Legal notice and privacy

A fan project

Dungeon Blitz was created and published by Blue Mammoth Games. All rights to the game, its name, logo, artwork, music, sound and every other part of it remain with Blue Mammoth Games and their respective owners. We claim none of them.

Trademarks and game files

"Dungeon Blitz", the Dungeon Blitz logo and "Blue Mammoth Games" are trademarks of Blue Mammoth Games. We use the name only to say which game this server is for. The game client, its artwork, music and data are the work of Blue Mammoth Games; the launcher only delivers them so the game keeps running, with changes and additions for this server. The server software was written from scratch by fans and contains no code from the original server.

For rights holders

If you represent Blue Mammoth Games or Ubisoft and want anything changed or removed, write to the email address in the legal notice. We answer quickly and take the server, the downloads and this website down on request.

Provided as is, without any warranty. Playing is at your own risk; we cannot promise that the server or your progress will stay available.

Deutsch: Dungeon Blitz ist ein Spiel von Blue Mammoth Games; alle Rechte an Spiel, Name, Logo, Grafik, Musik und allen übrigen Inhalten liegen bei Blue Mammoth Games bzw. den jeweiligen Rechteinhabern; „Dungeon Blitz“ und das Logo sind Marken von Blue Mammoth Games. Dieser Server ist ein inoffizielles, nicht-kommerzielles Fanprojekt ohne Gewinnabsicht und steht in keiner Verbindung zu Blue Mammoth Games oder Ubisoft. Die Server-Software ist eine eigene Neuentwicklung ohne Code des Original-Servers. Auf Wunsch von Blue Mammoth Games nehmen wir Server, Downloads und Webseite jederzeit und sofort vom Netz.

Legal notice (Impressum)

Angaben gemäß § 5 DDG

Contact

Email: [email protected]

Verantwortlich für den Inhalt nach § 18 Abs. 2 MStV

Amir Memeti, address as above.

Disclaimer

We check the content of this site carefully but cannot guarantee that it is complete, correct and current. Links to other websites are the responsibility of their operators; we had no reason to object to them when we set them.

Privacy

Controller under the GDPR is the person named in the legal notice. We only process what the game needs to run, and we never sell or share it for advertising.

This website

The website sets no cookies and uses no analytics, tracking or third-party services. Fonts and images are served from our own server. The player counter and rankings load from our own API.

Your game account

• Email address, used to log in. Your password never reaches us in plain text: the game client sends a hash, and we store only a salted hash of that.
• Whether and when you confirmed your email address. To confirm it, we email you an 8-digit code. Until you enter it we keep a hash of the code, the address it went to and when it was sent; the code expires after 30 minutes and the record is removed once the address is confirmed.
• Your heroes and their progress: name, class, appearance, level, items, missions, friends, guild and party, and dungeon scores.
• A record of completed trades between players, to sort out disputes and abuse.

Legal basis is Art. 6 (1) (b) GDPR: we need this data to provide the game you signed up for.

Public information

Hero names, class, level, appearance and dungeon scores are visible to other players in game, in the rankings and in the online counter on this website. Your email address is never shown.

Device identifiers

So that a suspension for cheating or abuse cannot be dodged with a new account, the launcher reads identifiers that already exist on your computer each time you log in: the operating system's machine ID, the hardware UUID or serial number, the serial numbers of the mainboard and BIOS, the serial number of the system disk and the hardware addresses of your network adapters (on Linux, also when the Windows app runs under Wine or Proton). The launcher stores nothing of its own for this. The values never leave your computer in readable form: the launcher hashes each one and sends them encrypted. We store only a keyed hash of each, together with the account, the IP address and when it was last used. We use them for one purpose only: to enforce suspensions and to see which accounts share a device. Never for statistics, advertising or tracking. The launcher shows a short notice about this on its start screen.

The Android app does the same with the identifiers Android offers to every app without special permission: the Android ID, the device ID of the Widevine content protection and, where Android lets any app read it, the serial number of the device or its chip. Like the launcher, it stores nothing of its own for this and sends the values only hashed and encrypted.

The browser version (beta.dungeonblitz.online) reads no device identifiers; there a suspension applies to the account and the IP address. It keeps your game settings (key bindings, sound, quality) in your browser's local storage, on your device only, like the launcher keeps them in its own folder.

Because it is a beta, the browser version sends us technical reports so we can fix bugs and make it run smoothly: errors with their technical details, how fast the game runs (frame rates, slow or frozen frames and what the game was doing at that moment, such as the open window or the area), loading times, dropped connections, and once per visit the browser, operating system, graphics card, screen size and memory of your device. Each visit gets a random number that is not stored on your device, so visits cannot be linked to each other through it; the server links the reports to your account and hero while you play, and stores them with your IP address in the activity log. We use them only to improve the game. Legal basis is Art. 6 (1) (f) GDPR (our legitimate interest in a working game).

The launcher also checks whether it is running inside a virtual machine, using the manufacturer and model the system reports, and the Android app whether it is running in an emulator. Both send only the type, if any. Logins from virtual machines are turned away, and the attempt is kept in the activity log like any other refused login.

A suspension covers the devices the account played on. If another account logs in from such a device, it is suspended too, for the same time and with all devices it played on; lifting the original suspension lifts it as well. A suspended internet connection with an IPv6 address covers the whole connection (the /64 block your provider assigns), because the address inside it changes. A device can create at most three new accounts per day. A computer counts as the same device only if several of its identifiers match, never a single one; on Android the Widevine device ID is enough, because it belongs to the phone's hardware.

Reading these identifiers is part of the game you ask for: an online game that keeps banned cheaters out (§ 25 (2) no. 2 TDDDG). Storing and comparing the hashes is based on our legitimate interest in protecting the game and other players from cheating and abuse (Art. 6 (1) (f) GDPR).

Activity log

The server keeps a log of what happens in the game so that reports can be checked and abuse can be traced: logins and failed logins (with IP address and device), entering and leaving the game, chat messages (local, world, party, guild and whispers), trades, spending of Mammoth Idols, items found (with the party members you were with), progress such as levels, quests and cleared dungeons, party and guild actions, suspected cheating (with the game values that triggered the check, such as damage, position, reported stats or how fast the game clock ran), chat mutes and moderation actions. Legal basis is Art. 6 (1) (f) GDPR.

A word filter stops chat messages with severe abuse (slurs against someone's origin or sexuality, sexual violence, child abuse, Nazi slogans, telling someone to harm themselves). Such a message reaches nobody. It is kept in the log as a report for the team, and a team member decides whether to mute you; the filter itself never mutes anyone. The same filter rejects names of heroes and guilds.

The team can also write internal notes about an account and keep it on a watchlist, for example after a report. These notes are only for the team and are deleted together with the account.

Only the volunteer server team can see it, on an internal Game Master site that is protected by a login. Each team member's rights depend on their role: moderators see names, chat and history but not email addresses, IP addresses or devices. Every action a team member takes is recorded with their name.

Separately, the server's technical logs (connections with IP address, no email addresses) rotate automatically and are overwritten after a short time. When the game client hits an error, it sends the error message to these logs. The Android app also sends a short technical report when it freezes or was closed by Android: the reason Android gives, the app's memory use, the device model and Android version, and where in the app it got stuck. We use these reports only to fix the app.

Hosting

The server runs at Tube-Hosting (Ferdinand Zink), Schlesierstr. 7, 97631 Bad Königshofen, Germany. Our data stays on that server in Germany.

Confirmation codes are sent by email through our mailbox at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The email contains only your address and the code.

How long we keep it

Account data stays until you ask us to delete your account. Then we remove the account and all of its heroes.

• Chat messages and minor cheating checks: 30 days (180 days if flagged as serious).
• Items found: 90 days.
• Technical reports of the browser version: 90 days.
• Logins, device identifiers, IP addresses, entering and leaving the game, progress, party and guild actions: 180 days after they were last used.
• Trades, spending of Mammoth Idols, suspensions, chat mutes and moderation actions: kept, because they decide disputes and keep suspensions working. When an account is deleted they stay without IP address or device.
• Database backups: 30 days.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to its processing and take it with you (Art. 15 to 21 GDPR). Write to the email address in the legal notice from the address you play with; we answer within one month. You can also complain to a data protection supervisory authority.