隱私權政策

1. Controller

OwnRules Owner: Christian Huke Ernst-Heilmann-Straße 18 09116 Chemnitz Germany

Email: support@ownframe.de

For privacy questions or to exercise your rights, contact us at support@ownframe.de.

2. Hosting and server log files

This website is hosted on infrastructure by ZAP-Hosting GmbH & Co. KG, Hafenweg 8, 48155 Münster, Deutschland. When you access the website, the hosting provider processes the following standard server log data: IP address of the requesting device, date and time of access, requested URL, browser type and version, and the referring URL.

Processing is based on Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). Log files are stored for a maximum of 7 days and then deleted automatically; longer storage happens only where required to investigate a security incident. The hosting provider acts as a data processor under a data processing agreement per Art. 28 GDPR.

3. No analytics or tracking tools

This website uses no analytics or tracking tools and no advertising cookies. The only exception is a purely functional cookie ("NEXT_LOCALE") that remembers your selected language so you do not have to choose it again on your next visit. It contains no profiling data and is not used for tracking.

4. OwnFrame accounts (Supabase)

An OwnFrame account is optional. It is only required to publish, edit, like or delete community builds; every other part of the website works without an account. There is no password sign-up of our own — sign-in happens exclusively through external providers:

• Google / Discord — the provider's official OAuth flow in your browser, completed entirely by our backend function. OwnFrame receives the provider's account id and, where the provider supplies one, the display name — not the provider's email address.
• Steam — Steam OpenID 2.0 with server-side verification. Steam returns only the SteamID64, no name or profile data.
• Overwolf — linked through the OwnFrame desktop app; the app passes a short-lived session token from which our backend function verifies the Overwolf user id and display name.

On our Supabase backend we store, per account: the linked provider, the provider user id, the display name and the account id. No real email address is stored — no provider supplies us with one. Because Supabase requires an email field on every account, it generates a synthetic, non-deliverable internal address of the form <provider>-<id>@ownframe.local; it is an internal identifier only, never used to contact you and never shared with third parties. Session tokens are stored locally in your browser so you stay signed in; OwnFrame never sees any provider password.

Legal basis: Art. 6(1)(b) GDPR (providing the account at your request) or Art. 6(1)(f) GDPR (abuse prevention). Identities are never linked automatically; you can link and unlink them at any time yourself via the OwnFrame app (Settings → Account).

5. Community builds and votes

When you publish a community build, we store on Supabase: the build data (mods, arcanes, forma count, item), your guide text, your display name, a public build code and your account id (auth.uid()), so that only you can edit or delete the build. Community builds are publicly visible. You can delete them in your account on the website or in the app. When you like a build, your account id and the build id are stored (one like per account). If you report a build by email, we process your message and email address to handle the report (Art. 6(1)(f) GDPR) and delete them once they are no longer needed for that purpose.

6. YouTube links in build guides

Build guides may contain YouTube links. The website does not embed a YouTube player and loads no preview images from Google. Only clicking the link opens YouTube in a new browser tab; processing there is subject to Google's own privacy policy.

7. OwnFrame desktop app

The desktop app (Overwolf client) processes additional data. Game inventory data, price caches and on-device screen text recognition (OCR, never saved or uploaded) stay on your device. For current data, the app fetches market prices from our own server (prices.ownframe.de) and the update list and OCR models from GitHub; this technically transmits your IP address to the respective server. There is also an optional, consent-gated YouTube embed (Privacy-Enhanced Mode, revocable at any time in the app settings). Tebex handles premium subscription payments in your browser. The in-app privacy policy covers these in detail.

8. Data processors and third parties

• ZAP-Hosting GmbH & Co. KG — hosting and server log files (data processor, Art. 28 GDPR).
• Supabase — account management, authentication and storage of community builds. The data is stored in the EU (Ireland). Supabase is a provider based in the USA, so access from third countries, for example for support or operations, cannot be fully ruled out.
• Google — optional login identity.
• Discord — optional login identity.
• Valve (Steam) — optional login identity.
• Overwolf — desktop app login identity.
• Tebex — premium subscription checkout (runs in your browser; OwnFrame receives only the subscription status).

9. Data retention

• Server log files: maximum 7 days, then deleted automatically.
• Account data (linked identities, display name): for the lifetime of your account. You can delete your account yourself (Settings → Account in the OwnFrame app); this removes account data, community builds, likes and the premium grant immediately.
• Community builds: until you delete them, or automatically when the owning account is deleted.
• Likes: while the like exists; removed when you unlike or when your account is deleted.
• Language cookie (NEXT_LOCALE): until it expires or you delete it in your browser.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). Simply email support@ownframe.de to exercise these rights.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the Sächsischer Datenschutzbeauftragter (Saxony), Devrientstraße 5, 01067 Dresden, Germany, www.saechsdsb.de.

11. Changes to this policy

We update this policy when features are added or legal bases change. The "last updated" date shows the current version.

Last updated: 30 October 2026