Privacy Policy

For privacy requests and legal notices, the controller responsible for data processing is warmUP Game Launcher (sole proprietor: Levent Yakin), Paulsborner Strasse 91, 10709 Berlin, Germany. Full operator details are in our Imprint.

This Policy covers the Site, the desktop App, api.warmup-gamelauncher.com, ads.warmup-gamelauncher.com, and other warmUP-operated domains or backend routes.

When you join the waitlist on this Site, we store the email address you provide so we can notify you when warmUP launches and send launch-related updates (such as download links and creator-program details).

• We do not sell your email address.
• You can unsubscribe at any time using the link in any email we send, or by contacting us.
• We use a database provider (Supabase) to store waitlist entries. See "Service providers" below for details on third-party infrastructure.

Depending on which features you use, warmUP may process the following categories of data:

• Waitlist data: email address, signup timestamp, and referral source.
• Account and subscription data: user ID, email address, subscription status, selected plan, and Stripe checkout/customer identifiers where you create or sign in to a warmUP account.
• Local library and device data: installed games, custom games, emulator entries, display preferences, controller settings, and local cache data stored on your device.
• Connected account data: profile identifiers and OAuth tokens for services you link, such as Discord, Steam, Epic Games, GOG, or Amazon Games.
• Diagnostics and analytics: event names, screen paths, error messages, app version, operating system, language, and similar technical data, where enabled.
• Network and security data: IP address, request headers, device identifiers, and abuse-prevention metadata.
• Consent records: when you interact with the cookie banner, we log a pseudonymous device identifier, the choice and categories selected, the notice version, the page, a truncated IP address, the user agent, and a timestamp, so we can demonstrate valid consent under Art. 7(1) GDPR. These records are stored in the warmUP CRM; see our Cookie Policy.

We use the following services to run warmUP and this Site:

• Supabase: authentication, database (including waitlist entries and subscription state), and related APIs.
• Stripe: subscription checkout, customer portal, and payment processing. Card and payment details are handled by Stripe and are not stored by warmUP.
• Cloudflare: DNS, TLS, caching, and security for warmUP domains.
• Discord: OAuth profile connection, parties, and social features in the App.
• Instagram / TikTok: if you take part in the creator program, we review publicly posted Reels you tag or share with us under those platforms' own terms.
• Analytics (optional): if enabled, product analytics tooling (e.g. PostHog) may process anonymized or pseudonymous usage events to help us improve the Site and App. See our Cookie Policy for details.
• YouTube (Google): when you choose to play an embedded video on the Site, the player is loaded from YouTube. See "YouTube video embeds" below.

On this Site we use Google Analytics 4, a web analytics service provided by Google Ireland Limited (measurement ID G-84WVV8DWCF), to understand how many people visit the Site and how it is used. We only enable GA4 if you accept optional cookies in our cookie banner. The legal basis is your consent under Art. 6(1)(a) GDPR.

We use Google Consent Mode v2. Until you enable analytics, we do not load Google Analytics and no analytics cookies or comparable storage are set. After you enable analytics, GA4 may use cookies or similar technologies to analyse your use of the Site.

Depending on your interaction with the Site, Google may process data such as a truncated IP address, device and browser information, pages visited, time spent on pages, referrer URL, and approximate location derived from the IP address. Google may transfer data to servers in the United States (Google LLC). Where required, we rely on the EU-US Data Privacy Framework and EU standard contractual clauses as safeguards for such transfers.

Google typically retains event-level analytics data for up to 14 months, after which it is deleted or aggregated. You can withdraw consent at any time with effect for the future via Cookie settings in the Site footer and by turning analytics off. We then stop collecting new analytics data, delete prior consent-based traffic events linked to your browser's pseudonymous device identifier in our systems, and record the withdrawal in our consent audit log. You can also read Google's privacy policy at policies.google.com/privacy and install Google's browser add-on to opt out of GA measurement: tools.google.com/dlpage/gaoptout.

In addition to GA4, we operate our own consent-based reach and usage tracking at ads.warmup-gamelauncher.com/api/traffic. This service runs only after you enable analytics in the cookie banner. It records page views, interactions, and similar usage events and may store a pseudonymous device identifier and session identifier in your browser. If analytics is off, we do not send usage data to this service.

On the landing page we may show a preview image for a YouTube video loaded from YouTube's image servers (i.ytimg.com). The interactive YouTube player is not loaded until you click play and confirm in a separate consent dialog.

If you confirm, we load the player from www.youtube-nocookie.com (a Google service). YouTube may then process data such as your IP address, device and browser information, video interactions, and approximate location derived from the IP address, and may set cookies or use similar technologies on your device. Google may transfer data to servers in the United States (Google LLC). Where required, Google relies on the EU-US Data Privacy Framework and EU standard contractual clauses as safeguards.

The legal basis is your consent under Art. 6(1)(a) GDPR when you choose "Play video" in the embed dialog. Your choice is stored locally in your browser so you are not asked again for the same video on this device. You can withdraw the effect for the future by clearing site data/local storage for this Site or using your browser's privacy controls; we do not operate a separate YouTube account for you.

Google's privacy policy: policies.google.com/privacy. YouTube terms: youtube.com/t/terms.

• operate the waitlist and send launch-related communications;
• provide the launcher, library, account, and subscription features;
• process payments and enforce entitlements;
• run the creator/reward program and verify Reel view counts;
• secure, debug, rate-limit, and improve the Site and App;
• respond to support, legal, and privacy requests;
• comply with legal obligations.

Where applicable law requires a legal basis, we rely on consent, contract performance, legitimate interests, and compliance with legal obligations, depending on the feature and context.

We keep personal data only as long as we need it for the purposes above, and we delete or anonymize it after that. Concretely:

• Waitlist entries: until launch communications are finished, until you unsubscribe, or until you ask us to delete them — whichever comes first, and in any case no longer than 24 months after the last interaction.
• Account and profile data: for as long as your account exists. When you delete your account — in the App under Settings → Privacy → Delete account, or through the deletion form — it is scheduled for permanent deletion and erased within 30 days.
• Connected account data and OAuth tokens: deleted when you disconnect the service or delete your account.
• Diagnostics, analytics, and reach measurement: up to 14 months, or until you withdraw consent, after which consent-based traffic events linked to your device identifier are deleted.
• Network, security, and abuse-prevention logs: short operational periods only, unless a longer period is needed to investigate an incident or defend a legal claim.
• Consent records: up to three years after the consent or its withdrawal, so we can evidence your choice under Art. 7(1) GDPR.
• Invoices, payment records, and accounting documents: retained for the statutory periods — generally six to ten years under German commercial and tax law (§§ 238, 257 HGB, § 147 AO). Data kept for that reason is blocked from any other use and deleted when the period ends.

Deletion on request. On a verified erasure request we delete your personal data within 30 days, except where retention is required by law or is necessary to establish, exercise, or defend legal claims. We confirm receipt in writing and answer within one month (Art. 12(3) GDPR). Local app data remains on your device until you delete it, clear App data, or uninstall the App.

We use reasonable technical and organizational measures, including access controls, encryption in transit, and Supabase Row Level Security. No system is guaranteed to be fully secure.

We and our service providers may process data in the European Union, United States, and other countries. Where required, we rely on appropriate transfer mechanisms such as standard contractual clauses or equivalent safeguards.

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal data, and to withdraw consent at any time — for example by unsubscribing from the waitlist.

How to delete your profile or make any other request. Use our data deletion form — no login and no app install needed. It covers erasure, access to a copy, and corrections, and it is open to warmUP players, website visitors, waitlist subscribers, and business partners of the warmUP Ad Center. You receive written confirmation of receipt with a reference immediately, we answer within one month, and verified deletion requests are completed within 30 days.

If you use the desktop App and are signed in, you can also delete your account yourself under Settings → Privacy → Delete account, and export a copy of your data there. Requests by email to privacy [at] @warmup-gamelauncher [dot] .com or by post are equally valid. We may need to verify your identity before we delete or release data.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). For our establishment in Berlin, the competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit). You may also contact the supervisory authority in your country of residence.

warmUP is not directed to children. Where processing relies on consent, the minimum age is 16 in Germany and the European Union (Art. 8 GDPR), or the lower age set by national law (down to 13) where permitted. If you believe a child provided personal data to us without appropriate consent, contact us and we will take reasonable steps to delete it.

We may update this Policy when features, providers, laws, or business practices change. The latest version will show a new effective date.

Questions or privacy requests: privacy [at] @warmup-gamelauncher [dot] .com