). For all other messages it is our legitimate interest in answering them (Art. 6(1)(f) GDPR). We keep emails as long as we need them for your request, and longer only where tax or commercial law requires us to keep business letters.

Your Fire Sword account

At /account, you can manage your Fire Sword account, which is also used for our games and connected services. The page talks to our own account service on our own servers.

  • Profile: we read your username, email address, optional names and language from our sign-in system. Changes are saved there. A new email address is used only after you open a confirmation link sent to it while signed in to the same account. The pending address and a hash of its confirmation token expire after 24 hours; the old address receives a notice once the change is complete. Passwords and authenticator secrets stay in our sign-in system.
  • Public profile picture: an optional uploaded picture is shown next to your username in participating services, including Community, and is public. We crop and re-encode the image and remove its metadata. Replacing or removing it deletes the old picture files.
  • Security: the page shows your sign-in methods, active sessions and account security history. Session information can include the network address and browser or app involved. Sign-in events in our sign-in system are kept for 90 days. Records of changes made through these account settings are kept for up to 400 days. You can sign out other sessions from the page.
  • Data exports: you can request a PDF and ZIP export from the connected account, GameAPI, Nova chat, Community and wiki services. Only you can download your export after a recent login. Export files are deleted seven days after they are ready and are excluded from backups. For other or historical data, or help exercising your rights, contact contact@fs-studios.com.
  • Account deletion: self-service deletion is not enabled in this release. To request deletion or discuss data that must be retained, contact contact@fs-studios.com.

The legal basis for providing the account functions you request is Art. 6(1)(b) GDPR; for responding to data-rights requests it is Art. 6(1)(c) GDPR. We protect accounts against abuse under our legitimate interest in a secure service (Art. 6(1)(f) GDPR). Account request logs record the request time, method, path without query parameters, result and duration; the application access log does not record the client IP address. Central operational logs are retained for 14 days, and local service logs rotate when their storage limit is reached.

Account records and profile pictures are included in encrypted backups stored in the EU and retained for up to 18 months. Data removed from the live service disappears from those backups when they expire. Copies of account settings, privacy requests and security records remain private; a profile picture is public only while it is being used by an active account.

Our games and other websites

Our games and their websites have their own privacy policies, for example perfecttower2.com (opens in a new tab) and the browser games at games.fs-studios.com (opens in a new tab).

We also link to other websites, for example Steam, Discord, YouTube and social media. The icons in our footer are plain links: nothing is loaded from those services until you click one. When you follow a link, the privacy policy of that website applies.

Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you (Art. 15),
  • have it corrected (Art. 16),
  • have it deleted (Art. 17),
  • restrict its processing (Art. 18),
  • receive it in a portable format (Art. 20),
  • object to processing based on our legitimate interest (Art. 21),
  • withdraw your consent at any time, with effect for the future (Art. 7(3)).

To use these rights, email contact@fs-studios.com. Because our statistics are anonymous, we usually cannot link them to you.

You also have the right to complain to a data protection authority. In Austria this is the Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, Austria, dsb.gv.at (opens in a new tab). You can also contact the authority in the EU country where you live.

Changes to this policy

We update this policy when the website changes, for example when we add a new feature. The date at the top of this page shows the last change.

Back to top