Privacy Policy

We now keep two records tied to your warmUP account: a sign-in log, and how often and how long the launcher is open.

• Every successful sign-in to a warmUP account is recorded with the time, the app version, your operating system and CPU architecture, and the pseudonymous installation ID your device already uses for device attestation. A two-letter country is stored only when our hosting provider has already resolved it. Your IP address is not stored.
• When you open warmUP while signed in, we record that it was opened and roughly how long it stayed open. That tells us how much the launcher is actually used, so we can decide what to build next and keep the service running. Aggregated, non-personal figures such as the total number of active users may be shared with business partners and advertisers; individual records never are, and this data is not used to target advertising at you.
• Neither record contains anything about your game library, play time per game, or what you do inside the App.
• Sign-in records are deleted after 24 months at the latest, usage records after 14 months, and both immediately when you delete your account. You can download them at any time through Settings → Privacy → Export my data in the App, and you can object to the usage records at any time.
• Optional diagnostics telemetry stays separate and stays your choice — it only covers crash and error reporting. In the App you can accept this Policy with or without it, and change your choice any time in Settings → Privacy.

For privacy requests and legal notices, the controller responsible for data processing is warmUP Game Launcher (sole proprietor: Levent Yakin), Paulsborner Strasse 91, 10709 Berlin, Germany. Full operator details are in our Imprint.

This Policy covers the Site, the desktop App, api.warmup-gamelauncher.com, ads.warmup-gamelauncher.com, and other warmUP-operated domains or backend routes.

When you request the free warmUP download on this Site, we store the email address you provide so we can process your download request and manage related account or support follow-up in our CRM.

Separately, you may optionally consent to receive warmUP product updates by email. That consent is never required for the download. If you choose "Receive updates & download", we record your choice (including consent text version and timestamp) so we can demonstrate valid consent. Choosing "Download once. No future updates" means we will not send product-update emails. You can withdraw anytime via the unsubscribe link in any update email or by contacting us.

• We do not sell your email address.
• Product-update emails are only sent when you have given consent.
• Entries are stored in our CRM (warmUP Ad Center / AI Sales Engine) and may be queued via Cloudflare infrastructure. See "Service providers" below.

Depending on which features you use, warmUP may process the following categories of data:

• Download sign-up data: email address, signup timestamp, optional product-updates consent (yes/no), consent text version, and referral source.
• Account and subscription data: user ID, email address, subscription status, selected plan, and Stripe checkout/customer identifiers where you create or sign in to a warmUP account.
• Account sign-in records: for each successful sign-in or account creation in the App, the time, whether it was a sign-in or a sign-up, the App version, operating system version, CPU architecture, the pseudonymous installation identifier of the device, and — only where our hosting provider has already resolved it — a two-letter country code. Your IP address is not stored in this record. See Account sign-in records below.
• App usage records: for each time you open warmUP while signed in, the start time, the time of the last sign of life, the end time where the App closes normally, the App version, operating system version, CPU architecture, the pseudonymous installation identifier, and — where already resolved by our hosting provider — a two-letter country code. No IP address is stored, and no record is made of which games you own, launch, or play. See Account and usage records below.
• Local library and device data: installed games, custom games, emulator entries, display preferences, controller settings, and local cache data stored on your device.
• Connected account data: profile identifiers and OAuth tokens for services you link, such as Discord, Steam, Epic Games, GOG, or Amazon Games.
• Diagnostics and analytics: event names, screen paths, error messages, app version, operating system, language, and similar technical data, where enabled.
• Network and security data: IP address, request headers, device identifiers, and abuse-prevention metadata.
• Consent records: when you interact with the cookie banner, we log a pseudonymous device identifier, the choice and categories selected, the notice version, the page, a truncated IP address, the user agent, and a timestamp, so we can demonstrate valid consent under Art. 7(1) GDPR. These records are stored in the warmUP CRM; see our Cookie Policy.

We use the following services to run warmUP and this Site:

• Supabase: authentication, database (including subscription state), and related APIs.
• Stripe: subscription checkout, customer portal, and payment processing. Card and payment details are handled by Stripe and are not stored by warmUP.
• Cloudflare: DNS, TLS, caching, and security for warmUP domains.
• Discord: OAuth profile connection, parties, and social features in the App.
• Instagram / TikTok: if you take part in the creator program, we review publicly posted Reels you tag or share with us under those platforms' own terms.
• Analytics (optional): if enabled, product analytics tooling (e.g. PostHog) may process anonymized or pseudonymous usage events to help us improve the Site and App. See our Cookie Policy for details.
• YouTube (Google): when you choose to play an embedded video on the Site, the player is loaded from YouTube. See "YouTube video embeds" below.

On this Site we use Google Analytics 4, a web analytics service provided by Google Ireland Limited (measurement ID G-84WVV8DWCF), to understand how many people visit the Site and how it is used. We only enable GA4 if you accept optional cookies in our cookie banner. The legal basis is your consent under Art. 6(1)(a) GDPR.

We use Google Consent Mode v2. Until you enable analytics, we do not load Google Analytics and no analytics cookies or comparable storage are set. After you enable analytics, GA4 may use cookies or similar technologies to analyse your use of the Site.

Depending on your interaction with the Site, Google may process data such as a truncated IP address, device and browser information, pages visited, time spent on pages, referrer URL, and approximate location derived from the IP address. Google may transfer data to servers in the United States (Google LLC). Where required, we rely on the EU-US Data Privacy Framework and EU standard contractual clauses as safeguards for such transfers.

Google typically retains event-level analytics data for up to 14 months, after which it is deleted or aggregated. You can withdraw consent at any time with effect for the future via Cookie settings in the Site footer and by turning analytics off. We then stop collecting new analytics data, delete prior consent-based traffic events linked to your browser's pseudonymous device identifier in our systems, and record the withdrawal in our consent audit log. You can also read Google's privacy policy at policies.google.com/privacy and install Google's browser add-on to opt out of GA measurement: tools.google.com/dlpage/gaoptout.

In addition to GA4, we operate our own consent-based reach and usage tracking at ads.warmup-gamelauncher.com/api/traffic. This service runs only after you enable analytics in the cookie banner. It records page views, interactions, and similar usage events and may store a pseudonymous device identifier and session identifier in your browser. If analytics is off, we do not send usage data to this service.

On the landing page we may show a preview image for a YouTube video loaded from YouTube's image servers (i.ytimg.com). The interactive YouTube player is not loaded until you click play and confirm in a separate consent dialog.

If you confirm, we load the player from www.youtube-nocookie.com (a Google service). YouTube may then process data such as your IP address, device and browser information, video interactions, and approximate location derived from the IP address, and may set cookies or use similar technologies on your device. Google may transfer data to servers in the United States (Google LLC). Where required, Google relies on the EU-US Data Privacy Framework and EU standard contractual clauses as safeguards.

The legal basis is your consent under Art. 6(1)(a) GDPR when you choose "Play video" in the embed dialog. Your choice is stored locally in your browser so you are not asked again for the same video on this device. You can withdraw the effect for the future by clearing site data/local storage for this Site or using your browser's privacy controls; we do not operate a separate YouTube account for you.

Google's privacy policy: policies.google.com/privacy. YouTube terms: youtube.com/t/terms.

• process free download sign-ups and, where consented, send product updates by email;
• provide the launcher, library, account, and subscription features;
• process payments and enforce entitlements;
• run the creator/reward program and verify Reel view counts;
• secure, debug, rate-limit, and improve the Site and App;
• respond to support, legal, and privacy requests;
• comply with legal obligations.

Where applicable law requires a legal basis, we rely on consent, contract performance, legitimate interests, and compliance with legal obligations, depending on the feature and context.

Account sign-in records are separate from the optional diagnostics telemetry you can switch on and off in the App. Whenever you sign in to a warmUP account or create one, we record the time, whether it was a sign-in or a sign-up, the App version, your operating system version, CPU architecture, and the pseudonymous installation identifier your device already uses for device attestation. Where our hosting provider has already resolved a country from the connection, we store that two-letter country code. We do not geolocate you ourselves and we do not store your IP address in this record.

We keep this log to secure your account and support you: it lets us and you answer "when and from which of my devices was this account used", detect account takeover, and reproduce version-specific problems. The legal bases are performance of the contract (Art. 6(1)(b) GDPR) for operating your account and our legitimate interest in the security of the service (Art. 6(1)(f) GDPR). It is therefore not covered by the diagnostics toggle and continues even if you decline optional analytics.

The log records nothing about your game library, play time, or what you do inside the App, and it is never used for advertising or profiling. You can export the full log at any time through Settings → Privacy → Export my data, and you may object to the processing under Art. 21 GDPR using the contact details in section 14.

App usage records. Separately from the sign-in log, we record when warmUP is opened while you are signed in and roughly how long it stays open. The App reports the start, sends a sign of life every few minutes while it runs, and reports the end when it closes normally; a session whose signs of life stop is treated as ended at the last one, so a crash cannot leave an open-ended record. Alongside it we store the same coarse client facts — App version, operating system, CPU architecture, installation identifier, and a country only where already resolved by our hosting provider.

We use this to understand how much warmUP is actually used, to plan what to build next, to size the service, and to report aggregated, non-personal usage figures — for example the total number of active users — to business partners and advertisers. Individual records are never shared for that purpose, and this data is not used to target advertising at you or to build a profile of your interests. The legal basis is our legitimate interest in operating and improving the service (Art. 6(1)(f) GDPR). Usage records are deleted after 14 months at the latest, and immediately when you delete your account. You can object to this processing at any time under Art. 21 GDPR using the contact details in section 14.

We keep personal data only as long as we need it for the purposes above, and we delete or anonymize it after that. Concretely:

• Waitlist entries: until launch communications are finished, until you unsubscribe, or until you ask us to delete them — whichever comes first, and in any case no longer than 24 months after the last interaction.
• Account sign-in records: at the latest 24 months after the sign-in they describe, and immediately together with your account when you delete it.
• App usage records: at the latest 14 months after the session they describe, and immediately together with your account when you delete it.
• Account and profile data: for as long as your account exists. When you delete your account — in the App under Settings → Privacy → Delete account, or through the deletion form — it is scheduled for permanent deletion and erased within 30 days.
• Connected account data and OAuth tokens: deleted when you disconnect the service or delete your account.
• Diagnostics, analytics, and reach measurement: up to 14 months, or until you withdraw consent, after which consent-based traffic events linked to your device identifier are deleted.
• Network, security, and abuse-prevention logs: short operational periods only, unless a longer period is needed to investigate an incident or defend a legal claim.
• Consent records: up to three years after the consent or its withdrawal, so we can evidence your choice under Art. 7(1) GDPR.
• Invoices, payment records, and accounting documents: retained for the statutory periods — generally six to ten years under German commercial and tax law (§§ 238, 257 HGB, § 147 AO). Data kept for that reason is blocked from any other use and deleted when the period ends.

Deletion on request. On a verified erasure request we delete your personal data within 30 days, except where retention is required by law or is necessary to establish, exercise, or defend legal claims. We confirm receipt in writing and answer within one month (Art. 12(3) GDPR). Local app data remains on your device until you delete it, clear App data, or uninstall the App.

We use reasonable technical and organizational measures, including access controls, encryption in transit, and Supabase Row Level Security. No system is guaranteed to be fully secure.

We and our service providers may process data in the European Union, United States, and other countries. Where required, we rely on appropriate transfer mechanisms such as standard contractual clauses or equivalent safeguards.

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal data, and to withdraw consent at any time — for example by unsubscribing from product-update emails.

How to delete your profile or make any other request. Use our data deletion form — no login and no app install needed. It covers erasure, access to a copy, and corrections, and it is open to warmUP players, website visitors, download sign-ups, and business partners of the warmUP Ad Center. You receive written confirmation of receipt with a reference immediately, we answer within one month, and verified deletion requests are completed within 30 days.

If you use the desktop App and are signed in, you can also delete your account yourself under Settings → Privacy → Delete account, and export a copy of your data there. Requests by email to privacy [at] @warmup-gamelauncher [dot] .com or by post are equally valid. We may need to verify your identity before we delete or release data.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). For our establishment in Berlin, the competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit). You may also contact the supervisory authority in your country of residence.

warmUP is not directed to children. Where processing relies on consent, the minimum age is 16 in Germany and the European Union (Art. 8 GDPR), or the lower age set by national law (down to 13) where permitted. If you believe a child provided personal data to us without appropriate consent, contact us and we will take reasonable steps to delete it.

We may update this Policy when features, providers, laws, or business practices change. The latest version will show a new effective date, and a summary of what changed stays at the top of this page.

A material change is also announced inside the App: the installer shows the same summary before you install, and an existing installation shows it in a dialog on the home screen and asks you to confirm the updated Policy before the change applies to you.

Questions or privacy requests: privacy [at] @warmup-gamelauncher [dot] .com