Privacy Policy

2aHosting and delivery via Cloudflare#

winku.de (opens in a new tab) and the associated services run on a server that we set up and operate ourselves; the hardware and data centre are provided to us by netcup GmbH (Karlsruhe) as a processor (contract under Art. 28 GDPR), and the server is located in Nuremberg, Germany. Some of our emails are sent by this server itself; the others – such as confirmation codes and messages about your account – go through the mail server of MC-HOST24.de (opens in a new tab) Gericke KG (Berlin, Germany), which also hosts our mailboxes (for example [email protected]). The provider processes the sender and recipient address, subject, content and time of these emails. For backup purposes we copy the data every night to our own hardware in Germany and keep it there for 30 days; an additional encrypted copy — only we hold the key — is kept for seven days at Hetzner Online GmbH (Gunzenhausen) in Germany, which provides the storage space for it as a processor (contract under Art. 28 GDPR). Before the move and before switching to the new website, we also made full backups of the previous website and its discontinued parts; they are kept on our own hardware and on our server in Germany, and we delete the personal data in them no later than twelve months after the respective backup. The full backup of the previous website from 18.09.2026, which contains personal data, is additionally kept until its deletion date of 18.09.2027 on a Storage Box of Hetzner Online GmbH (Germany); it is encrypted, and only we hold the key.
The pages are delivered through the network of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA); this applies to winku.de (opens in a new tab) and all services operated under it (except our Minecraft game servers and the download server for the programs, see below) as well as to vidono.de (opens in a new tab). Every request first passes through Cloudflare's servers and only then reaches our server. Cloudflare processes your IP address, the requested address, technical details of your browser and – because the encrypted connection ends at Cloudflare and is re-encrypted from there to us – also the transmitted content, such as form entries. This serves reliable availability and protection against attacks; our server is thus not directly reachable from the internet. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).
Cloudflare processes this data on our behalf under a contract pursuant to Art. 28 GDPR. Data may be transferred to the USA in the process. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); the European Commission's standard contractual clauses apply in addition. Cloudflare does not set any advertising or analytics cookies for us. More information: https://www.cloudflare.com/privacypolicy/ (opens in a new tab)
Game servers: Our Minecraft game servers run on our server in Nuremberg (netcup, see above). Connections to them do not go through Cloudflare: your Minecraft game and your browser (for example when a resource pack is downloaded) connect to our relay server, which we run at OVHcloud in a data centre in Germany; OVHcloud only provides the server and processes data on our behalf (contract under Art. 28 GDPR). Before that, incoming traffic passes through the filter against overload attacks that OVHcloud uses for its servers; it processes your IP address and technical details of the connection. The relay server passes the connection on to the game servers in Nuremberg through an encrypted tunnel and includes your IP address, so that they can limit sign-ins per address; the relay itself stores nothing and does not write IP addresses into its log, only counters. The game servers only need your IP address while you are connected; we do not write it into their logs. The logs record who joins and leaves when (Minecraft name and UUID), as well as commands entered, errors and – in games with a chat – chat messages. The web server of the game servers, from which your game downloads resource packs, logs requests with a shortened IP address (the last digits removed), the time and the requested file. We delete both logs after 14 days at the latest, and crash reports of the game servers (without IP addresses) after 30 days. The legal basis is our legitimate interest in games that are reachable and protected against attacks (Art. 6(1)(f) GDPR). The real-time part of Wink games (currently Plank Drop) can also run on this server; what is processed there is described under the respective service. It does not use a database there; game state and inputs are kept in memory only while the game is running. The log of this part contains only numbers of rooms and accounts, errors and load figures – no IP addresses and no names – and is deleted after 14 days at the latest. Anything else the game servers store is described under the respective service.
WinkuGames (Minecraft network): WinkuGames is our Minecraft network with a public lobby. You reach it in Minecraft at the server address winku.de (opens in a new tab); it runs on our game servers (see above) and is open to anyone with a Minecraft account – you don’t need a Winku account. When you join, your Minecraft game sends your Minecraft name, your UUID and your skin, as it does on any server; the server checks with Mojang or Microsoft that the account is yours. The servers only need your IP address while you are connected; we do not write it into their logs. The lobby has a public chat: everyone who is in the lobby at that moment sees your messages together with your Minecraft name. The game server’s log also contains your chat messages and the commands you enter, each with your Minecraft name (no IP address); we delete this log after 14 days at the latest. Like any Minecraft server, the lobby keeps technical game data for your UUID (such as where you last were, your inventory and the Minecraft statistics) and remembers which name belongs to which UUID; this data stays as long as the lobby exists. Parkour times, your settings (for example whether you have hidden other players) and anything else the lobby knows about you are kept in memory only and are gone as soon as you leave or the server restarts. When you enter the lobby, your game downloads our resource pack from the web server of the game servers; it contains only our own graphics and sounds and no personal data, and the download is logged with a shortened IP address as described above. Ranks: Players with a rank (Inhaber, Admin, Dev, Mod, Builder, Creator or Plus, as shown in the game) wear a badge in the tab list, in the chat and on their nameplate. For this we store, for these players, on the network’s proxy (the server you connect through) their Minecraft UUID, their Minecraft name, the rank and the date it was given, until the rank is withdrawn; then we delete the entry. For all other players we store nothing for this. For display, we send the rank to the network’s game servers; there it is kept in memory only. Moderation: If we ban a player or mute them, the proxy stores for as long as the penalty applies their Minecraft UUID, their name, the reason, who imposed it, since when it applies and until when (or permanently); we delete expired or lifted penalties and keep no history of past ones. When you join, the server checks whether a ban applies. The proxy’s log contains one line per kick, ban, mute or maintenance action with the name, the action, the duration and the team member who triggered it (no reason, no IP address); we delete it after 14 days at the latest. Messages in the team chat only go live to team members and are not stored. If a team member turns invisible to spectate, their previous location and game mode are kept briefly in their player data on the server until they switch back. The legal basis here is our legitimate interest in protecting the community and enforcing the rules (Art. 6(1)(f) GDPR). Replays and reports: The game server records every round of Hide and Seek and Nebelflucht so that the team can watch it when a report comes in: positions, movements and viewing direction, equipment and items, names, UUIDs and skins of all players in the round, block changes and game events such as deaths, but no voice chat. We delete the recording after 7 days; if someone was reported in the round, we keep it until the report is resolved and delete it 30 days after that. Only the team with moderation rights can watch it, in the game on a replay server of its own; there is no backup copy. With /report you can report a player in the game. For this we store, on the game server and in the moderation area on smp.winku.de (opens in a new tab) (team only), the reporter and the reported player (UUID and name), the reason, server and game, the link to the recording, the times, the status, the team member handling it and the result, until the report is resolved and for 30 days after that. The legal basis is our legitimate interest in enforcing the rules and protecting against cheating and abuse (Art. 6(1)(f) GDPR); you can object to this under Art. 21 GDPR – just write to us at [email protected]. AntiCheat: So that nobody wins with cheats in the lobby and in the games, the game server automatically checks the movements and actions of all players, for example whether someone is flying, moving impossibly fast, hitting from too far away or breaking blocks too quickly; the checks adapt to the game mode. Alerts, violation levels and measurements are kept in memory only and are gone as soon as you leave or the server restarts; the only thing written to disk is a timestamp in your technical player data saying when something last stood out (so that, for example, a parkour time does not count). If there is a well-founded suspicion, the game server saves a clip of about two minutes (roughly 90 to 120 seconds before and 30 seconds after) with the same data as a recording: positions, movements, equipment, names, UUIDs and skins of all players nearby, and block changes; in Hide and Seek and Nebelflucht it sets a marker in the recording of the round instead. It also automatically creates a report for the team: the reporter is “AntiCheat”, along with your name and UUID, the check that triggered, the measurements, server and game and the link to the clip; we handle this report like any other (see above for the retention periods). We delete a clip after 7 days; if it is attached to a report, we keep it until the report is resolved and delete it 30 days after that. There is no backup copy, and only the team with moderation rights can watch it. The game server’s log contains one line per report with name, UUID, check and measurements (no IP address); we delete it after 14 days at the latest. The AntiCheat imposes a ban of up to 30 days by itself only in clear-cut cases, for example when someone flies impossibly for many seconds; for this we store, as with any ban, UUID, name, reason and duration for as long as it applies. Everything else is looked at by the team before it decides anything. If you think you were banned or reported unfairly, write to us at [email protected]; the team will then review the case by hand and lift an unjustified ban. The legal basis is our legitimate interest in fair play and in protecting against cheating (Art. 6(1)(f) GDPR); you can object to this under Art. 21 GDPR – just write to us at [email protected]. Access only with the Wink Mod: When you join WinkuGames, the Wink Mod sends the game server the list of its loaded mods and a sign-in ticket that it fetches from smp.winku.de (opens in a new tab) just before (Winku account number, Minecraft UUID and name, valid for 60 seconds at most). The server checks both only at login and stores nothing of it. We can restrict access to players with the Wink Mod and ban players with banned cheat mods for 30 days; in that case we store the reason “verbotene Mod: <ID>” (“banned mod”) for as long as the ban lasts. Language: If you set a language yourself in WinkuGames (German or English), the proxy stores your Minecraft UUID and the language you chose until you switch back to automatic; then we delete the entry. If you change nothing, you get your game’s language and we store nothing. The team also reviews a ban for a banned mod by hand on request and lifts it if it was unjustified. The legal basis is our legitimate interest in a fair network that is protected against cheating (Art. 6(1)(f) GDPR). Voice chat: There is voice chat with the Simple Voice Chat mod in the lobby, in waiting areas, in Hide and Seek and in Time Loop; it is off during Nebelflucht rounds. It only works if you have installed the Simple Voice Chat mod; otherwise nothing happens. Your voice is sent in small encrypted packets to our game server (UDP port 24454, through our relay server with OVHcloud’s filter against overload attacks, see above), decrypted there in memory only and passed on to players near you. We don’t store it: no recording, no history, no file per player, and our replays contain no voice either. For this, the proxy keeps your IP address only in memory for the length of your session and does not log it; if something goes wrong, your name or UUID can appear in the server’s log (14 days). Anyone who is muted, or invisible as a team member, can’t speak. The recording feature of the Simple Voice Chat mod is switched off on our servers. If you report someone with the Wink Mod, the game replay can also contain voices from the voice chat; that is described in the section on Wink (15o) under “Reports”. The legal basis is the use of the feature that you switch on yourself with the mod (Art. 6(1)(b) GDPR), and for the error logs our legitimate interest in secure operation (Art. 6(1)(f) GDPR). We keep no statistics about how you use it, and the servers report nothing to third-party statistics, advertising or analytics services. The legal basis is our legitimate interest in a network that works, is protected against abuse and in which the team can be recognised (Art. 6(1)(f) GDPR). You can get access and deletion on request at [email protected].
Program downloads: You usually download installation files and updates of the programs not through Cloudflare but from our download server at files.relvia.de (opens in a new tab). winku.de (opens in a new tab) first checks the request and then forwards your program or browser there with a signed address that is only valid for a short time; the address contains no details about your account. The download server runs on our relay server at OVHcloud in Germany, and here too incoming traffic first passes through the OVHcloud filter against overload attacks (see above). The download server fetches the files themselves from our storage space at Hetzner Online GmbH in Germany and keeps them ready for further downloads; Hetzner learns nothing about you, because these requests come from the download server and not from your device. The download server sees your IP address only for the transfer. Its access log contains the time, the type of request, the requested path, the result, the amount of data transferred and whether the file came from the cache — without your IP address and without the signature in the address. If the download server reports an error, the error message may contain your IP address and the requested address. The logs serve operation and protection against misuse; we delete them after 14 days at the latest. The legal basis is our legitimate interest in delivering the programs quickly and securely (Art. 6(1)(f) GDPR).

15aSigning in with Twitch#

You can sign in with your Twitch account. In doing so, Twitch transmits to us your Twitch ID, your login and display name, your email address and the address of your profile picture. We request read-only access to this information (user:read:email) and receive no right to act on your behalf. The access token is returned to Twitch immediately after the one-off retrieval and is not stored by us. We download your profile picture once and store it on our server; it is not re-loaded from Twitch, so Twitch does not learn when you visit our pages. The legal basis is the performance of the user relationship at your request (Art. 6(1)(b) GDPR). The provider is Twitch Interactive, Inc., USA; by signing in, data is transmitted there because you explicitly request this connection (Art. 49(1) sentence 1 point (b) GDPR). If a Winku account already exists for your email address, we do not link the accounts automatically; you have to sign in the regular way once to do so. If Twitch does not give us an email address, we first create a new account with a placeholder address of the form “twitch-<Twitch ID>@twitch.invalid”, to which nothing is ever sent; you can only use the account once you have chosen a username and confirmed your email address with a code right afterwards (section 4).

15bVidono — video requests in a stream#

Vidono (vidono.de (opens in a new tab)) allows viewers of a channel to suggest a video clip for the stream.
Sign-in: channel owners and moderators sign in with their Winku account; winku.de (opens in a new tab) passes the account ID to vidono.de (opens in a new tab) via a single-use ticket valid for 60 seconds. vidono.de (opens in a new tab) sets a session cookie with a random ID and, after sign-in, additionally the cookie “vidono_bleib”. It contains only the value “1” and no identifier and expires after 180 days; if the session has expired, Vidono uses it to sign you in again via your Winku account without another click. It is deleted when you sign out. Both cookies are technically necessary (§ 25(2) no. 2 TDDDG).
Of the channel owner we process the Twitch channel identity (channel name and Twitch ID), the rules they define and the queue. The legal basis is the performance of the user relationship (Art. 6(1)(b) GDPR).
Of submitting viewers we process the display name they choose themselves, the requested video clip and the associated amount. The chosen display name is shown publicly in the channel's stream; you can choose it freely and do not have to provide a real name. The legal basis is the performance of the user relationship (Art. 6(1)(b) GDPR).
Payments by viewers do not go through us. Payment is made via the method the channel owner has set up themselves; we merely receive the notification that a payment has been received, together with the amount and the name and text provided by the viewer.
To be distinguished from this is paid access for channel owners. At present no such access can be purchased, and no processing takes place for it. If such access is offered later, Lemon Squeezy will handle the payment (Lemon Squeezy, Inc., USA). For this we transmit your email address and the identifier of your channel with us; payment data such as card or account numbers does not reach us and is not stored by us. Lemon Squeezy processes the payment data as an independent controller. A transfer to the USA takes place. Details are set out in Lemon Squeezy's privacy notices.
For previewing and selecting the clip, the YouTube player is loaded as soon as you enter a YouTube link; a notice directly below the input field says so beforehand. In doing so Google (USA) learns your IP address and may store information on your device. Without that input the player is not loaded. The legal basis is your consent given by entering the link (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Video thumbnails are loaded from YouTube once a video is selected. Google's privacy notices apply in addition.
For display in the stream, the overlay maintains a connection to StreamElements (StreamElements Ltd., USA); this concerns only the channel owner, not their viewers. Through this connection we learn of the channel's incoming donations.
Retention: completed queue entries (played, skipped, rejected) are deleted after 30 days, the history of incoming payment events as well as the moderation log and the results of the video checks after 12 months, completed moderator invitations after 90 days. This happens automatically; the channel owner does not have to do anything and cannot extend it. Open queue entries remain until they are completed. If the channel owner deletes an entry or their account, the associated data is removed immediately.

15dSigning in with Discord#

You can sign in with your Discord account — in the WinkuBot dashboard (bot.winku.de (opens in a new tab)) and on winku.de (opens in a new tab) itself. Discord then transmits to us your Discord ID, your username, the ID of your profile picture and, if you have stored one with Discord, your email address. We request read access only (identify, email, guilds) and receive no right to send messages on your behalf or to read your messages. The “guilds” permission serves solely to determine on which Discord servers you may “Manage Server”; you can see which servers these are in the dashboard.
Where the tokens remain depends on where you sign in: if you sign in on winku.de (opens in a new tab), we return the access token to Discord immediately after retrieving your account data once and do not store it. In the WinkuBot dashboard we store the access token and the refresh token, because the dashboard uses them to retrieve your server list from Discord on every visit; both are deleted as soon as you delete your access (section 15e).
If you sign in with Discord for the first time and Discord transmits an email address, we create a Winku account for that address so that support, legal texts and your other Winku services are held under one account. You will receive an email about the newly created account. If a Winku account already exists for that address, we do NOT link the accounts automatically; to do so, you must sign in normally on winku.de (opens in a new tab) once and connect Discord in your account there. If Discord does not transmit an address, no Winku account is created — you can still use the WinkuBot dashboard.
The legal basis is the performance of the user agreement at your request (Art. 6(1)(b) GDPR). For users in the European Economic Area the provider is Discord Netherlands B.V., Amsterdam; Discord's privacy policy (https://discord.com/privacy (opens in a new tab)) applies in addition. You can disconnect Discord from your Winku account in your account at any time.

15eWinkuBot — bot for Discord servers and the dashboard#

WinkuBot is a bot for Discord servers; it is configured in the dashboard at bot.winku.de (opens in a new tab). Section 2 applies accordingly to visits to this page: it is delivered via Cloudflare, the application itself stores no IP addresses and runs on our own server in Germany.
Dashboard session: after sign-in a cookie named “winku.sid” is set. It contains only a random session ID and expires after 30 days; the associated session data is stored in our database. The cookie is technically necessary; no consent is required for it under § 25(2) no. 2 TDDDG. If you choose a language, the cookie “sprache” is added (lifetime one year, content only the language code). We do not set analytics or advertising cookies.
Signing in with your Winku account: if you are signed in on winku.de (opens in a new tab), the dashboard signs you in through it, like the other Winku services. winku.de (opens in a new tab) then passes your Winku account number, your display name, your profile picture and, if you have linked Discord to your Winku account, your Discord ID and Discord name to the dashboard; other Winku services do not receive the Discord details. If your Discord access has expired, the dashboard renews it with the stored refresh token or checks through the bot on which of its servers you have “Manage Server”. The legal basis is the performance of the user agreement at your request (Art. 6(1)(b) GDPR).
Data from operating the bot: if WinkuBot is used on a Discord server, we process, depending on the modules enabled, the server, channel, role and user IDs from Discord as well as the settings defined for the server. In particular these are: the server's configuration; for the level system the user ID, experience points collected, the level and the time of the last award; for moderation, in the event of a hit – in the word filter or by an automatic rule such as invite links to other servers, message floods or mass mentions – the user ID, the action, the reason (such as the triggering word) and the time, plus warning points, which expire after the period set by the server and are then deleted; for auto-role and welcome messages the join events including the user ID; for tickets the message history of the respective ticket; and, depending on the module, balances, achievements, birthdays, giveaway entries, invite counts and emoji usage. Message content is checked but not stored permanently — except for messages within a ticket, which exist precisely for that purpose, and the details that the modules described below expressly store.
More modules: The following modules are off on a server until the server team switches them on in the dashboard. Only backing up, restoring and applying a template (see “Backups and templates”) can be done by anyone with the Discord permission “Manage Server” even if the module is off. Which channels, roles and questions are set up for them is decided by the server teams themselves. Where a shorter period is given below, it applies. As above, the legal basis is the legitimate interest of those responsible for the server and their members in running and protecting their server (Art. 6(1)(f) GDPR); where you submit a suggestion or an application yourself, performance at your request is added (Art. 6(1)(b) GDPR).
Server logs and verification: If a server switches on the logs, the bot writes events of the server (joins and leaves with the age of the Discord account, role and nickname changes, created, changed and deleted channels and roles, bans, timeouts, voice channel moves, and deleted and edited messages) as cards into channels the server chooses itself. So that the text of a deleted or edited message can appear in the card, the bot briefly stores new messages (text, links to attachments, Discord ID of the person, channel and time) – only while the module is on, only in channels and for people the server has not excluded, and only for the period the server chooses (1, 7 or 30 days; default 7). The entry is deleted as soon as the deletion or edit has been logged, when the period ends, when the module is switched off and when the bot leaves the server. The bot reads the server's audit log only to show in the card who did something; we store nothing of it. The cards themselves sit at Discord in the server's channel. With verification, new members confirm with a button, the rules or a small maths or emoji task that they are real, and then get the member role. While a person is not yet verified, we store server ID, Discord ID, join time and, where applicable, the server's time limit; the entry is deleted as soon as they verify, leave the server or the time limit runs out. Tasks and wrong tries are kept only briefly in memory. The server can set a minimum age of the Discord account (how long the account has existed at Discord, not your age) and have members removed who do not verify in time or whose account is too new; you get a direct message beforehand if you allow them. Results appear in the server's log channel and in its moderation log.
Protection against raids and mass actions: If a server team switches on the “Protection” module, the bot checks joins and the entries in the server's audit log to detect and stop join waves (raids) and mass actions such as deleting many channels or roles. For each new member it keeps the Discord ID, join time, age of the Discord account, whether a profile picture is set, and the username (to spot matching name patterns) in memory for a few minutes; for actions such as deleting a channel, banning or granting permissions it counts in memory, per executing Discord ID, how often they happened within a short time. Both stay in memory and are gone after one hour at the latest. Only the following is stored: a history of alerts (server ID, time, type, for mass actions the Discord ID of the executing person, reason, actions taken) for 90 days; the whitelist the team maintains itself (Discord IDs of people, bots and roles) until removed there; and, during a raid or lockdown, the previous state of the settings that were changed (channel IDs and send permissions, verification level, invite pause) until the measure ends. Alerts go to the channel the team chooses and, if enabled, as a direct message to the server owner; they name the executing person. Depending on the settings, the bot times out, kicks or bans new members during a raid, removes roles with dangerous permissions from people who exceed a limit, or removes bots; the server owner is always exempt. The bot acts on fixed limits set by the team, and the team can undo every action.
Backups and templates: In the dashboard and with /backup, people with the Discord permission “Manage Server” back up the server's structure, restore it from a backup or apply a ready-made template; if the module is on, the bot also backs up daily or weekly and, when Protection reports a raid or mass action, right away. A backup contains roles (name, color, permissions, order), categories and channels (name, topic, slowmode, channel permissions for roles, forum tags), server settings (name, language, verification level, system and rules channel, welcome screen), the Discord AutoMod rules including their word lists, the list of server emojis (name and ID, no images) and WinkuBot's settings for this server. Messages, attachments, members, who has which role, and channel permissions for individual people are not backed up. Per server we keep the latest 7 backups (the team sets 1 to 20), plus at most 3 after a protection alert and 3 the bot takes before a restore; pinned backups stay until the team deletes them. If WinkuBot is no longer on a server, we delete its backups after 30 days. The server's log lists, with Discord ID and name, who backed up, restored, applied a template or created a share link – for one year; the changes in Discord's audit log carry the same name. If the team shares a backup via a share link, anyone with the link can see and use its structure: server name, role names and colors, category and channel names and topics including role permissions, without settings, AutoMod rules, IDs, messages or members; the link can be revoked at any time. The downloadable file contains the same data as the backup. If you delete your data in your profile, we replace your name in the log, and a backup that contains your Discord ID is deleted entirely.
Suggestions and applications: With the “Suggestions” module, members submit ideas with /suggest and vote for or against with a button. We store the title and description, your Discord ID, the status with the team's reason, the Discord ID of the team member who set it, and your vote (one per suggestion). If you submit “anonymously”, your name is not on the card; your Discord ID stays in our database so we can send you a direct message when the status changes (the team can turn that off) and check the pause between two suggestions. Suggestions are not deleted automatically; the team can delete any of them together with its card. With the “Applications” module, members apply through forms; which questions are asked is decided by the server team. We store your Discord ID, your answers word for word, the decision with its reason, the Discord ID of the person who decided, and the team's votes. The application appears as a card in a channel chosen by the team; your join date and account age from Discord are shown with it. An unfinished form stays in the bot's memory for at most 30 minutes and is not stored unless you submit it. We delete decided applications together with their answers, votes and card after the period the team sets (30 to 365 days, default 90), and open ones after one year at the latest; the cooldown after a rejection only works as long as the application is stored. On acceptance the bot sets the roles the team defined; on acceptance and rejection you get a direct message (can be turned off). The bot decides nothing itself. If you delete your data in your profile, your votes and applications are deleted together with the card, and your suggestions are anonymised: your name is taken off the card and the link to you is removed. Do not put anything in an application that you do not want to share; server teams should not ask for particularly sensitive details (for example about health or religion).
Rank card: With /rank and /leaderboard the bot shows your level as an image: with your display name and username, your avatar, level, rank, XP and, if the server has it switched on, your time in voice channels (the level system stores these minutes and a daily limit for XP with your Discord ID for that). The image is created on our server; for that the bot loads avatars and the server icon from Discord (cdn.discordapp.com (opens in a new tab)) and keeps them in memory for at most 30 minutes, finished images for 60 seconds; nothing goes to disk. Other members can show your card in a channel with /rank @name; the same values are also on the server's leaderboard. If you pick your own color with /rankcolor, we store that one color value with your Discord ID for this server; /rankcolor off deletes it again. Whoever may manage a server can upload a background image in the dashboard (PNG, JPEG or WebP up to 4 MB): we check the file, scale it down and store it as a new image without metadata (for example without location and camera) in our database until it is removed or the bot leaves the server; who uploaded it is kept for 90 days in the dashboard's change log. Only upload images you have the rights to and that do not show people without their consent – the image appears on every rank card of the server. If you delete your data in your profile, your voice minutes, your daily limit and your color are deleted too.
Pinned message, timed roles, AFK and channel games: For the pinned message we store, per channel, the text the server team sets and the ID of the message currently at the bottom; no data about individual members is created, and the count of new messages in the channel stays in memory and contains no names or content. If the team gives you a timed role (dashboard or /zeitrolle), we store your Discord ID, the role, start and expiry, the Discord ID of the person who gave it, an optional reason and whether you get a direct message on expiry; the entry is deleted as soon as the bot has removed the role or the timer is ended early, and if the bot cannot remove the role (missing permissions) it keeps trying for a day, then the entry lapses. With /afk we store your Discord ID, the server, the reason you enter yourself and the start time; if the server has the “[AFK]” nickname prefix on, we also remember your previous nickname to restore it. If someone mentions you while you are AFK, we only store a reference (Discord ID of the person who mentioned you, channel, message ID, time), never the text, at most 50 per person. As soon as you write again, your AFK entry is deleted; you can still open the list of mentions for 24 hours (only you see it), after which it is deleted, and anyone who never comes back is forgotten after 30 days. In the channel games (counting, word chain) a server sets up, the bot reads the messages in the game channel to check them against the rules. What is stored: the state per channel (the current number, or the words used so far in the current round, without saying who wrote them), the record, the Discord ID of the person who was last right, and, for the leaderboard, the number of correct and wrong moves per person and channel. The text of other messages is not stored; the words of the word chain are deleted when the round ends, and the leaderboard counters stay until the server team resets or removes the game or you delete all your data.
Moderation commands and cases: With /warn, /timeout, /kick, /ban, /purge and further commands the server team acts by hand. We store every action as a case with a running number: type, Discord ID of the person affected and of the team member acting, reason, duration or expiry, channel and, for /purge, the number of deleted messages (not their content); likewise internal team notes (/note), which only the team sees. The bot remembers temporary bans and locked channels until they expire so it can lift them. Depending on the settings, you get a direct message with the server name and reason before a kick or ban. We delete cases after the period the team sets (default 365 days; at 0 they stay until the team deletes them). If you delete your data in your profile, the cases about you are removed, and in cases you created as a team member the reference to you is removed.
Link protection: If the module is on, the bot checks links in new and edited messages against built-in patterns of known scam sites, a public list of phishing addresses (see “Queries to third-party services”) and the server's own lists; it never opens the linked pages. On a hit it deletes the message and acts according to the settings (timeout, kick or ban); for typical scam links the person gets a direct message that their account may have been taken over. Per hit we store the domain, reason, action taken, time and your Discord ID for 30 days, never the text of the message.
Setup: When the bot is invited to a server, it reads the server's audit log once to find the person who added it and sends them a direct message with setup links; we store nothing of this. The setup wizard (/setup) keeps its steps in memory for at most 10 minutes.
Insights (server statistics): If the module is on, the bot counts per day the messages (total, per channel and per hour), joins, leaves, the member count, minutes in voice channels and the number of active people – numbers only, no content and no names; who was active on a day is kept in memory only until midnight. Only if the server team switches on per-person statistics do we store, per person and day, the number of messages and voice minutes with their Discord ID, for 90 days. We delete the server's daily values after 400 days.
Utility and reminders: /userinfo, /serverinfo, /avatar and the other info commands only show what Discord provides anyway and store nothing. With /remindme we store your Discord ID, the server, the channel, your text (at most 500 characters), the time and whether the reminder comes as a direct message; the entry is deleted once delivered, undeliverable ones after 30 days.
Games: Running games (for example tic-tac-toe, connect four, hangman, blackjack) only live in memory and end after 10 minutes without a move. For the trivia leaderboard we store, per server, your Discord ID, points, correct and wrong answers and the time you last played; without a new game the entry expires after one year. Blackjack with a stake uses the balance of the economy module.
Role menus, role restore and booster thanks: Role menus only store their layout (texts, roles, channel), no clicks. If role restore is on, we remember your roles (only their IDs) and, if set, your nickname when you leave a server, to give them back when you return; the entry is then deleted, at the latest after the server's period (default 90 days, at most 365). Booster thanks store nothing; the message names you and the number of boosts.
Channel automation and scheduled messages: Channel automation stores rules per channel and, for automatic deletion, only the IDs of the messages with their deletion time until they are deleted. Scheduled messages store the text, channel, date and the Discord ID of the person who created them; if you delete your data, this reference is removed.
Queries to third-party services: Some modules fetch data from third-party services, always from our server and never from a member's device. These services learn the IP address of our server, the program name “WinkuBot” and the address or channel that is queried, but nothing about your Discord server or its members; the titles, images, prices and links in the messages come from them. These are: for feeds a server team sets up, YouTube (Google), Reddit, Bluesky and the podcast and RSS addresses the team enters; for live alerts Twitch (Twitch Interactive, Inc., USA) and Kick; for /wiki Wikipedia (Wikimedia) with the search term; for link protection, once a day a public list of known phishing addresses from GitHub (GitHub, Inc., USA), without any data about servers, members or messages; for the “Free games” alert the free promotions of the Epic Games Store (Epic Games, Inc., USA) and the giveaway list of GamerPower.com (opens in a new tab) (Steam, GOG, Prime Gaming, Ubisoft, itch.io (opens in a new tab), consoles, mobile), queried about every ten minutes once for all servers, with the source credited in the footer of the card; for “Twitch clips” the clips of the last 24 hours of a channel the team picks, every five minutes, through our existing Twitch access (application access, no person signs in), where title, preview image, name of the clip's creator and view count are public at Twitch. Per alert we store only what the team sets: channel, chosen platforms or the Twitch channel name and its Twitch ID, an optional role, the minimum number of views and the IDs of offers or clips already reported (at most 300), no data about members. Discord itself loads the images of the cards through its media proxy; in the dashboard your browser loads the images of the “Free right now” card directly from Epic or GamerPower (without referrer) when you look at it.
The legal basis is the legitimate interest of those responsible for the server in running and moderating their community (Art. 6(1)(f) GDPR); for the dashboard and your access it is the performance of the user agreement (Art. 6(1)(b) GDPR).
Retention and deletion: the data remains, unless a shorter period is given below, until the respective module is switched off or deletion is requested; if the bot is removed from a server, we delete all data of that server after 30 days (if it is invited again before then, everything is kept). You can trigger deletion yourself: in the dashboard under “My profile” there is “Delete all my data”. This immediately and permanently removes all data stored for your Discord ID — access, levels, warnings, tickets, balances, achievements and logs; in other people's entries your name is replaced by “Deleted user”. This also applies to the modules below; suggestions remain as an anonymous card, and backups containing your ID are deleted entirely. What the bot has written into a channel as a message or card (for example cards of the server log) is held by Discord in the server's channel; only application cards are removed by the bot itself when you delete. Server owners can at the same time have the bot removed from the server and all server settings deleted. A Winku account created under section 15d is not affected; you delete it in your account on winku.de (opens in a new tab).
Recipients: Discord Netherlands B.V. (Amsterdam) or Discord Inc. (USA) — every bot message and every request goes through Discord, because that is where the service takes place. Other recipients are only the third-party services named under “Queries to third-party services” – and only if a server team switches on the respective module; WinkuBot has no advertising and no tracking pixels.

15fCueUp — Twitch panel#

Streamers who use CueUp can show a panel below their Twitch stream with the current song and the next song requests once Twitch has approved the “CueUp” extension; until then it is not generally available on Twitch. The panel stays off until the channel owner switches it on in CueUp.
Of the channel owner we process the Twitch ID of the channel they linked to their Winku account, and what CueUp reports for display: the current song (title, artist, address of the cover image at Spotify), the next requests and up to ten further tracks from their Spotify queue. The channel owner decides in CueUp which of these are sent; anything switched off is not sent. Position and volume of playback and the ways requests can be made (chat command, channel points reward) are no longer accepted since 17 September 2026; older versions of CueUp still send them, but nothing of that is stored. So that the panel can show a channel that has never used CueUp how to set it up, we also store the channel ID and the day CueUp first reported for that channel. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).
Of viewers who requested a song we process – only if the channel owner switched it on in CueUp – their Twitch display name and the address of their Twitch profile picture, so the panel can show who requested a song. Both are publicly visible on Twitch anyway; the ID of the Twitch account does not reach us. The legal basis is the legitimate interest of the channel owner and their viewers in seeing who requested which song on stream (Art. 6(1)(f) GDPR).
Anyone viewing the panel retrieves the display data from winku.de (opens in a new tab); this creates the server logs described in section 2. The panel sets no cookies and does not learn who is viewing it. The panel loads cover images directly from Spotify (Spotify AB, Sweden) and profile pictures directly from Twitch (Twitch Interactive, Inc., USA); these providers learn the IP address of the device. The panel itself is delivered by Twitch; Twitch's privacy notice applies in addition.
Retention: every report replaces the previous one – played or deleted requests thus disappear from the panel. If CueUp reports nothing for a day, the display data is deleted. If the channel owner switches the panel off, it is deleted immediately; only the note “switched off” remains for 30 days. The channel ID with the day of the first report is deleted together with the Winku account.

15gWovia — where to watch, and what I have watched#

Wovia (wovia.winku.de (opens in a new tab)) shows on which streaming services a film or series is available and, if you wish, keeps a watchlist and a record of watched films and episodes. Anything to be stored requires a Winku account. Wovia may be restricted to individual accounts.
What we store: for your account, the account ID, your display name and the address of your profile picture (from your Winku account); your watchlist with dates; watched films and individual watched episodes, each with a timestamp; your ratings (1 to 10) with timestamps; your own notes on individual titles (up to 2000 characters, with timestamp — visible only to you unless you expressly release them when sharing a list, see “Sharing”); the streaming services you state as your own subscriptions; your settings (country, catalogue language, display options including whether ratings are shown as thumbs or stars) and the most recently chosen filters of your lists; in addition, saved universes, your chosen order for universes (release or story order), the areas in which watched titles are hidden, your share links and your universe suggestions (both described below), and for “For you” your taste profile, the suggestions calculated from it and your “Not interested” list (see “For you” below). Wovia sets your country once, on your first visit with an account, from the origin Cloudflare reports for your connection (only the country code, see section 2a); if you choose a country yourself, that choice applies. Nothing is stored for this for guests. When a check mark takes a title off your watchlist, we note this with a timestamp so that Wovia can ask, if you undo it, whether to put the title back on your watchlist. The application stores no IP addresses; the server logs described in section 2 apply to page requests. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).
Wovia rating: your ratings are additionally included in a shared score per title that all users can see — a percentage and a banded vote count (“5+”, “10+” …). It is calculated once a day from the ratings and only shown once at least five different people have rated a title; only the result per title is stored, without reference to individual people, so no single rating can be read from it. The legal basis is our legitimate interest in offering everyone a meaningful assessment (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR): switch off “Include my ratings anonymously in the Wovia rating” in the settings; from the next daily run your ratings no longer count towards any score. Deleted ratings and accounts also drop out at the next daily run. For you (personal suggestions): so that Wovia can suggest films and series that suit you, our server calculates a taste profile from your own Wovia data – what you have watched, your ratings, your watchlist, your “Not interested” list, your subscriptions and your country. It consists of weighted features of the titles as known from TMDB (topic keywords, genres, people from direction and cast, decades, languages, share of films and series), your favourite titles and figures on what it is based on. In addition, we store up to 250 suggestions calculated from it, each with a match score and a reason, the time of the calculation and a checksum of the state of your data, so that it is only recalculated when something has changed. It is recalculated when your data has changed (at the earliest after 15 minutes, after “Not interested” after one minute), otherwise at most once a day and only while you use Wovia; for this we note the time of your last visit. Profile and suggestions are replaced with each calculation and deleted after 180 days without a new calculation. No data from other users is included and no AI is used; only IDs of titles and keywords are sent to TMDB, nothing from your account. Only you can see your profile – openly under “For you” → “Your taste”; it is not shown to anyone, not sold and not used for advertising, and it does not lead to any decision with legal or similarly significant effect (Art. 22 GDPR). The legal basis is our legitimate interest in making suitable suggestions to you (Art. 6(1)(f) GDPR); only your own information at Wovia is used for this, and only you see the result. Suggestions are switched on by default. You can object at any time (Art. 21 GDPR): switch off “Personal suggestions” in the settings, on “For you” or in the app – we then delete the profile and suggestions immediately and stop calculating. Your “Not interested” list remains until you remove individual entries or delete your Wovia data.
Sign-in and access: Wovia has no password of its own. You sign in on winku.de (opens in a new tab); winku.de (opens in a new tab) passes your account ID, display name and profile picture address to Wovia via a single-use, short-lived ticket. Wovia asks winku.de (opens in a new tab) on every request whether your account may use Wovia; only the account ID is transmitted for this, and Wovia keeps the answer in your session for at most five minutes. On Apple TV you sign in to Wovia with a code that you confirm on winku.de (opens in a new tab) or in the Wovia app, or you add the Apple TV in the Wovia app on your phone, tablet or Mac and enter the three-digit code it shows you on the Apple TV; the paragraph “Sign-in with a code” in section 4 applies. So the Wovia app can find the waiting Apple TV, the Apple TV shows up in your local network (Wi-Fi) with its device name and a random ID for the sign-in while you sign in, and the Wovia app looks for it there; this search stays within your network and we receive nothing from it.
Cookie: Wovia sets the cookie “wovia.sid” once you sign in or, as a guest, change the country. It contains only a random session ID and expires after 30 days without use; the session data (for guests only the chosen country, otherwise also the chosen language) is stored in our database. So that you are signed in without clicking, Wovia also sets the cookie “wovia_sso”. It contains only “1” or “aus” and remembers for 30 minutes that automatic sign-in via winku.de (opens in a new tab) has already been attempted, or for one day after signing out that none should take place. Both cookies are technically necessary; no consent is required for them under § 25(2) no. 2 TDDDG.
Film and series data comes from TMDB: Wovia obtains titles, descriptions and availability information from The Movie Database (TMDB Inc., USA); TMDB compiles the availability information from JustWatch data. These requests are made by our server, not by your device. What is transmitted to TMDB is the IDs of the titles requested, the chosen country and language and, for a search, the search term entered. Your IP address, your account and your lists do not reach TMDB this way. In addition, our server asks Wikidata (Wikimedia Foundation, USA) for direct links to titles on individual services and for German voice actors; only the title’s identifiers are sent, nothing about you.
Images are loaded directly from TMDB: your browser or the Wovia app loads posters, stills, provider logos and pictures of people directly from image.tmdb.org (opens in a new tab). TMDB thereby learns your IP address and the addresses of the images loaded; data is transferred to the USA. The legal basis is our legitimate interest in showing the images in their current version without copying them onto our own servers (Art. 6(1)(f) GDPR). TMDB's privacy notice applies in addition.
Trailers: a trailer is only loaded when you click “Play trailer”. Your browser then loads the YouTube player (youtube-nocookie.com (opens in a new tab)); Google (USA) thereby learns your IP address and may store information on your device. Without your click the player is not loaded. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you tick “Load YouTube videos on this site without asking from now on”, your browser remembers this decision in its local storage (no cookie, nothing is sent to us); trailers then load without another click. You can withdraw your consent at any time with effect for the future — via “Withdraw YouTube permission” below the player, in the Wovia settings, or by clearing your browser's site data.
Import from JustWatch and other services: Wovia offers a script with which you can export your own lists from your JustWatch account to a file. It runs exclusively in your browser, in the window in which you are signed in to JustWatch; it reads neither password nor access token and sends nothing to Wovia. You then upload the file to Wovia yourself. We read titles, IDs, list membership, series progress and dates from it and add them to your lists; we do not store the file itself. You can likewise upload export files from IMDb, Letterboxd, Trakt or Netflix, or a CSV, TSV or JSON file of your own. Your browser reads these files itself (including ZIP archives); only the entries derived from them are transmitted to us — title, IDs, year, type, list membership, rating, season and episode, and date. Other contents of the file, such as device or profile names in a Netflix viewing history, do not leave your device, and we do not store the file itself. Wovia has no connection with these services.
Sharing: you can show your lists (such as the watchlist or watched titles) via a share link. Anyone who knows the link can view the selected lists without signing in, read-only. Your ratings, your notes and your display name only appear there if you expressly switch this on when creating the link; everything is off by default. The link consists of a long random ID, is blocked for search engines and is not listed anywhere. For each link we store your account ID, the chosen settings, the time of creation and the number of views — without IP addresses or any other information about visitors. Under “Teilen” (Share) you can withdraw a link at any time; it then stops working immediately. Please bear in mind that a link you pass on can be opened by anyone who obtains it. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).
Universes and AI: under “Reihen” (universes) you can put together films and series that belong together as a universe; you select them from TMDB search results. Our server retrieves the information on the selected titles from TMDB itself. Whether the titles really form a universe, the order of the story, the name of the universe and the countries in which it is popular are then assessed by the AI model Claude of Anthropic PBC (USA), used via the Claude API; Claude may use a web search for this. Claude may also name titles still missing from the universe; our server searches for these on TMDB itself and has the complete list checked again. On a universe page you can also add titles, suggest titles for removal or have missing titles searched for; the same applies there. A title is only removed if the check also finds that it does not belong to the universe. You can also suggest a story order; this is checked as well. Only you can see your own requests and their results. Claude rates how unsuitable a suggestion was (a number from 0 to 3). From this we calculate penalty points, which we store with your account ID for 30 days; anyone who repeatedly makes rejected or obviously unsuitable suggestions may be unable to submit further ones for a while. Accepted changes to a universe (added and removed titles, changed story order) are recorded in a change history. It can be viewed by everyone on the universe page but shows no names or accounts — only whether a change was made by you. Internally we store your account ID with it, because you are responsible for your changes. Signed-in users can dispute another user's change; if the check refutes it, the account that made it receives penalty points as for a rejected suggestion. The legal basis for penalty points and the change history is our legitimate interest in protecting the shared universes against misuse and errors (Art. 6(1)(f) GDPR). If you delete your Wovia data, we remove your penalty points and your account ID from the history; the changes themselves remain without any link to you. The request is made by a separate, isolated machine of ours. Only the title, type, release date and a short synopsis of the selected titles are transmitted to Anthropic — no text from you, and not your account ID, your name, your IP address or your lists. Anthropic does not use inputs via the Claude API to train its models and deletes them within 30 days unless they are needed for longer to enforce its usage policies or for legal reasons. This involves a transfer to the USA, safeguarded by the European Commission's standard contractual clauses in the data processing agreement with Anthropic (Art. 46(2)(c) GDPR). Our server checks the result again; the AI cannot add titles. We store your suggestion — the selected titles, the result with its reasoning, your account ID and the time — in order to enforce the limit of a few suggestions per day and a pause after repeatedly rejected suggestions, and to avoid having identical selections checked again, and delete it after 30 days. Accepted universes contain no information about you and are visible to everyone. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).
Wovia apps for Android, iPhone, iPad, Mac and Apple TV: the apps give you access to the same Wovia data as the website; they talk to wovia.winku.de (opens in a new tab) and winku.de (opens in a new tab) and load images directly from TMDB (see “Images are loaded directly from TMDB”). You sign in with your Winku account in the browser; the app never sees your password. Instead, it receives a sign-in credential and stores it encrypted in your device’s secure storage (Android Keystore or Keychain; on Android, iPhone and iPad in a way that keeps it out of device backups). We only store a checksum of it and your device’s name so you can recognise the sign-in. The credential stays valid for 30 days after it was last used and can be ended individually under “Signed-in devices” on winku.de (opens in a new tab). On your device, the apps keep their settings, your recent searches and cached images, and the Apple TV app also keeps the lists and titles it last loaded so that it starts quickly; they need this for the features you use (§ 25(2) no. 2 TDDDG). The apps use no advertising or analytics services and no push notifications. If you open a service from an app, your device starts that service’s app or website; what the service learns in the process is governed by its privacy policy. “Delete Winku account” in the settings of the apps for Android, iPhone, iPad and Mac takes you to winku.de/account/privacy (opens in a new tab). The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).
Deletion: under Settings → “Delete my Wovia data” you remove, immediately and permanently, everything Wovia has stored for your account, including your Wovia sessions. Your Winku account is not affected. If you delete your Winku account on winku.de (opens in a new tab), we also delete your Wovia data in the same way along with it; if Wovia cannot be reached at that moment, we catch up on it automatically.

15hWatchMod — chat moderation for Twitch#

WatchMod (watchmod.winku.de (opens in a new tab)) is a bot that moderates a channel's Twitch chat according to the channel owner's rules, together with a dashboard. WatchMod may be restricted to individual accounts.
Sign-in and session: you sign in with your Winku account. winku.de (opens in a new tab) passes to WatchMod, via a single-use ticket valid for 60 seconds, your account ID, your display name, the address of your profile picture and, if you have connected Twitch to your account, your Twitch ID and Twitch login name. WatchMod asks winku.de (opens in a new tab) whether your account may use WatchMod; only the account ID is transmitted for this. After sign-in WatchMod sets the cookie “watchmod.sid”. It contains only a random session ID and expires after 14 days without use; the session data, including the chosen language, is stored in our database. The cookie is technically necessary; no consent is required for it under § 25(2) no. 2 TDDDG.
Of the channel owner: when the channel owner connects their channel, we store the channel's Twitch ID, name and picture address, the ID of their Winku account and the Twitch access and refresh tokens with the permissions “channel:bot” (the bot may appear in the channel) and “moderation:read” (read the list of moderators); the tokens are stored encrypted in our database. In addition we store the channel's settings — filters, commands, timers, texts, reasons, giveaways, the texts for events (such as thanking for subs, raids and follows), the raid and spam protection including a trusted list of channel names, counters and quotes — and the team: Twitch ID, login name, profile picture and permissions of the people the channel owner lets into the dashboard, as well as the members of self-created exemption groups. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).
Change log: anyone who changes settings in the dashboard or moderates via the dashboard is recorded in the channel's change log with the ID of their Winku account, their display name, their profile picture, their Twitch login name and the change, and for an action also with the name of the person affected. Only the channel owner can see the change log; entries are deleted after 365 days. If someone deletes their Winku account, we anonymise their entries in other people's channels: what was changed stays, but not who did it. The legal basis is the legitimate interest of the channel owner in being able to see who changed what in their channel (Art. 6(1)(f) GDPR).
Of viewers in the chat: the bot receives every chat message of the channel via Twitch and checks it in memory against the configured rules. It keeps the last 400 messages per channel in memory only; they are not stored permanently and are gone after a restart. The live chat in the dashboard likewise shows the channel owner and their team the last up to 150 messages per channel from memory only. What is stored: for each person in the chat, the Twitch ID, display name, profile picture address, the time of first and last appearance, the number of messages and, if the channel has switched on the check for new accounts, the creation date of the Twitch account, which WatchMod requests from Twitch for this purpose (deleted after 365 days without a new appearance); for an action taken by the bot, a log entry with ID, name, module, reason, match, action and the triggering message (deleted after 90 days); a record of penalties with type, duration, reason and the person acting, but without message text (deleted after 730 days); a violation counter per person (deleted after 180 days without a new violation). Only at the moment of a penalty, and only as long as the channel owner does not switch it off, do we also save the last messages of the person concerned (default 15) as evidence; evidence added manually by moderators is added to it. Both are deleted together with the associated penalty record. Anyone who takes part in a giveaway is listed with ID, name, role and result in its list of participants until the channel owner deletes the giveaway. The legal basis is the legitimate interest of the channel owner in moderating their chat and in recognising repeated violations (Art. 6(1)(f) GDPR). The channel owner decides on the use in the channel and informs their viewers about it insofar as they are obliged to do so.
Events, quotes and statistics: events in the channel — subs, gift subs, raids, follows, new Bits badges and donations via Twitch's charity feature — are listed with Twitch ID, name, type, amount and the bot's reply in the channel's event list (deleted after 30 days). Quotes added in the chat or in the dashboard are stored with text, game, date and the name of the person who added them until they are deleted in the channel. If the channel owner switches on the public command list (watchmod.winku.de/c/ (opens in a new tab) followed by the channel name), anyone can view the channel's commands there and, if the channel owner allows this as well, the quotes — without the name of the person who added them. For replies such as “followage” or “account age”, the bot asks Twitch since when the person asking, or the person named, has followed the channel or when their account was created; the result stays in memory for a few minutes only. For the statistics we store only counts per hour — messages, the number of different chatters, first-time chatters, actions and events — without names or texts (deleted after 400 days). The legal basis is the legitimate interest of the channel owner in running and evaluating their chat (Art. 6(1)(f) GDPR).
Deletion: if the channel owner disconnects their channel in the dashboard, we revoke the tokens at Twitch and immediately delete the channel, the tokens and all data stored for the channel. If you delete your Winku account on winku.de (opens in a new tab), we also disconnect all your channels and delete everything stored for them, together with your WatchMod sessions; if WatchMod cannot be reached at that moment, we catch up on it automatically. Requests for information or deletion from viewers are likewise handled upon a message via the support form.
Recipients: Twitch Interactive, Inc. (USA) — every bot message, every action and every request goes through Twitch, because that is where the service takes place; Twitch's privacy notice applies in addition. There are no other recipients. The application runs on our own server in Germany and is delivered via Cloudflare (section 2a).

15mSigning in with accounts from other providers (Google, Microsoft, Minecraft, PayPal and others)#

Besides e-mail address and password, Twitch (section 15a) and Discord (section 15d), you can sign in to winku.de (opens in a new tab) with an existing account from the providers listed below. Signing in via a provider is optional; every Winku account can be created and used without it. We list further providers here before enabling sign-in with them.

How sign-in works: when you choose a provider, we redirect you to its site. You sign in there and decide yourself whether to share the requested details with winku.de (opens in a new tab). We never learn your password at the provider. We only request read access to the basic data listed per provider below — no right to publish, buy or pay anything on your behalf, and no access to messages, contacts, posts, files or payment data. We use the access token issued by the provider exactly once to retrieve these details and do not store it. Exception for Apple: we keep the refresh token that Apple issues at sign-in, encrypted, and use it only to revoke your authorization at Apple when you disconnect Apple from your account or delete your account. The token is deleted together with the connection. The connection is protected against forged requests with a random value (OAuth 2.0 with "state" and, where the provider supports it, PKCE).

First sign-in and e-mail confirmation: when you sign in with a provider for the first time, we show you the name and e-mail address from the provider's details; if either is missing, we ask for it. You can change both. We send a six-digit code, valid for 15 minutes, to the e-mail address. Your Winku account is only created with this code — even if the provider already reports the address as confirmed. This ensures that the address belongs to you. If the confirmed address already belongs to a Winku account, we connect the sign-in option to that account and inform you by e-mail. To limit abuse, for every code sent we store a non-reversible check value of the e-mail address, your IP address and the time for at most 24 hours; the code itself is only kept as a check value in your session.

What we store: for each connection we store the provider, your account identifier there, the user and display name, the e-mail address shared, the address of the profile picture and the times of connecting and of the last sign-in. We download a profile picture once and keep it on our server so the provider does not learn your IP address when it is displayed; we do not replace a picture you uploaded yourself. We use this data solely to sign you in and to display your account. We do not share or sell it, do not use it for advertising, profiling, analytics or training AI models, and write nothing back to the providers.

Deletion: you can disconnect a connection at any time under "Connections" in your account; we then immediately delete all data stored for it, including the downloaded profile picture (if it is also your profile picture on winku.de (opens in a new tab), it remains there until you change it). If the connection is your only way to sign in, we first ask you to set a password or another option so you are not locked out of your account. Deleting your account deletes all connections. You can also request deletion informally at [email protected]. You can additionally revoke access for winku.de (opens in a new tab) in the account settings of the respective provider; data stored there is managed by the provider.

The providers in detail:

• Google — provider: Google Ireland Limited, Dublin, Ireland. Scopes: openid, email, profile. We receive: Google ID, name, e-mail address, profile picture. Privacy policy: https://policies.google.com/privacy (opens in a new tab)
• Microsoft — provider: Microsoft Ireland Operations Limited, Dublin, Ireland. Scopes: openid, email, profile. We receive: Microsoft ID, name, e-mail address. Privacy policy: https://privacy.microsoft.com/privacystatement (opens in a new tab)
• GitHub — provider: GitHub, Inc., San Francisco, USA. Scopes: read:user, user:email. We receive: GitHub ID, username, name, profile picture and your confirmed primary e-mail address. Privacy policy: https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement (opens in a new tab)
• GitLab — provider: GitLab Inc., San Francisco, USA. Scopes: openid, profile, email. We receive: GitLab ID, username, name, e-mail address, profile picture. Privacy policy: https://about.gitlab.com/privacy/ (opens in a new tab)
• Amazon — provider: Amazon Europe Core S.à r.l., Luxembourg. Scope: profile ("Login with Amazon"). We receive: Amazon ID, name, e-mail address — no order, address or payment data. Privacy policy: https://www.amazon.de/gp/help/customer/display.html?nodeId=201909010 (opens in a new tab)
• Spotify — provider: Spotify AB, Stockholm, Sweden. Scopes: user-read-email, user-read-private. We receive: Spotify ID, display name, e-mail address, profile picture; Spotify additionally sends country and subscription type, which we neither use nor store. Privacy policy: https://www.spotify.com/legal/privacy-policy/ (opens in a new tab)
• PayPal — provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Scopes: openid, email, profile ("Log in with PayPal"). We receive: PayPal ID, name, e-mail address — no balances, payments or bank details; nothing is paid through this sign-in. Privacy policy: https://www.paypal.com/legalhub/privacy-full (opens in a new tab)
• Kick — provider: Kick Streaming Pty Ltd, Melbourne, Australia. Scope: user:read. We receive: Kick ID, username, e-mail address, profile picture. Privacy policy: https://kick.com/privacy-policy (opens in a new tab)
• Dropbox — provider: Dropbox International Unlimited Company, Dublin, Ireland. Scope: account_info.read. We receive: Dropbox ID, name, e-mail address, profile picture — no access to your files or folders. Privacy policy: https://www.dropbox.com/privacy (opens in a new tab)
• Patreon — provider: Patreon, Inc., San Francisco, USA. Scopes: identity, identity[email]. We receive: Patreon ID, name, vanity name, e-mail address, profile picture — no membership, pledge or payment data. Privacy policy: https://privacy.patreon.com/policies (opens in a new tab)
• Epic Games — provider: Epic Games, Inc., Cary, USA. Scope: basic_profile (Epic Account Services). We receive: Epic account ID and display name; Epic does not share an e-mail address, so we ask for it. Privacy policy: https://www.epicgames.com/site/privacypolicy (opens in a new tab)
• Steam — provider: Valve Corporation, Bellevue, USA. Method: OpenID. We receive: your Steam ID; where applicable we retrieve your public profile name and public profile picture via the public Steam interface. Steam does not share an e-mail address, so we ask for it. Privacy policy: https://store.steampowered.com/privacy_agreement/ (opens in a new tab)
• Telegram — provider: Telegram FZ-LLC, Dubai, United Arab Emirates. Method: Telegram Login (confirmation in your Telegram app, signed with our bot's key). We receive: Telegram ID, first and last name, username, profile picture and the time of approval; Telegram does not share an e-mail address or phone number, so we ask for the address. Our bot does not send you messages. Privacy policy: https://telegram.org/privacy (opens in a new tab)
• Lichess — provider: Lichess.org (opens in a new tab) (Association Lichess, France). Method: OAuth 2.0 with PKCE, scope email:read. We receive: Lichess ID, username, the name given in your profile where available, and your e-mail address. We return the access token to Lichess immediately after retrieval. Privacy policy: https://lichess.org/privacy (opens in a new tab)
• Roblox — provider: Roblox Corporation, San Mateo, USA. Scopes: openid, profile. We receive: Roblox ID, username, display name and profile picture; Roblox does not share an e-mail address, so we ask for it. Privacy policy: https://www.roblox.com/info/privacy (opens in a new tab)
• Wikipedia — provider: Wikimedia Foundation, Inc., San Francisco, USA. Scope: identity verification with real name and e-mail address. We receive: the central ID of your Wikimedia account, username, real name where given and — only if confirmed at Wikimedia — your e-mail address; no edits or watchlists. Privacy policy: https://foundation.wikimedia.org/wiki/Policy:Privacy_policy (opens in a new tab)
• Apple — provider: Apple Distribution International Limited, Cork, Ireland. Method: “Sign in with Apple” (OpenID Connect), scope: name, email. We receive: an Apple identifier that is unique to winku.de (opens in a new tab), your name (only on your first sign-in and only if you share it) and your e-mail address. If you wish, Apple hands out a relay address instead of your real one (@privaterelay.appleid.com) and forwards messages to your mailbox; we send the confirmation code to that address too. Apple sends the reply to our callback address by POST; because your session cookie is not sent along with a POST like that, we keep it in our database for at most 10 minutes and delete it as soon as your sign-in picks it up. So that your authorization at Apple ends when you disconnect Apple or delete your account, we store Apple’s refresh token encrypted and send it back to Apple at that moment (revocation). After that, “Winku” no longer appears under “Sign in with Apple” in your Apple ID. Privacy policy: https://www.apple.com/legal/privacy/ (opens in a new tab)
• itch.io (opens in a new tab) — provider: Itch Corp, USA. Scope: profile:me. We receive: itch.io (opens in a new tab) ID, username, display name and profile picture; no purchases, downloads, payment data or e-mail address, so we ask for it. Privacy policy: https://itch.io/docs/legal/privacy-policy (opens in a new tab)
• X — provider: Twitter International Unlimited Company, Dublin, Ireland. Scopes: users.read, tweet.read, users.email. We receive: X ID, username, name, profile picture and your confirmed e-mail address. X technically requires "tweet.read" to retrieve your own profile; we do not read, store or publish posts. Privacy policy: https://x.com/en/privacy (opens in a new tab)
• TikTok — provider: TikTok Technology Limited, Dublin, Ireland. Scope: user.info.basic. We receive: TikTok ID (open_id), display name, profile picture; TikTok does not share an e-mail address, so we ask for it. Privacy policy: https://www.tiktok.com/legal/privacy-policy-eea (opens in a new tab)
• Minecraft Java — provider: Mojang AB, Stockholm, Sweden (a Microsoft company). Method: verification by joining a server instead of a sign-in page. You enter your Minecraft name; we look up the matching UUID at Mojang and show you a personal server address (…mc.winku.de (opens in a new tab)) that is valid for 10 minutes. When you join it with Minecraft, your game registers the join with Mojang like with any online server. Our verification server on our server at OVHcloud in Germany asks Mojang, using your Minecraft name and a check value of the connection, whether exactly this account has joined, reports the code, UUID, name and the address of your skin to us and closes the connection immediately; it stores nothing, not even your IP address. When it closes the connection, Minecraft shows you a confirmation code that you enter on winku.de (opens in a new tab) — only then does it continue. That way nobody who lures you onto such an address can take over your account. We delete the open verification (code, expected UUID and name, language of the page, and one non-reversible check value each of the confirmation code and of your IP address against abuse) after 24 hours at the latest. We receive: Minecraft UUID, Minecraft name and your skin; Minecraft does not share an e-mail address, so we ask for it. Privacy policy: https://privacy.microsoft.com/privacystatement (opens in a new tab)
• Minecraft Java via the Microsoft sign-in — providers: Microsoft Ireland Operations Limited, Dublin, Ireland (Xbox Live) and Mojang AB, Stockholm, Sweden. Scope: XboxLive.signin. Since 22 September 2026 you can also prove your Minecraft Java account without starting the game: you sign in with Microsoft, we have the sign-in confirmed by Xbox Live and exchange that confirmation at the Minecraft interface (api.minecraftservices.com (opens in a new tab)) for your Minecraft profile. We receive: Minecraft UUID, Minecraft name and the address of your skin; Microsoft does not share an e-mail address here, so we ask for it. We use the access tokens from Microsoft and Mojang only in that moment and do not store them; no verification record is created as with the server join. If the Microsoft account does not own Minecraft Java, we tell you so and store nothing. Without a Microsoft sign-in, the route via the server join remains. Privacy policy: https://privacy.microsoft.com/privacystatement (opens in a new tab)
• Minecraft Bedrock — provider: Microsoft Ireland Operations Limited, Dublin, Ireland (Xbox Live). Scope: XboxLive.signin. We receive: your gamertag and your Xbox user ID (XUID); Xbox does not share an e-mail address, so we ask for it. Where available, we fetch the skin for the head with your XUID from the interface of the open-source project GeyserMC (api.geysermc.org (opens in a new tab)); GeyserMC only receives the XUID, and a skin only exists there if you have played on a server with Geyser before. Privacy policy: https://privacy.microsoft.com/privacystatement (opens in a new tab)

Minecraft name and head: From your skin we draw the face of your character as a picture and store it on our server like any profile picture; we load the skin itself from Mojang (textures.minecraft.net (opens in a new tab)) only for this and do not store it. Every time you sign in with Minecraft we renew the name and head. If you choose Minecraft in your account under "Displayed name and picture", winku.de (opens in a new tab) shows your Minecraft name and the head wherever it shows you (header, reviews).

The legal basis is the performance of the user relationship at your request (Art. 6(1)(b) GDPR) and, for limiting abuse, our legitimate interest in a secure sign-in process (Art. 6(1)(f) GDPR). Each provider is itself responsible for processing on its side; its privacy policy applies. Some providers are based outside the European Union (USA, Australia). Your sign-in is transmitted there because you expressly choose this sign-in option yourself (Art. 49(1)(b) GDPR); for certified providers in the USA the EU-US Data Privacy Framework applies in addition. The provider names are trademarks of their owners; there is no business relationship with them beyond the use of their sign-in interfaces.

15nBergo – backups for PCs, NAS and mobile devices#

Bergo consists of the program for Windows and macOS on your PC or Mac, the Bergo station (on your NAS, Raspberry Pi or another PC), the web app at bergo.winku.de (opens in a new tab) and the Bergo app for Android and iOS (see “Bergo app for Android and iOS” at the end of this section).
Your files stay with you: backups, uploads from your phone and archived data travel within your home network directly from device to device, encrypted and with mutual verification of the device certificates. Neither files nor file and folder names nor the passwords of upload logins are transmitted to winku.de (opens in a new tab); we have no access to your backups and keep no copy. To a station or PC, the Bergo app only uploads over Wi-Fi or Ethernet at your home and only to private addresses, never over mobile data, never over a VPN and never over the internet. If you choose your cloud as the target in the app or the program, files go straight from your device to your cloud provider, which also means over the internet, but never through winku.de (opens in a new tab) (see “Backing up to your cloud” at the end of this section). Album names, folder names and naming patterns for filing go only to your own station or PC, never to winku.de (opens in a new tab); files you restore to the phone come straight from there.
Sign-in and session: the web app signs you in with your Winku account; winku.de (opens in a new tab) passes your account ID, your display name and the address of your profile picture via a single-use ticket valid for 60 seconds. bergo.winku.de (opens in a new tab) sets a session cookie (“bergo.sid”) with a random ID that is valid for 90 days and extended with every use, and – if you switch the language – the cookie “bergo_sprache” (one year). Both are technically necessary (section 25(2) no. 2 TDDDG). Whether your account may use Bergo is decided by winku.de (opens in a new tab).
Connected devices: when you connect a device, we store with your account the name you give it, its type (PC, station or phone), the operating system (for phones with device model) and the program or app version, and a device credential that we only keep as a hash (SHA-256). While Bergo runs, each device reports about once a minute its IP addresses in the home network, its port, its self-issued device certificate including the fingerprint, free and total storage space, and which tasks it takes on (accepting backups, phone uploads, archiving). We pass this information only to the other devices of the same account so that they find each other in the home network and trust only each other. We also store the time of connecting and of the last report. Phones check in when the app starts and before every backup run, at most once per minute, and transmit neither IP addresses nor storage space.
Reports: after every backup, archiving and restore, the device sends a short report: name of the backup, target, start, end, result, number and total size of the files and, if applicable, an error text from which the program removes paths beforehand. Reports contain no file or folder names; we delete them after 90 days. The Bergo app also sends such a report (named “Fotos & Videos”) after a run with new files.
Codes: codes for connecting a PC or phone are valid for 15 minutes, invitations for stations for 60 minutes. We store them only as a hash and delete them one day after they expire. To slow down guessing, we count requests per IP address in the server’s memory for up to one hour; this protects your account against abuse (Art. 6(1)(f) GDPR).
How long we keep data: we keep connected devices and the time of their last check-in until you remove the device, delete your Bergo data under “Setup” or delete your Winku account; we do not remove devices on our own after a fixed period. Every new check-in overwrites the home network addresses and storage space a device reported before. We delete reports after 90 days and codes one day after they expire; your sign-in at bergo.winku.de (opens in a new tab) ends 90 days after you last used it.
Purpose and legal basis: the processing serves solely so that your devices find each other, identify themselves to each other and you can see the state of your backups (Art. 6(1)(b) GDPR). Program, station, web app and Bergo app connect to our server encrypted via Cloudflare (section 2a). Only the other devices of your account see a device’s details; apart from the service providers in section 2a who host, deliver and back up for us, nobody receives them.
Program for Windows and macOS: sign-in, the check whether your account may use Bergo, updates, error reports and – only with your consent – usage figures work as for all our programs (sections 4 and 9 to 12). On Windows the Winku Agent handles sign-in and updates; on a Mac, Bergo only tells you about a new version and you install it yourself. Notifications (such as “Backup done” or “Target not reachable”) are shown by your operating system; they do not go through a push service or through us. If you turn on autostart, Bergo adds itself to your user account’s login items; nothing is sent to us for this.
Deletion: you remove individual devices in the web app or in the program; under “Setup” → “Delete my Bergo data” you delete all Bergo data of your account (devices, codes, reports) immediately. If you delete your Winku account on winku.de (opens in a new tab), we also delete all Bergo data of your account (devices, codes, reports) along with it; if Bergo cannot be reached at that moment, we catch up on it automatically. Your backups on your devices and storage media are not affected. You can also remove phones in the Bergo app under “Disconnect”; a phone removed in the web app forgets the pairing at its next check-in.
Installing and updating the station: the web app shows you the command to install it. It downloads the installation script and the station program from bergo.winku.de (opens in a new tab); the station also does this every time it starts, to update itself (this creates the log data described in section 2). Your device downloads the station’s base images (Node.js on Alpine Linux) directly from Docker Hub (Docker, Inc., USA) and, if you turn on SMB, Samba from the Alpine Linux package repositories. These downloads happen between your device and these providers; they learn your IP address and process it under their own privacy notices, and we receive nothing from them.
On your devices: the program stores the device credential and certificate, targets, backups, settings, a history of the last 300 operations and passwords for network folders encrypted in your user profile (on Windows with the Windows data protection interface, on a Mac with a key in the keychain); passwords of upload logins only as a hash. The station stores backups, uploads and its settings in the folder you choose during installation; its log, for example of rejected sign-ins, stays on the station. The storage analysis also runs gently in the background on its own, reads only names and sizes of files, not their contents, and keeps its result only on your PC or Mac; on a Mac it leaves out data of other apps and folders you have not given Bergo access to. When archiving, Bergo writes a content list with file names, sizes and checksums to the storage medium so that it remains readable without Bergo. The Bergo app keeps the access token and the device certificate in protected storage (Android Keystore or iOS Keychain); its settings and which files have already been backed up (ID and checksum) are kept only on the phone and on your station, and the history (which file was backed up when: 90 days, at most 10,000 entries) only on the phone. Widgets, the Quick Settings tile and shortcuts read the status from the app’s own storage on the phone (on iOS an app group); none of this is sent to us either.
Bergo app for Android and iOS: The Bergo app backs up your phone’s photos and videos to a device on your home network — to a Bergo station (for example on your NAS or Raspberry Pi) or to a PC running Bergo – or, if you choose, straight to your cloud (see “Backing up to your cloud”). Automatic backup is off by default: you start a backup yourself or switch on continuous backup. If you turn the respective feature on, the app also backs up voice recordings (Android only), files from folders you choose to share (iOS: Files app, Android: folder picker), on Android the local WhatsApp backup (only if you share that folder; it is encrypted and can only be restored through WhatsApp) and, only if you ask for it and allow it, your contacts as a single vCard file (at most daily, only when something changed). If your target is a station or PC, everything you back up goes exclusively over your Wi-Fi (or Ethernet) at home, straight to the device you picked during setup, encrypted and with mutual verification of the device certificates. For this, the app never uploads over mobile data and never over a VPN, and it only connects to addresses in private network ranges; your files never travel over the internet or through our servers. Photos, videos, recordings, files, contacts, their names, capture times, locations stored in photos and checksums never reach winku.de (opens in a new tab), and they reach no third party other than the cloud provider you choose yourself as your target. The same goes for album names, folder names and naming patterns: the app sends them only to your own station or PC on your home network, never through our servers, and bergo.winku.de (opens in a new tab) receives none of them. We have no access to any of it and keep no copy. Setup: when you connect, the app opens the page bergo.winku.de (opens in a new tab) in your phone’s browser, where you sign in with your Winku account; the app never sees your password. The browser uses the technically necessary session cookie of bergo.winku.de (opens in a new tab) (section 25(2) no. 2 TDDDG). Your phone then has its own device credential: a self-issued certificate whose private key never leaves the phone (Android Keystore or iOS Keychain) and an access token that the app keeps in protected storage. What is sent to bergo.winku.de (opens in a new tab): the name you give the phone, the system with device model (for example “Android 15 · Pixel 7a”), the app version, the public device certificate including its fingerprint, a hash of the token (SHA-256) and the time of connecting and of the last report. The app checks in when it starts and before every backup run, at most once per minute, and fetches the list of your connected devices so it knows which station to trust and at which address it can be reached on your home network; the phone itself does not transmit an IP address or storage space. After a run with new files the app sends a short report — number of files, total size, result, start and end and the name of your station, without file or folder names; we delete reports after 90 days. Codes for connecting the phone are valid for 15 minutes; we store them only as a hash and delete them one day after they expire. Permissions: the app asks for access to your photos and videos (Android: photos and videos and the media location, so the original file is backed up unchanged including where it was taken; iOS: photo library), for notifications and — on iOS only — for access to the local network to reach your station. The app reads voice recordings (Android only) and contacts only after you turn on the respective feature and the system asks for your permission; it reads folders only if you share them in the system dialog, and only those. On Android a long backup runs as a foreground service with a visible notification. Your phone only deletes photos or videos when you choose “Free up space” in the app and confirm, and only those that your station has confirmed as backed up with a checksum or that your cloud provider holds with the same size and a matching checksum. Restore: files this phone itself has backed up can be loaded from your station back onto the phone; this works only on your home network, straight from your station. History and notifications: only your phone remembers which files were backed up when (90 days, at most 10,000 entries); bergo.winku.de (opens in a new tab) learns nothing about it. Reminders and error messages are local notifications on your phone, and the app uses no push service for them. The app contains no advertising, no tracking and no third-party analytics or crash-reporting components. You get the app from Google Play or the Apple App Store. Google or Apple process data on their own responsibility when you do (for example to install it and for purchase receipts) and provide us with aggregated statistics and — if you allowed this on your device — crash reports; details are in their privacy notices. If you take part in a test, the following also applies: for a closed test on Google Play, we add the email address of your Google account to the list of testers. With Apple’s TestFlight we see your name and email address if we invite you by email (not via a public link), as well as device, system version, when you installed and opened the app, and crash reports and feedback with screenshots that you send yourself. We use this only to run the test and fix bugs (Art. 6(1)(b) GDPR) and remove you from the list of testers when the test ends or when you ask us to. Deletion: you remove your phone in the web app bergo.winku.de (opens in a new tab) under devices — the phone notices at its next check-in and forgets the pairing — or in the app under “Disconnect”, which removes the phone from your account. Under “Setup” → “Delete my Bergo data” you delete all Bergo data of your account (devices, codes, reports) immediately; if you delete your Winku account at winku.de/account/privacy (opens in a new tab), we delete it along with it. Everything you have backed up is on your own devices and stays there until you delete it yourself. The legal basis for processing on bergo.winku.de (opens in a new tab) is the performance of the user agreement (Art. 6(1)(b) GDPR): your devices need to find each other and identify themselves, and you can see the state of your backups. Like the web app, the app connects to our server encrypted via Cloudflare (section 2a).
Backing up to your cloud: in the Bergo app and the Bergo desktop app you can choose your own storage with a cloud provider as the target instead of a station or PC: Google Drive, OneDrive, Dropbox, MEGA, pCloud, Box, S3-compatible storage (such as Amazon S3, Backblaze B2, Wasabi, Cloudflare R2, Hetzner or IONOS) or WebDAV storage (such as Nextcloud, ownCloud, MagentaCloud, GMX, WEB.DE (opens in a new tab), HiDrive, Koofr, Yandex Disk, a Hetzner Storage Box or your own server). You don’t need a Winku account for this. Your files then go encrypted (HTTPS) straight from your device to that provider, over the internet, but never through winku.de (opens in a new tab) or any other server of ours; signing in with the provider doesn’t go through us either. We receive neither your files nor their names, folders or checksums, nor your credentials for the provider, and we have no access to them. Because this transfer runs only on your device and on your instructions, and we receive nothing from it, we are not a controller within the meaning of the GDPR for your files at the provider; we describe it here so you know what happens. The provider is your own contractual partner and processes your files on its own responsibility under its terms and privacy policy: Google Drive – Google Ireland Limited, Ireland (https://policies.google.com/privacy (opens in a new tab)); OneDrive – Microsoft Ireland Operations Limited, Ireland, or your organisation for a work or school account (https://privacy.microsoft.com/privacystatement (opens in a new tab)); Dropbox – Dropbox International Unlimited Company, Ireland (https://www.dropbox.com/privacy (opens in a new tab)); MEGA – MEGA Privacy Kft., Hungary, or MEGA Networks LLC, USA, if you took out your MEGA plan through the App Store or Google Play (https://mega.io/privacy (opens in a new tab)); pCloud – pCloud AG, Baar, Switzerland (https://www.pcloud.com/privacy_policy.html (opens in a new tab)); Box – Box, Inc., Redwood City, USA (https://www.box.com/legal/privacypolicy (opens in a new tab)); for S3 and WebDAV, the provider or server whose address you enter. Where the provider stores your files is between you and the provider. For the record: Google, Microsoft and Dropbox also process data in the USA and are certified under the EU-U.S. Data Privacy Framework for this. For Switzerland (pCloud) the European Commission has found an adequate level of data protection; where MEGA stores your files is set out in MEGA’s privacy policy (they are only stored there in encrypted form anyway); with pCloud you choose when creating your account whether your files are stored in the EU (Luxembourg) or in the USA. Box is based in the USA and refers to the Data Privacy Framework only for business accounts; with a personal Box account your files are stored in the USA without that commitment. With S3 and WebDAV providers you choose the provider and often the region yourself; if the provider is outside the EU, check first how it protects your data. Signing in through the browser: for Google Drive, OneDrive, Dropbox, pCloud and Box, Bergo opens the provider’s sign-in page in your system browser, never in an embedded web view; you enter your password only there, and Bergo never sees it. The provider then gives Bergo an access key (token). Bergo asks for as few permissions as possible: with Google only for access to the files Bergo creates itself (“drive.file”), with OneDrive only for a dedicated app folder (“Apps/Bergo”) and your profile (name and email address), with Dropbox only for a dedicated app folder (“Apps/Bergo Backup”), with pCloud only for a dedicated app folder. Box has no app folders and only grants permission to read and write all files in your Box account; Bergo only creates the folder “Bergo” there and works exclusively inside it. To show you which account you are connected with and how much space is left, Bergo asks the provider for your account name or email address and your storage usage; this stays on your device. Signing in with credentials in Bergo: for MEGA you enter your email address, password and, if you use it, your two-factor code in Bergo. Bergo does not send your password in plain text but, like MEGA’s own apps, only a sign-in value derived from it, and only to MEGA. Only the session and your MEGA account key, which Bergo needs for encryption, are stored – never the password. Just like MEGA itself, Bergo encrypts every file on your device first (end-to-end), so MEGA cannot read it; you still see your files normally in MEGA. For S3 you enter the endpoint, region, bucket, access key and secret (ideally a key that is limited to this bucket), for WebDAV the address, your user name and a password (ideally a separate app password). Bergo only connects to S3 and WebDAV over HTTPS, on your home network too; if your own server uses a self-signed certificate, Bergo shows its fingerprint once for you to confirm and remembers it. Access keys, sessions, secrets and passwords stay on your device only, protected in the Android Keystore, in the iOS Keychain (this device only, not in iCloud Keychain) or on your PC or Mac with your system’s encryption. They never appear in logs, crash reports or support requests. Storage: Bergo stores your files unchanged, as originals, with the provider so you can view them there; except with MEGA it does not add its own encryption. It also keeps an index in the “.bergo” folder (paths, sizes, checksums, capture times) so it can find your files again after a reinstall. In the app, Bergo uploads to the cloud over Wi-Fi only by default, and over mobile data only if you turn that on. “Free up space” only deletes files from the phone whose copy Bergo has verified with the provider as complete and unchanged (same size and a matching checksum). Disconnecting: if you disconnect the cloud in Bergo, Bergo revokes its access with the provider (Google, Dropbox, Box), signs its access key out at pCloud or ends the session at MEGA, and then deletes all credentials on your device; for S3 and WebDAV it deletes the key or password on your device. Microsoft doesn’t offer such a revocation; there you remove the access at account.microsoft.com/privacy/app-access (opens in a new tab), or through your organisation for a work or school account. With every provider you can also remove the access yourself in your account. Your files stay with the provider until you delete them there. Without a Winku account, your device sends nothing to bergo.winku.de (opens in a new tab) – no device details and no reports. If you also connect Bergo to your Winku account, what is described above applies to bergo.winku.de (opens in a new tab), with the same legal basis (Art. 6(1)(b) GDPR); even then we receive no files, no file or folder names and no credentials for your cloud. Google Drive: Bergo uses data it receives through Google APIs only to store, verify and find your backups in your Google Drive. It does not pass this data on to anyone, does not use it for advertising, and nobody at Winku can read it. Bergo’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy (opens in a new tab)).

15oWink — ScamRadar, Wink Arcade, Wink Plaza and Wink Plus for players of HugoSMP.net (opens in a new tab)#

Wink (smp.winku.de (opens in a new tab); until 25 September 2026 “Spawn”, the mod until then “ScamRadar”; until 19 September 2026 hugosmp.winku.de (opens in a new tab), which redirects) is offered by Winku for players of the Minecraft server HugoSMP.net (opens in a new tab); it is not offered by the operators of that server. It comprises the warning list ScamRadar, the Minecraft mod “Wink” (formerly “ScamRadar”), the skill games Wink Arcade (formerly “SMP Arcade”), the Wink Plaza extras and the Wink Plus subscription (formerly “Spawn Plus”). The warning list is not public: only signed-in Winku accounts with access to Wink and a mod linked to such an account can see it; we exclude search engines.
Sign-in and session: You sign in with your Winku account. This happens on smp.winku.de (opens in a new tab) itself: you enter your email address and type the code winku.de (opens in a new tab) sends you — or your password, if you have one. Wink checks none of this itself; it passes your input on to winku.de (opens in a new tab) together with your IP address (section 4) and stores neither password nor code, and your address stays in your session only while the sign-in is running (20 minutes at most). If you do not have a Winku account yet, it is created along the way with that confirmed address and the username you pick. winku.de (opens in a new tab) passes your account ID, your display name and the address of your profile picture via a single-use ticket valid for 60 seconds; we store them together with your role at Wink and the time of your last visit. On smp.winku.de (opens in a new tab) you appear — also to the team — under the name of your Minecraft account (if you linked several, the most recently linked one; in the lobby the one you are currently playing with), never under your Winku display name; the site shows that and your profile picture only to you, for example when you link a mod or as long as you have not linked a Minecraft account yet. Wink asks winku.de (opens in a new tab) whether your account may use Wink; only the account ID is transmitted for this. If you open smp.winku.de (opens in a new tab) without a session, the site asks winku.de (opens in a new tab) once in the background whether you are already signed in there and then signs you in without a further click; it remembers that it has asked in the cookie “smp_sso” for 30 minutes, and after you sign out it remembers there for one day not to sign you in again by itself. After you sign in, smp.winku.de (opens in a new tab) sets the cookie “smp.sid” containing a random session ID; it expires after 30 days without use, and the session data is kept in our database. If you choose a language, the cookie “smp_lang” remembers it for one year. When the Wink app opens a page in its web view, the cookie “smp_app” remembers for one year that the page should appear there without the Winku header and footer; it only contains the value 1. All four cookies are strictly necessary (Section 25(2) No. 2 TDDDG).
Browser storage: In your browser's storage (localStorage), smp.winku.de (opens in a new tab) keeps your records in the title games, whether their sound is on, whether Sonic Echo also marks the note blocks with shapes, which keys you assigned in Blade Duel, Jelly Volley and Plank Drop, whether sound and music are on there and how loud, how strong your practice bot is in Plank Drop, whether Jelly Volley shows you where the ball will land, which level you last practised in Jelly Volley and Blade Duel and with how many jellies per side, which areas of the site you have already visited, the language in which you last viewed it, which trophies have already been shown to you, which ones you earned without signing in, what is in your cart in the shop (which items and for which Minecraft account; it stays only in your browser and is deleted when you buy or empty it), whether the replay of a report shows you the map from above, for which game you have already seen the “How this game works” panel and when you dismissed the tip to install smp.winku.de (opens in a new tab) as an app; for the Copycat sounds (your submissions, sounds in the game, for team members the audios) how loud the players are set; for team members also whether the preview on “Chat emote settings” is collapsed. This stays on your device until you delete the site data of smp.winku.de (opens in a new tab) in your browser. Only the trophies earned without signing in are sent to Wink by the site once you are signed in, so that they are added to your account. Storing this is strictly necessary for the games, settings and trophies you use to work (Section 25(2) No. 2 TDDDG). When you work on a case as part of the team, your browser keeps your draft decision, your place on the page and an open tool in session storage (sessionStorage). That way you find everything again after reloading or going back. It stays only in this tab for at most 30 minutes and is never sent to us. Closing the tab deletes it.
Minecraft account and mod: To report, to object, to use the mod and to play Wink Arcade, you link your Minecraft account. For this, the mod registers a one-time random value with Mojang's session server, and our server asks there whether the player with your name registered that value; your Microsoft access token never leaves your computer. We store the UUID and name of the Minecraft account, the time of the proof and whether it came via the mod or the bank bot with your account; a Minecraft account belongs to at most one Winku account. Only one Minecraft account can be linked per Winku account; you can switch after unlinking. So that this also applies to signing in on winku.de (opens in a new tab), Wink checks with winku.de (opens in a new tab) before linking (sending your account ID and the UUID and name of the Minecraft account) and — when verified through the mod — adds it there to your Winku account as the sign-in method "Minecraft", including the head from your skin (section 15m); if it is already linked to another Winku account, we do not link it. There is one exception: linking via the bank bot (a code sent as an in-game message) is easy to talk a player into. A later verification through the mod therefore assigns a Minecraft account linked this way to the Winku account that provides it; the previous account gets a notice. Pending link attempts are valid for 15 minutes; we store codes only as a hash and delete the attempts one day after they expire. The mod receives its own pass, which we store only as a hash (SHA-256), together with the Minecraft UUID, the mod and Minecraft versions and the time of last use; we delete passes unused for 180 days. If you open a page of smp.winku.de (opens in a new tab) from the mod (for example with /scamradar web), a one-time link signs you in: we store it only as a hash together with your account and the target page; it is valid for two minutes, can be used once and is deleted one day after it expires. Only while you play on HugoSMP.net (opens in a new tab) does the mod keep a connection to Wink open, through which it learns right away when the warning list, badges, your notices or settings or the link of your Minecraft account change; it also fetches the warning list about once a minute, new notices every 30 seconds and your settings and the status of your reports every five minutes, and it keeps asking Wink Arcade for ready checks, challenges and games for you. It also reports how many minutes you have played on HugoSMP.net (opens in a new tab) since the last request; we add them up for your account, because reports only count fully after some playing time. When the mod shows you the warning for a player, it reports that player's UUID and we count per case how often a warning was shown — we do not store who was warned. Otherwise the mod sends the pass, your Minecraft UUID, the versions and the details for the authenticity check (see “Authenticity of the mod”), but no chat logs, no positions and no list of the players around you — except as described further down in this paragraph (“On HugoSMP.net (opens in a new tab) the mod keeps a connection to smp.winku.de (opens in a new tab) even without an account …”), in the WINKHUB (your spot in the hall) and near the Lounge, Plank Drop and the Gallery as described in those paragraphs (for example your seat in the Lounge or your approximate position, so the mod can load the pictures around you), during a 1v1 (see “Wink Arcade — 1v1”), for the handshake and the deal, for “Safe handover” in escrow trading, in the Chat House and in a report you send yourself (see "Reports"). If you type a player name in the mod (when reporting, in commands such as /scamradar check, or where the name goes in HugoSMP.net (opens in a new tab) commands such as /tpa, /msg or /pay — there only if your game itself knows hardly any matching names; never words from chat messages), it sends the letters you typed to Wink and gets matching names back (see “Player directory and name suggestions”); we do not store what you type. For the heads of players who are not in your game right now (such as in name suggestions), the mod loads their skin from Wink — only the UUID is sent, without your account — and keeps it in the Minecraft folder under “config/scamradar”; after three days it fetches it again. Marking, muting, hiding skins and the notices about TPA requests happen only in your game — muting and hiding the skin because of a warning only once a person on the team has checked it; the mod never accepts a request by itself, except those of your opponents and team mates in Wink Arcade fights and, if you pull in the participants as the host of a tournament, theirs (one per second, none from players with a warning), with “Safe handover” in escrow trading, once you both agree, only your trading partner’s, and in the Chat House as host only the other person’s. We store your settings for this with your account — since 20 September 2026 also the mod’s other settings (appearance and notices, chat and emotes — such as whether names in chat are clickable —, TPA — such as whose TPA requests you get a notice for, and the TPA hub —, evidence, ender chest, since 4 October 2026 also Nebelflucht and calls — without devices) and the binding of its keys (five since 21 September 2026, with the "report a good experience" key), so that you can carry on the same way on any computer (seven keys since 22 September 2026, adding "search players" and "incognito"); if you switch incognito on, we store that and when you last switched (at most once every five minutes), and while it is on we do not pass your badge, your green good-experience mark or your cosmetics on to other players' mods and leave you out of the reporters' hall of fame in the game — warnings about you are not affected; the first time you link your account we take over the state from that computer. This also includes which emote sits on which slot of the emote wheel, plus your settings for it (tap = last emote, wheel size, whether walking stops an emote, whether the camera follows your own tomato throw, how loud the band’s instruments sound), which reasons (place and offence) the mod should no longer warn you about, and your settings for voice volume levelling (on/off, target volume, strength, tame loud speakers) — no audio is ever stored for this. For the preview of voice volume levelling in the mod, the team stores a sample recording of a team member’s voice, with their consent. We keep it on our server until it is replaced or deleted and deliver it to all mod users; the mod keeps it in “config/scamradar/stimme”. No recordings of players are made for this. The mod’s voice menu shows who’s talking, who talked last or who was near you. When someone talked and how loud is only kept in your PC’s memory while the game is running – the level is only measured while the menu is open. None of it is saved or sent anywhere. Each player’s volume is Simple Voice Chat’s own and stays in its settings on your PC. These settings also include: whether the voice menu replaces Simple Voice Chat’s volume menu and which key opens it; where the mod shows messages with buttons (Wink bar, in chat or always visible), how many it shows there at most, how long they stay and where the counter sits on your screen; whether the server’s holograms at spawn are hidden for you (show, no text, off); whether the mod shows HugoSMP.net (opens in a new tab) friend requests in chat; whether you have muted goat horns and bells; whether the mod’s options show only the most important settings or all of them; where the navigator’s small compass sits and which key stops navigation. The Wink bar messages themselves only stay in your game’s memory and aren’t sent anywhere; which sounds you hear, when someone uses a horn or bell and where you let the navigator guide you are neither stored nor sent. While your mod is linked to your account and running, we keep in memory only when it last checked in (for at most 3 minutes, gone after a restart). From that, other players with the mod on HugoSMP.net (opens in a new tab) see a small Wink icon above your name while you are using the mod; we store nothing permanently for this. In incognito, or if your account is blocked, nobody sees it. On HugoSMP.net (opens in a new tab) (Minecraft 1.21.6 and later) the mod reads your /settings shortly after you join, without showing the menu; when one of its features needs a setting (TPA requests in a fight, a tournament, the Chat House or a “Safe handover”, payments for a payout or a deal, the bank bot viewing your ender chest), it switches it briefly and then back exactly as it was. Friend requests HugoSMP.net (opens in a new tab) sends you via /friend are fetched quietly and shown in a menu of their own; the mod only accepts or declines them on your click. The last state read, anything still to be switched back and open friend requests (name, player ID, time) are stored only on your PC (under “config/scamradar” in hugo-einstellungen.json and freund-anfragen.json); none of this is sent to Wink. With your other settings on your account we only store the switch “Adjust /settings automatically” (on by default; if it is off, the mod asks in chat). On your PC, the Minecraft folder under "config/scamradar" holds the pass, your notifications of the last 30 days, a contact book (who you dealt with in the last 48 hours via TPA, trade, payment, private message, damage or proximity) and a personal list (players after whose TPA you died shortly afterwards, 90 days); the mod keeps the last minutes of play (as many as set as the evidence length in the mod: half a minute to ten, five at first) in memory only. None of this leaves your PC unless you send it yourself in a report. Also in memory only, the mod keeps the last minutes (the same length) as a game replay (always on HugoSMP.net (opens in a new tab); since 20 September 2026 recording can no longer be switched off, because a report without evidence carries no weight — you set its length under Options → Evidence): ten times a second the positions, view direction, posture (such as sneaking, hitting, blocking, elytra, burning), the item in hand and the health of players within 64 blocks with Minecraft name and UUID, twice a second their six visible equipment slots (both hands, helmet, chest, legs, boots) with name, custom name, count, durability, real enchantments and lore, plus your own inventory (36 slots, ten times a second, so every change) and the contents of windows you open yourself (chests, trades, the auction house — when opened, on every change and when closed, exactly as you see them), dropped items with the exact item (for shulker boxes and bundles with a summary of their contents) — when they were dropped, picked up or disappeared and, as far as the game shows it, who threw or picked them up —, projectiles (arrows, ender pearls, thrown potions, crystals, primed TNT), nearby block changes and snapshots of the blocks around the places you were at during that time (also before a teleport or world change, so that the replay follows you there); if you use Simple Voice Chat, also the voices you hear and your own — there has been no separate switch for this since 20 September 2026. The replay, too, only leaves your PC with a report you send yourself (see "Reports"). If the mod can't upload a replay right away, it keeps it on your PC (config/scamradar/replay-versand) until smp.winku.de (opens in a new tab) accepts it, for at most 72 hours, and then deletes it. The mod downloads badges once as images from our server (without the pass) and keeps them there under "abzeichen". To tell you about new versions, the mod asks smp.winku.de (opens in a new tab) for the latest version for your Minecraft version and loader — without its pass and without an ID for your installation; as with every request, we only process your IP address briefly and do not store it. The mod also fetches our settings for the mod — even without a linked account — on start and, on HugoSMP.net (opens in a new tab), at most every ten minutes (straight away when something has changed): which features we have switched off right now, how often it should ask us, corrected texts and the patterns it uses to recognise messages and menus of HugoSMP.net (opens in a new tab), including the names of the commands it sends there (in fights only from a fixed list in the mod; in the Chat House and for “Safe handover” it takes the teleport and accept command words from us). For this it only sends the mod and Minecraft versions and the loader; we count in memory how many mods per version are asking right now and store nothing about you. It keeps the last answer under “config/scamradar”. The legal basis is our legitimate interest in being able to steer the mod in case of bugs or overload without a new version (Art. 6(1)(f) GDPR). On HugoSMP.net (opens in a new tab) the mod keeps a connection to smp.winku.de (opens in a new tab) even without an account and reports your world, lobby and position (rounded to 0.1 blocks, after 8 blocks of movement, at most once per second and at least every 30 seconds) and, on changes, the UUIDs of up to 80 nearest players within 128 blocks – so it can show objects near you and hide players who are busy elsewhere. We only keep this in memory. The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Error reports of the Wink mod: The mod asks you once on the title screen whether it may send us error reports. This is off by default; without your yes nothing is sent, not even later, and you can change it at any time under Options → More (the choice applies to this PC). If you agreed and a part of Wink crashes, the mod sends a short report to smp.winku.de (opens in a new tab): the kind of error, the places in Wink’s code where it happened (without paths), the mod, Minecraft and loader versions, which other mods are installed in which version, and the time — no error message (it could contain names, paths or chat), no account, no UUID, no name. It sends the same error at most once an hour and at most twelve reports per game start; what it has already sent, it remembers under “config/scamradar” only as an ID of the error with the time. We use your IP address only in memory to slow down too many reports and do not store it. Only Wink admins see the reports; we delete them after 90 days. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time for the future with the same switch.
Linking Discord: You can link your Discord account to Wink to automatically receive the roles for your badges on our Discord server. This works through a code: you get it under “Account”, send it to our bot WinkuBot on Discord, and only then does Wink learn your Discord ID — this is not a sign-in with Discord, and we never see your Discord password. We then store your Discord ID, your display name there, the ID of your Discord profile picture, when the link was made and which roles were set last; the code itself is only kept as a checksum and expires after 15 minutes. Our server fetches your profile picture from Discord itself and keeps a scaled-down copy without metadata, so it can be shown to you under “Account” without your browser contacting Discord; only you can see it there. If you change your picture on Discord, we replace the copy at the next sync; if you unlink or delete your account, we delete it immediately. For the roles, WinkuBot only receives Discord IDs, role names and your rank and clan on HugoSMP.net (opens in a new tab) — not your Winku account, not your reports and nothing from your chats; conversely the bot only reports your display name, the ID of your profile picture, whether you are a member of our server and whether and since when you boost it back to us. Which roles you get follows from the same badges shown on the site — of the reporter levels only the highest — and is synced regularly. Whoever linked their Discord last also rides along in the game, in the little plane that advertises our Discord above spawn: everyone with the Wink mod sees your Minecraft name with rank, clan and badge there and a small figure made from your skin — nothing beyond what everyone already sees of you in the game — until somebody else links their Discord. Players in incognito do not ride along; then whoever linked before takes the seat. If you unlink, you are gone from there within a few minutes as well. The legal basis for this is our legitimate interest in advertising our Discord (Art. 6(1)(f) GDPR); you can object at any time via the support form (Art. 21 GDPR), and incognito takes you out. If you have Wink Plus, you also get the “Wink · Plus” role, with Wink Plus Gold also “Wink · Plus Gold” — WinkuBot only learns that it is currently running for you, not since when or what it costs; if you carry a warning mark, there are no such roles. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). You also get roles for your rank and your clan on HugoSMP.net (opens in a new tab) (“HugoSMP · rank”, “Clan · tag”), as shown in the tab list (from the player directory), “Wink · Creator” while you are in the creator program, and on your birthday “Wink · Geburtstag” (not with a warning mark and not while you play incognito). On your birthday, WinkuBot also congratulates you in the birthday channels of our Discord server with a mention, your Minecraft name and your Minecraft head — it never states your age there; the message stays until the team deletes it. In the commands channel you can send WinkuBot commands: “/check” shows you (only with a linked Discord) the warning status of a Minecraft name, “/account” your own status (linked Minecraft names, until when Plus and Plus Gold run, creator, birthday, rank and clan) — only you see either; “/top” shows everyone the leaderboards that are also on the website. With “/birthday” you can also set, view or delete your birthday via Discord; the same applies as under “Birthday”. For these commands WinkuBot sends us your Discord ID and what you typed, and we only answer with what the bot shows you; nothing is stored, unless you enter your birthday. The bot deletes the replies in the commands channel after 15 minutes. The legal basis is the use of Wink (Art. 6(1)(b) GDPR). While your Discord is linked, WinkuBot regularly tells us whether that Discord account is still a member of our Discord server; we only store yes or no and when this was last checked. We need this because the Discord plane in the mod can only be hidden while you are on the server. If you boost our Discord server, WinkuBot also tells us since when your boost has been running (Discord shows this to every member on your profile). For this we store that point in time, when we last saw your boost and which message about it we last sent you. We use it to unlock for you the booster cosmetics and the pink look (boost pink, boost violet, pink haze) for drone, antenna and watch and, with Wink Plus, the pink chat colours too — for as long as your boost runs and three more days. Everyone with the Wink mod sees the items on your character and so that you are boosting right now; we show nobody since when. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). When your boost ends, the items and colours rest; 90 days after your last boost we delete the details, and straight away when you unlink or delete your account. If you are on the smp.winku.de (opens in a new tab) team (reviewer or moderator), the bot also gives you the matching team role and removes it as soon as your role there changes or is paused; for this the bot only learns which team role belongs to your Discord ID. You can unlink at any time under “Account”; we then delete it immediately and the bot removes your roles at its next sync. It is deleted together with your Wink account anyway. Discord itself is responsible for the Discord server — what applies there is set out in their privacy policy.
Authenticity of the mod: Each time you start Minecraft, each time you join HugoSMP.net (opens in a new tab) and again whenever Wink no longer holds a valid result, Wink checks whether your mod is an official, unmodified version — at start-up even if you are not playing on HugoSMP.net (opens in a new tab) or the mod is not linked. For this, the mod sends the checksum (SHA-512) of its own file, the answer to a single-use random question from Wink (a checksum over the question and the file), its version, the loader, the Minecraft version and whether it comes from a development environment, and — if any — the names of mixins of other mods that interfere with Wink and of Wink classes that another mod overrides; no files, no paths and no list of your other mods. If the mod is linked, its pass and your Minecraft UUID are added, and Wink keeps the result for at most 12 hours, in memory only. If it is not linked, it sends neither pass nor UUID, and Wink only returns the result without storing it; we keep your IP address only in memory to fend off too many requests and discard it after one day at the latest. Wink compares the details with the official files: the ones we have released and the ones published on Modrinth, which it fetches from Modrinth itself without any details about you — for an unknown file it asks Modrinth about its checksum, again without any details about you. The random question expires after 5 minutes. If it is certain that your mod is not an official, unmodified version, the mod shows you a link to the original version, and 1v1 and reporting through the mod are locked until you use it; the warning list and everything else keep working, and you can still report on smp.winku.de (opens in a new tab). If Wink cannot carry out the check reliably at the moment, we lock nothing except 1v1. The legal basis is our legitimate interest in fair games, in reliable reports and in only an unmodified mod acting as referee (Art. 6(1)(f) GDPR). Automatic updates (optional, the mod asks on first start, can be turned off at any time): the mod asks smp.winku.de (opens in a new tab) for a new version and sends its version, the Minecraft version, the loader, the chosen update channel (stable, beta or dev), a random identifier of this installation for step-by-step rollouts and — if the mod is linked — its pass, so we can see whether beta or dev versions are meant for you (role, Wink Plus). If the team gives you the beta tester or dev role, we store it with your account (who gave it, since when) until it is removed or you delete your account. So that the team can give new games, modes and mod versions to specific people early, it can also add you to a group it has set up or unlock a game or a version for you personally. We then store with your account which group you are in or what has been unlocked for you, who added it and since when, until you are removed or you delete your account; adding and removing are also recorded in the moderation log (12 months). Other players cannot see this; it is included in your data export. The legal basis is the use of Wink (Art. 6(1)(b) GDPR). It only downloads a new version if we have signed it and its checksum matches, and swaps it when you quit the game. We store nothing about you; as with every request, the server briefly sees your IP address.
Account via Minecraft (quick account): If you do not have a Winku account yet, you can choose "Continue with Minecraft" when linking the mod. Wink then passes winku.de (opens in a new tab) a signed proof, valid for ten minutes and usable only once, containing the UUID and name of the Minecraft account that has just been verified with Mojang. If you accept the terms, winku.de (opens in a new tab) creates a Winku account: its display name is your Minecraft name; we store the UUID and name of the Minecraft account as the sign-in method "Minecraft", the time and your acceptance of the terms. Right after that you choose a username and confirm your email address with a code (section 4); until then the account carries a placeholder address of the form "mc-<UUID>@minecraft.invalid", to which nothing is ever sent, and cannot be used yet. You don't need a password: you sign in through the mod or with Minecraft on winku.de (opens in a new tab); if you lose access to Minecraft, your email address gets you back in ("Forgot password"). winku.de (opens in a new tab) remembers used proofs for one day so that none is accepted twice. The legal basis is the contract of use (Art. 6(1)(b) GDPR); you can delete the account like any Winku account under "Your data".
Reports: If you report a player, we store the UUID and name of the reported player, your Winku account and your Minecraft account, the place and offences you pick (and from them the category), your description, the time, whether the report came from the mod or the website, and the evidence you send along: the contact with the reported player detected by the mod (type and time, such as TPA or trade), the chat lines that name the reported player, links to clips (Medal, YouTube, Twitch, Streamable) that you attach yourself, images (re-encoded, without metadata), videos (repackaged without metadata), the mod's log and the mod's game replay. From the mod you can only report on HugoSMP.net (opens in a new tab), and you can only report players — on smp.winku.de (opens in a new tab) too — who have been seen there. For this, the mod sends with each report the address you are connected to and — if it currently sees the player in the world or the player list, or you dealt with them in the last 48 hours — how and when it saw them. We use both only for this check and do not store them; on the report we only note how we know the player was on HugoSMP.net (opens in a new tab) (for example “player list” or “player directory”). Otherwise we check whether someone has been seen against data we already hold: the player directory, earlier cases, auction-house findings and linked accounts with playtime on HugoSMP.net (opens in a new tab). Whether this evidence goes along is a single switch when you report; you do not pick individual parts — the mod shows you beforehand what is in it under “What's in it”. The log covers at most the last ten minutes before saving or sending (as many as set as the length in the mod, five at first): your positions, the positions of players within 32 blocks, damage, death, teleports, TPA, trade and payment events, and only those chat lines that name the reported player; our server makes players other than the reported player and those who damaged you unrecognisable before storing it. As of 20 September 2026 our server fetches the reported player’s skin from Mojang for EVERY report and freezes it — exactly as it looked at that moment. It sits quietly with the report so that the case file shows whom you reported, and it goes when the report goes; it only counts as visible evidence if you report a skin or a name. You do not have to attach anything yourself. The mod uploads the game replay in the background after you send the report, namely the whole recording — so that nothing is missing if the team moves the report to the person you actually meant; the times when the reported player was near you, in the chat or in voice chat are marked (older versions of the mod upload only those times, with 15 seconds before and 10 after): movements, posture and equipment of the players, your own inventory, dropped items, projectiles, block changes, the snapshots of the blocks at the places and in the worlds you were in during those times, with the times of the world changes, TPA, trade, payment and damage events, only those chat lines that name a player in the replay (older versions of the mod: only the reported player), and the voices of all players who could be heard in voice chat during those times. Since 20 September 2026 the Minecraft names and UUIDs of ALL players visible during those times go along, and our server attaches each one’s skin, which it fetches from Mojang — without a face and a name it cannot be checked who did what to whom. The replay doesn’t show the names and UUIDs of bystanders to you or to the reported player: they appear as “Player 1”, “Player 2” …, in the chat lines too; figure, movements and voice stay as evidence. Only the team (moderators and admins, not reviewers) can see their names when the review needs them, e.g. to add accomplices – revealed one replay at a time, and every reveal is logged (who, when, which replay); we keep that log as long as the rest of the moderation log (365 days). They remain in the stored recording because, when an unknown person is reported, we use it to build the list of players nearby (see “Reporting an unknown person”). The legal basis is our legitimate interest and that of those affected in clearing up fraud and insults on HugoSMP.net (opens in a new tab) (Art. 6(1)(f) GDPR); voice chat there can be heard by everyone nearby and is also streamed and recorded by players. Anyone who recognises themselves in a replay can object via the support form (Art. 21 GDPR). Our server converts the voices into one audio track per speaker. The moderation team can play the replay right away (reviewers without your name and skin). You and the reported player — they with a verified Minecraft account on smp.winku.de (opens in a new tab), among the replays of reports about them — only see it while we have the 3D replay for players switched on, and only after a waiting time: the end of the recording plus the replay’s length plus 10 minutes. The replay shows things you are not allowed to see while playing (such as what happens behind walls, or invisible players); shown right away, it would give an advantage in the game and break HugoSMP.net (opens in a new tab)’s rules. The reported player sees you in it as a nameless grey figure without a skin. Other players never see replays. Evidence is kept outside the publicly accessible area; only the moderation team and you can see it, and replays, as described, also the reported player. Only the moderation team can see who reported; reviewers appointed by the team for confirmations do not see reporters' names. Against mass reports we store a shortened, salted hash of your IP address with every report and clear it after 30 days. As of 20 September 2026 we also store one number with every report: how many different players you had reported in the seven days before. If someone reports very many different people in a short time, each single report weighs less; the number sits with the report and goes when the report goes. Since 20 September 2026 there is no fixed number of reports per day: we count your reports per day and how many of them were rejected, and only from that does a limit arise — the more rejected reports, the tighter, then a temporary ban and finally a permanent one. Rejected reports count for this for 90 days; confirmed ones count against them. If the team rejects a report, we record with it whether it was not proven, a false report or an honest mistake; an honest mistake has no consequences for you. This information is deleted together with the report. If you report an unusually large number of different players in a short time (ScamRadar: 8 in one hour or 15 in 24 hours; Wink Arcade: 4 different opponents in 24 hours or 8 in 7 days; good experiences: 6 in 24 hours or 8 in 30 days), we do not accept that report and automatically pause reporting in that area for 24 hours; a longer ban that is already running stays. We note the area, the counted numbers, the time and any ban that was running before on your account, and you get a notice. The moderation team looks at the note and keeps the pause, extends it or lifts it; we delete the note 365 days after that review, or earlier together with your account. The team can also ban you from reporting in Wink Arcade separately; we note that on your account with an end date. The legal basis is our legitimate interest in protecting the warning list and the Arcade from mass reports (Art. 6(1)(f) GDPR); you can object to a pause or ban via the support form. For your account we keep how many of your reports were confirmed or rejected; this determines how strongly your reports count. If you are among the ten reporters with the most confirmed reports and have linked a Minecraft account, you appear with your Minecraft name in the reporter leaderboard — on smp.winku.de/scamradar/top (opens in a new tab) with the number of your confirmed and rejected reports, visible to signed-in accounts with access to Wink, and on the reporters’ hall of fame in the game with head, rank, clan, badge and the number of confirmed ones, visible to all players with the mod, even without a linked account (in incognito you are left out there). The page also shows which players on the warning list have the highest levels; who reported whom is shown on neither list. The legal basis is our legitimate interest in showing who reports reliably and how the team checks (Art. 6(1)(f) GDPR); you can object via the support form (Art. 21 GDPR). Your trust level comes from the same record: from confirmed reports, from cases where others independently reported the same thing, from the share with evidence and from how long your Minecraft account has been linked, we calculate a trust value and from that a level. Special badges you have earned once are stored on your account with their key and the time you earned them; which badge you wear you choose yourself, and other players can see it. An open report counts for at most 365 days and fades before that, then it expires; a report confirmed by the team takes effect for 730 days from the decision. We delete expired reports together with their evidence 90 days later, and rejected and withdrawn reports 30 days after the decision. While an expired report is still there, it counts again if something new is reported about the same player. From all reports about a player we continuously calculate a risk value (percentage; shown in the mod and on the website as “…% risk”). It shows how careful you should be with this player: it takes in how serious the violations are, how often they happened, how well they are proven and how long ago they were. Whether the accusations are true is not shown by the number but by the note whether the team has checked them; below a minimum we show no number at all. Together with the warning level, that note, what the player is accused of (place and offence — for cases checked by the team, as the team filed them) and the list of incidents (see “Incidents”), it is the only thing other players get to see in the mod and on the website — not who reported, not how many, not what evidence exists and not exactly how the number comes about; not even a reporter learns how many others reported the same player. Anyone who repeatedly reports falsely can be barred from reporting for a limited time, and permanently if the abuse continues; we note this with an end date on the account, together with the number of bans so far. If the team bars you from reporting (on ScamRadar or in the Wink Arcade), you get a notice with the duration and the reason the team gives; any additional internal note by the team is kept only in the moderation log and in your data export (there with its date, without the name of whoever wrote it). You can contest a ban via the support form. To tune the weights, we keep from decided cases for 180 days only the type of evidence, the type of contact, the category and whether the report was confirmed, without any link to persons. If several people were involved in one incident, you can tick up to four accomplices when reporting — in game under "+ Accomplices", on the website in the report form. For each of them we then create a separate report about the same incident and copy your evidence there, because every person is reviewed and rated individually; the same recording or image therefore sits with several cases. The reports stay noted as belonging together, but each expires on its own and each is deleted on its own. Anyone who does not exist at Mojang is not taken over, and we tell you so. When reporting you can also mute the person for yourself right away — matching the place: hide them in chat, mute them in voice chat, hide their TPA requests, hide their skin or play no more Arcade games with them (the same applies to accomplices); this also works in the mod’s player info and under “My reports”. For this we store with your account the person’s UUID and name, what you turned on and with which report (or that you turned it on by hand). The mod receives this list so that it hides chat, voice, requests and skin only in your game; with “no more Arcade games” Wink Arcade no longer matches you and accepts no challenge between you. The person is not told, and it changes nothing on the warning list or in the rating. If you withdraw a report, whatever hung only on it goes away; otherwise it stays until you lift it or delete your account. The legal basis is the performance of the user relationship (Art. 6(1)(b) GDPR) — you turn it on yourself.
Reporting an unknown person: If you don’t know who it was, you can report an unknown person near you in the mod. We then also store with the report which players were on your “Nearby” list when reporting — that is, whom you could actually see in the 30 minutes before (Minecraft UUIDs and time only), the deposit (amount, status and the reason it was released or kept) and who in the team decided when and to whom the report was assigned. When the team decides on the deposit, we also store whether it is given back or kept, the chosen reason, an internal team note, which suggestion our system had made and which direct contacts with the identified person were on record (such as voice chat, chat, a trade or being nearby). From the replay we also record how many players were near you at the same time and how many talked at the same time (numbers only). To work out the suggestion, we also look at how often you have reported an unknown person before and how those reports ended. Only the team sees this; you get the reason as a notification. If you delete your account, we remove the link to you and the note; the amount stays for our cash accounting. From the replay we work out for the team who was nearby, how close and for how long, who talked, dealt damage to you or threw or picked up items, and who was invisible or sneaking at times. Only the team sees this list and your “Nearby” list; you see the amount, the status and the reason. Freezing and releasing the deposit appear as bookings in your ledger. If the team assigns the report to a person, it becomes a normal report (see “Reports”). Everything is deleted with the report; if the team assigns no one within 30 days, the case counts as unresolved, the deposit is released, and we delete it 30 days later. The legal basis is our legitimate interest in clearing up incidents even without a known name (Art. 6(1)(f) GDPR).
Warning list: The level per Minecraft account results from the reports. Several independent reports from players with proven contact automatically result in a notice and, with more weight, a warning; both are marked as "unchecked". How strongly a report counts depends on the contact and type of evidence, its age, how serious the reported violation is and how often the reporter's reports have been confirmed so far; reports from the same network or in a conspicuous cluster count less. A strong warning is set by a human from the team after the team has seen evidence (“checked by the team”); if very many players independently report the same thing with evidence, it also arises without a check and stays marked as “not yet checked by the team”. When the team confirms a case, it decides how serious it is (minor, moderate, serious or severe); since 23 September 2026 we store this severity with the case, and it caps the level: a minor case stays a notice, a moderate one a warning at most. The automatic level has no legal effect and does not similarly significantly affect anyone (Art. 22 GDPR): it is a labelled warning to other players that drops as soon as the reported player objects. Muting and hiding the skin in the mod only follow from a warning that a person on the team has checked — never from an automatic level or one carried by many players, and never from the auction-house check alone — and only if you have not turned it off in your mod. The warning list shows the UUID, name, skin head, level, risk value, whether it is checked, place and offence (and from them the category), the list of incidents and the team's summary — no names of reporters, not how many reported and no evidence —, as well as badges for the team and supporters and the green good-experience mark. For a badge, the team picks an emoji or uploads an image; we store uploaded images re-encoded and without metadata and delete them at the latest one day after no badge uses them any more. We load names and skins from Mojang; we cache skins and heads for up to 7 days. If the mod only knows the Minecraft name of a player — for example on a TPA request from someone you have never seen — it asks us for the head under that name; we then look the name up in our player directory and, if it is not there, at Mojang. In the game “Wink Run” (formerly “Spawn Run”) you play as a character wearing your own skin once your Minecraft account is linked; your browser loads it from Wink for this, not from Mojang. We delete names of players without any report, objection, badge or link after 30 days. The warning list also concerns players without a Winku account. The legal basis is the legitimate interest of the players of HugoSMP.net (opens in a new tab) in protecting themselves against fraud, traps, insults and other violations in the game (Art. 6(1)(f) GDPR). We protect the interests of those reported by requiring several independent reports with contact, by the labelling, by requiring evidence for every strong warning, by capping the level according to severity, by effects in the mod only after a check by a person, by the time limit, by the non-public access and by the objection procedure.
Aftermath of earlier incidents: When the effect of a confirmed incident runs out, it no longer disappears without a trace, as of 20 September 2026. For this we store two numbers and a date with every case: how heavily the earlier incidents weigh together, how many of them the team confirmed, and when the last one was. From that, a floor of the risk value remains; it halves every eighteen months and never drops below eight percentage points per incident confirmed by the team. This floor does not set the warning level itself — it only says that something happened. We delete these three entries together with the case, 1,095 days after the last incident, provided nothing new has come up by then, no report is attached to the case any more and no objection is open. If an accepted objection lifts the warning, we also take back the aftermath of that incident. If things stay quiet for a long time, the current points drop further as well — someone who changes is not measured against an old incident forever. Incidents: Since 23 September 2026 we also keep a list of incidents for every case. For each incident we store the date, whether the team checked it, the auction-house check proved it or very many players reported it independently, for checked incidents the severity, place and offence, the team's summary and until when it counts; existing cases were given one incident from their last confirmation. The list is shown with month and year on the player page and in the mod, visible to everyone who can see the warning list for as long as the incident counts. Expired incidents are no longer shown there one by one, only with a sentence saying that earlier incidents have expired; after that only the moderation team sees their details. Reports that are not checked yet appear in it together as one single line, never one per report, so that the number of reporters cannot be read off; names of reporters, evidence and points never appear in it. We take an incident out when an appeal against it succeeds or the team rejects a warning carried by many players; otherwise we delete the list together with the case, 1,095 days after the last incident. The legal basis is the same legitimate interest as for the warning list (Art. 6(1)(f) GDPR).
Objection: Anyone on the warning list can object on their player page after proving their Minecraft account — since 20 September 2026 also in the mod under "My reports → Objection"; in both cases the same thing is stored and decided. Until the decision, the warning list shows at most a notice; a level confirmed by the team remains for at most 7 days. Someone from the team who was not involved in the case decides and gives reasons. We store the objection with its text, status and decision and delete it 365 days after the decision. In addition, you can object at any time under Art. 21 GDPR via the support form, even without a Winku account.
Second chance — disclosing: We only switch the second chance on once it has been fully checked; until then only admins can try it out, and we process nothing for it for anyone else. Once it is on: if one of your Minecraft accounts has a checked warning, you can voluntarily disclose what you were warned for and give your side; other players then vote on whether they forgive you. This is possible 14 days after the warning at the earliest, counted from when the incident was confirmed. For this we store your statement, your consent to show evidence pictures, which pictures the team approves, the times (submitted, reviewed, published, end of voting) and the result. Visible are your Minecraft name, your head, your warning mark, the incident as shown on your player page, your statement and the approved pictures — during voting and for 30 days afterwards, to anyone who opens the page, even without signing in; we ask search engines not to index these pages (noindex). Only signed-in users can vote or report. Who reported you is never shown; replays, videos, clip links and incident logs are never published. Before anything becomes visible, the team reviews the disclosure and you confirm the finished view with a second click. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by withdrawing the second chance; we then delete the statement, picture approvals, votes and reports about it right away. Your player page and the mod show next to the incident whether a second chance is running or how it ended (forgiven, not forgiven, too few votes, with the date) and whether a new incident followed — as long as the incident counts and the record of it exists (see retention in the next paragraph); withdrawn, declined or removed disclosures are never shown there. The legal basis for this is our legitimate interest in warning other players accurately (Art. 6(1)(f) GDPR).
Second chance — voting, reports, retention: If you vote, we store your vote (forgive or not), whether it counts and, if not, why, whether your mod’s contact tracking was running at the time and whether only one side reported frequent contact (see “Contact for second chances”), and, to detect multiple accounts, a shortened, salted hash of your network (never the IP address itself). While voting is open we also store proof that you looked at everything: when you opened the statement, which pictures you opened and how long the page was visible. To decide whether you may vote, we check data we already store: account age, linked Minecraft account, playtime, confirmed and rejected reports, your own warnings and connections to the warned player (friends list, same network, same Minecraft account, gifted Plus). If you are connected to that player, you cannot vote. If you are connected to someone who reported, or are frequently in contact with the warned player or a reporter, you can vote, but your vote does not count. How many votes a vote needs is fixed when it is published, from the number of accounts that could vote and were active in the last 30 days; for this we only count and store nothing about individual accounts. Other users never see who voted, only the number of votes and, after the end, the result in percent. The team sees the votes with names so it can spot coordinated voting and strike individual votes. The legal basis is our legitimate interest in a fair vote that can’t be manipulated (Art. 6(1)(f) GDPR). You can report a second chance to the team; we then store the reason, your optional text and your account. Retention: we delete the viewing proof and the network hash of the votes as soon as voting ends. We delete the statement, picture approvals, votes and reports 30 days after the end. A disclosure the team approved but you did not publish expires after 14 days. If the incident no longer exists (successful objection, deleted case), we delete the content right away. What remains is a record without text or votes: case, status, result with the vote counts, the dates and, if the team then lowered the severity, by how much. It is used to enforce the waiting period for a new attempt (30 days after the first “not forgiven” or a withdrawal during voting, then 60, 120 and at most 180 days; after a new incident within a year of being forgiven, 180 days) and to undo a lowering if a new incident follows; it is deleted after 365 days or together with the case. If you delete your account, we delete your disclosures, your votes and your viewing proof; your reports remain without a link to your account until their deadline. If the community forgave you and the team (or, for minor incidents and if switched on, the automation) then lowers the severity, the warning is otherwise handled as described above.
Contact for second chances (mod): So that close friends of a warned player don’t vote on them, the mod counts — once we switch this on; it is off by default, and until then it counts and sends nothing — who you are often in touch with: who you send private messages to, who writes to you (privately or with your name), who you hear speaking in voice chat and who you stand next to for a while — not at spawn, and only on HugoSMP.net (opens in a new tab) with a linked account. In game modes with strangers (Chat House, lounge, Wink Karaoke, Plank Drop, fights from quickplay, calls or tournaments) the mod counts neither voices heard nor proximity; fights from an accepted challenge do count. The counters stay on your computer (for at most three days). We only receive, per player and day, whether a “talk day” or “nearby day” was reached, together with your and the other player’s Minecraft UUIDs and the day — never what you write or say, never where you are, never times of day. We also store since when and when last your mod reported this, and with which version. We use this only for the second chance: if both sides reported frequent contact on at least three days within 90 days, one person’s vote does not count on a second chance of the other, nor on a second chance of someone the other reported. If only one side reports it, the vote counts, but the result then always goes to the team. Other users see nothing of this; the team only sees that a vote does not count for this reason. The legal basis is our legitimate interest in a fair vote (Art. 6(1)(f) GDPR). You can object in the mod under “Contact for second chances”; it then stops counting and immediately deletes what it counted on your computer. With us, each day is deleted after 90 days; if the feature is switched off, we delete everything. When you delete your account, we also delete everything reported about you. Your data export contains what your mod reported and how many entries others reported about you.
Suggestions for places and offences: If an offence or a whole place is missing when you report, you can suggest one — in the browser in the report form, and since 20 September 2026 in the mod as well. For this we store whether it is meant to be a place or an offence, the suggested name, your optional reason, the place it belongs to, your account and the time. The moderation team sees the suggestion together with your account and decides on it; if it is accepted, the name is then available to everyone — so the name becomes public, you do not. We delete decided suggestions 180 days after the decision; if you delete your account, open suggestions disappear entirely and decided ones lose the account and the reason. The legal basis is our legitimate interest in keeping the choices when reporting understandable (Art. 6(1)(f) GDPR).
Reporting a good experience: If someone helped you or traded fairly, you can report exactly that — in the browser or in the mod with a key of its own that you set yourself. For this we store the UUID and name of that person, your Winku account and your Minecraft account, the place and the good reasons you pick (such as "trading: delivered"), your text, your evidence (an image, a video or a clip link; without evidence nothing is created), whether the report came from the mod or the website, the kind of contact the mod detected, the time, whether the two of you reported this about each other, and a shortened, salted hash of your IP address, which we clear as soon as the report can no longer count. The moderation team sees every good experience together with your account and decides with a reason; you get the decision as a notification. Since 22 September 2026, several independent, confirmed good experiences become a PERCENTAGE on the reported person ("70% backed by others"), shown before their name in game, on their player page and in the list of these players; the badges Legit, Trusted and Honor no longer exist. Only that number and the good reasons behind it are public — not who reported them and not how many. For this we store with the person that number, the number of reports that count and since when and until when it applies; when the number first appears, the person gets a notification. A warning, a confirmed incident or expired reports take it away again, and it drops by itself when nothing new comes in. A confirmed good experience counts for 180 days; we delete the report itself, evidence included, 400 days after the decision. If one is rejected as made up, you cannot report a good experience for 90 days. If you delete your account, open reports disappear together with their evidence, and decided ones lose any link to you. The legal basis is our legitimate interest and that of the players in making reliable trading partners recognisable (Art. 6(1)(f) GDPR); anyone who does not want to appear there can object via the support form (Art. 21 GDPR).
Notices, log, abuse protection: We inform you about the status of your reports and objections, about deposits and withdrawals, about Wink Arcade invitations, about achievements you unlock and new best scores, about your subscriptions and about new supporters of your creator code on the website and in the mod, which shows them in the top right — not via messages in the HugoSMP.net (opens in a new tab) chat; we delete these notices after 60 days. If the team confirms a warning on your Minecraft account or re-classifies it (different offence, different severity), you get such a notice — if that Minecraft account is linked to your Wink account — with the classification and how to object, without names of reporters or team members; you cannot switch it off. While your Minecraft account is linked to your Wink account and has a warning level (notice, warning or strong warning), we also store per Minecraft account the last level we told you about, for which incident we told you that a second chance is possible, and when we last wrote to you directly about your warning. We use this to let you know when your warning appears, goes up, goes down or ends, and when you can ask for a second chance (once it is switched on) — never twice for a message like the one above. If the warning ends or you unlink the account, we delete the entry at the next hourly check, and right away with your account; it is part of your data export. You can turn these notices (“Your warning”) off under notifications. The legal basis is the use of Wink (Art. 6(1)(b) GDPR). You decide which of these messages you want at all — whatever you switch off is never written down; messages about your own reports, about warnings and about your account stay on. We store your choice with the settings on your account. We record every decision of the moderation team in a log (who, when, what, reasons), as well as withdrawals and refunds, links made via the bank bot and games with stakes, and delete it after 365 days. To curb abuse, we count requests per IP address and per account for up to 24 hours in the server's memory.
Wink as an app and notifications on your phone (optional): You can put smp.winku.de (opens in a new tab) on the home screen of your phone or PC like an app. For this, the site serves a description of the app (manifest) and a service worker. It only stores files in your browser's storage that are the same for everyone — look, font, images and the “No connection” page — so the app starts quickly and is not blank without a connection; it never stores pages with your data. In detail: when it is installed, it stores the “No connection” page and a few basic files (styles, a script, fonts, images); after that, on first use, it stores further static files of the site (styles, scripts, images, fonts — never recordings or audio files). It always loads pages fresh from the network and does not keep them; APIs, sign-in and sign-in links (links that only work once), live connections, push and uploads it never touches — they go to us and back unchanged. With every new version of our service it deletes its old cache. This is strictly necessary for the app you install (Section 25(2) No. 2 TDDDG) and stays until you remove the app or delete the site data of smp.winku.de (opens in a new tab). If you turn on “Notifications on your phone” on smp.winku.de/app (opens in a new tab) and allow it in your browser, your browser creates a push address with its maker's push service and generates keys for it. We store your Winku account, this push address, the two public keys, a device label taken from your browser's identifier (such as “Android · Chrome”), the language, when you turned it on, when a notification was last delivered and how often delivery failed recently. Through it you get the same messages as in the bell — what you switch off there is not sent to your phone either — and for new messages in Wink Messenger only who they are from, never their content (we don't know it); if your messenger is set to “Do not disturb”, none are sent for it. We encrypt every notification so that only your device can read it (RFC 8291). A number for the app icon can come with the notification; it is only shown on your device. If your browser renews the push address, the service worker tells us the new one together with its keys — the old one serves as proof — and we swap the entry. The push service — depending on your browser Google (Firebase Cloud Messaging), Apple, Mozilla or Microsoft — only sees the push address, the time and the size and delivers it to your device; this may involve a transfer to the USA (Google LLC, Apple Inc. and Microsoft Corporation are certified under the EU-US Data Privacy Framework, Art. 45 GDPR). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); you can withdraw it at any time by turning it off on smp.winku.de/app (opens in a new tab), removing a device there or blocking notifications in your browser. If the push service reports that the push address no longer exists, delivery fails ten times in a row or nothing has been delivered for 120 days, we delete the entry, and straight away with your account; your devices are listed in your data export.
Wink app for Android and iPhone: The Wink app is your way into Wink on your phone. You sign in with your Winku account in the browser; the app never sees your password. For this it gets a pass from winku.de (opens in a new tab); winku.de (opens in a new tab) only stores a checksum of it, plus “Wink” and the name of your device as the name of the sign-in, so you can recognise it at winku.de/account (opens in a new tab) and end it on its own. With every request the app sends this pass, its platform and version and your language setting to smp.winku.de (opens in a new tab). Wink asks winku.de (opens in a new tab) which account the pass belongs to and checks, just like the website, whether your account may use Wink; our server keeps this link in its memory for at most 30 minutes, as a checksum instead of the pass, and stores it nowhere. The app shows what you also see on smp.winku.de (opens in a new tab) — balance and ledger, notifications, the games of Wink Arcade, the ScamRadar player search — and only sends what you do there: look for an opponent, get ready, accept or decline challenges, mark notifications as read. While the app has the Arcade open and for 30 seconds after, you are in the lobby just like with an open tab: others see you there according to your lobby settings, can challenge you and can be matched against you. Less frequent pages and the playing field of a game are shown in an embedded view of smp.winku.de (opens in a new tab). For this the app fetches a link that is valid for one minute and only once and is kept only in memory; through it the view gets the same session as a browser (cookie “smp.sid”, see “Sign-in and session”) and the cookie “smp_app”, and the browser identifier carries the suffix “WinkApp” with platform and version. There, the pages only pass game events to the app — for example that a game was won, so your phone vibrates, or how many notifications are unread; this stays on your phone. The app contains no tracking and no ads, and we receive no device identifier from it. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). If you sign out in the app, it ends the pass at winku.de (opens in a new tab) and deletes the cookies of its view; you can also end it at winku.de/account (opens in a new tab).
Former site: No reports, accounts, balances or other data from the former site smp.winku.de (opens in a new tab) are held at Wink.
Wink Arcade — balance and bank: For the skill games we keep a balance in HugoSMP.net (opens in a new tab) in-game money and a ledger for your account: every deposit, withdrawal, stake, win and returned stake with amount, time, reference (such as the number of the game) and the balance afterwards. For deposits we store the name and UUID of the Minecraft account they came from, for withdrawals the Minecraft account we paid out to. We delete bookings, deposits and withdrawals 180 days after they took place, and the balance account itself when you delete your data at Wink; a remainder under $2 can no longer be withdrawn and is lost when you do. For the settlement with HugoSMP.net (opens in a new tab) we set aside 75% of every fee and every purchase price. For this we store, for each transaction, only the amount, the kind (for example Arcade fee, shop or Plus), the transaction number (such as the number of the game or booking) and the time — no account, no name and no UUID; the number only points to the game or booking for as long as that is stored. If a Wink admin books a collection by HugoSMP.net (opens in a new tab), we also note a remark and their admin account; when the admin account is deleted, that link is removed. We keep these lines, without any link to you, for as long as we need them to reconcile the bank; the legal basis is our legitimate interest in correct settlement (Art. 6(1)(f) GDPR).
Wink Arcade settlement with HugoSMP.net (opens in a new tab): For every settled game with a stake and every tournament with a stake we store a settlement record. It contains the game, the result, each player’s stake, the pot, the fee with its rate and how it was split (HugoSMP.net (opens in a new tab), Wink, creator), what was paid out to the winners or returned, start, end and duration, and the status of the settlement with HugoSMP.net (opens in a new tab). For each player we store the Minecraft name and Minecraft UUID they had in that game, their stake and what went back to them; we do not store a link to your Winku account in these records. What was settled before 11.10.2026 we add retroactively, as far as the games and bookings are still stored. The purpose is proof towards HugoSMP.net (opens in a new tab): under HugoSMP.net (opens in a new tab)’s rules we must fully document every payout of winnings, and the server management must be able to investigate abuse and real-money trading; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The HugoSMP.net (opens in a new tab) server management can view this information on a protected page on smp.winku.de (opens in a new tab), search it by Minecraft name and download it as a file; but cannot change anything. Our admins get in with their Winku account, HugoSMP.net (opens in a new tab) team members with a server management rank (currently OWNER, ADMIN, DEV and SRMOD) with the code in the public chat as for the checklist (see “Checklist for HugoSMP”), and members of the server management with a personal access link (see “HugoSMP server management access”). For a name they also see there the deposits and withdrawals via our bank bot, as long as the ledger still holds them. Once this route is switched on (it is off by default), a Wink admin can report a settlement record to HugoSMP.net (opens in a new tab) through the bank bot as a /paytax command; it contains the amount, the Minecraft names of the players and the opponents, the game, the stake and the settlement amounts. We delete settlement records 3 years (1095 days) after the settlement. If you delete your data at Wink or your Winku account, the Minecraft name and UUID stay in these records until that period ends, because we have to be able to prove the payout to HugoSMP.net (opens in a new tab) for that long and to investigate abuse. Your data export does not contain them, because no Winku account is attached to these records; for information about them, contact support.
HugoSMP server management access: On request, a Wink admin creates a personal read-only access for members of the HugoSMP.net (opens in a new tab) server management, a link with which they can only view the settlement and the checklist. For it we store the name we give the access, when and by which admin account it was created, how long it is valid, whether and by whom it was revoked, when it was first and last used, and of the link only a hash. For every sign-in, page view (at most once per 10 minutes) and download we store the access, the type of access, the page and the time, but no IP address. After signing in, the session expires after 30 days without use, or earlier if the access ends earlier; the session holds the name and validity of the access for this. The purpose is to keep track of who viewed the settlement (Art. 6(1)(f) GDPR). We delete access entries after 365 days, and an expired or revoked access 365 days after it ends.
Server management invite: For members of the HugoSMP.net (opens in a new tab) server management, a Wink admin can create an invite instead of an access link. The invite only works for the first Winku account that accepts it. For this we store with the invite the number of that Winku account and the time it was accepted; we also record the acceptance with that number in the moderation log (365 days). We count every later attempt with the same invite and record it in the access log (time, type, page) and, if you are signed in, with the number of your Winku account in the moderation log. We do not store an IP address. Until you have signed in, only the invite number and a hash of its key are kept in your session, for at most 1 hour. The purpose is that only the invited person sees the settlement (Art. 6(1)(f) GDPR). We delete the binding 365 days after the invite ends. If you delete your Winku account, the invite ends right away and the binding is deleted.
Creator programme: If you apply to become a creator, we store your application: your Minecraft name, the ID and name of your Twitch channel, your text, the status of the application and the team's reply. We learn which Twitch channel you have from winku.de (opens in a new tab), where you link Twitch to your account; we also keep the channel's ID and name with your Wink account and update them each time you sign in. To review the application we fetch the public details of your channel from Twitch and store them with the application: description, partner or affiliate status, follower count, language, category and title, whether you are live, your saved streams (title, date, duration, views), clips from the last 30 days and your schedule; Twitch only learns the public ID of your channel. The team sees the application together with your activity on Wink (playtime, use of the mod, games and most frequent opponents, balance, reports) and can add an internal note to your code. If you have the Media or Famous rank on HugoSMP.net (opens in a new tab) — as it appears in the tab list and so in the player directory — and have linked Twitch, we accept your application automatically, without a review by the team; without that rank the team decides. We delete rejected or withdrawn applications 180 days after the decision, and fetched Twitch details 30 days after fetching if you are neither a creator nor currently applying; an accepted application stays as long as your code exists. If you are a creator, we store your code (it is your Minecraft name), which account it belongs to, whether the link is on or off, and how often it was clicked — the number of clicks, not the visitors. If you enter someone else's code, we store that code with your account, when you entered it, until when it is valid and whether it came by hand or through the link; the creator only sees how many accounts support them right now, not which ones. You can enter a creator code at the bank on smp.winku.de (opens in a new tab) or in the mod at the streamer sign; either way we store the same link. You can only choose a different code 14 days after entering one; if you remove the code earlier, it stops counting immediately, but the link stays as expired with its date so the waiting period still applies. If you win a game with a stake during that time, the creator's share appears as a booking in their ledger and your winnings in yours. If you buy in the shop or get Plus during that time, the creator's share likewise appears as a booking in their ledger — with the amount, the time and the label “Shop” or “Plus”, but without your account, your name or the item you bought — and your purchase in yours as before. In the creator studio, the creator only sees totals per source and day. If the purchase is refunded, the debit of the share appears in their ledger as well. If you arrive through a creator link and do not have an account yet, we ask you first: only if you agree does your browser store a small marker (a cookie with the creator's code, nothing else, at most 30 days) — so that your visit can still be attributed to the creator if you only sign up later. On your first visit with an account we enter the code and delete the marker. If you say no, we store nothing at all. The legal basis for the marker is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time by removing the code in the bank; for the programme itself it is performance of the contract (Art. 6(1)(b) GDPR). We delete codes, attributions, applications and Twitch details together with your Wink account, expired attributions at the latest together with the games they belong to; the retention period of the ledger applies to the bookings. LIVE badge: If you are an approved creator and have linked Twitch to your Winku account, the mod shows all other players with the mod a “LIVE” in front of your Minecraft name (above your head, in the tab list, in chat) while your Twitch channel is live — on hover with your Twitch name, the stream title and how long you have been live. For this we only request public information about your channel from Twitch (live or not, start time, title) and link it to your Minecraft account; we only store the public channel status, as for the streamer sign. If you play incognito, no badge is shown. You can switch it off at any time in the Creator Studio or in the mod options (“Show my LIVE badge”); we store this setting with your account until you delete it. Messages (Wink Messenger): With the Wink mod you can send messages to other players who use the mod with a linked account. The content is end-to-end encrypted: it is encrypted in your mod and only decrypted in the recipient's mod; we cannot read it, neither can the team. The keys are created in the mod and stay on your PC; we only keep the public keys of your devices with a device label (e.g. “Windows PC”) and the last connection until you remove a device, it has not connected for 90 days or you delete your account. To deliver messages we process who writes to whom, when each message was sent, its size and whether it is a request; the record of who has a chat with whom is deleted 365 days after the last message. We only keep encrypted messages until every receiving device has fetched them, for 30 days at most. We don't store your IP address for this. Your chat history is only kept by the mod on your PC under “config/scamradar” until you delete it. Who may message you (everyone, friends of friends or nobody), which chats you muted, “do not disturb”, your notice and display settings and domains for which links no longer ask belong to your settings on your account. We store whom you block until you unblock them; how many requests you send and how often you are declined, blocked or report, we count for 30 days without names to slow down spam — if many people block you within a short time, you can't message anyone new for 7 days. Whether a request lands under “Filtered” is checked only by your mod on the text; for this we provide at most the sender's warning level. If you report messages, your mod sends exactly the messages you picked to us in decrypted form, with proof that they are genuine; they are stored with your reason, reviewed by the team and deleted 365 days after the decision. If the team bans you from the messenger, we store the type, duration and reason until 30 days after the ban ends. Read receipts (“delivered”, “read”) and reactions are encrypted like messages; we only see that a small signal is sent and keep it only until it is fetched, for 30 days at most. Whether you send read receipts and whether notices show the start of a message are part of your account settings; only your mod shows that start, and it stays in the mod’s notifications (bell) on your PC for 30 days at most. Pictures and voice messages in Wink Messenger are encrypted by the mod with a key of their own that only travels inside the end-to-end encrypted envelope; pictures from your PC (including screenshots, which your mod only looks for in your screenshot folders on your PC; only the picture you pick is sent) are re-encoded first (no camera or location data, at most 1920 pixels/2 MB). We only store the encrypted content with its size, checksum, sender and receiving devices until every receiving device has fetched it once, for 7 days at most (at most 50 MB pending per account); a copy stays in the mod on your PC until you delete the message. Shared photo booth and gallery photos are only references; the recipient loads the preview from us just like through the photo's link. Calls in the messenger (in the mod and on smp.winku.de/messenger (opens in a new tab)) are end-to-end encrypted. The devices exchange the key for a call inside an encrypted messenger message; the audio is encrypted on your device and only relayed through our server to the other person’s device. We can’t hear it and don’t store it. Neither of you learns the other’s IP address; calls don’t run through Simple Voice Chat or the HugoSMP.net (opens in a new tab) server. While a call is running we process, in memory only, a random call ID, who is calling whom and on which device it was answered, start and end, and the amount of relayed packets (for limits against abuse); nothing of it is stored after the call. The legal basis is the use of Wink (Art. 6(1)(b) GDPR). Your call settings (mic mode, volume, sensitivity, leveling of your voice and the other person’s and, in the mod, whether people nearby hear you in voice chat — off by default) stay in the browser in local storage (wink-anruf), together with whether you talk by holding the space bar (push-to-talk); in the mod they have been part of your mod settings on your account since 4 October 2026, so you are set up the same on every PC. Only on your device, in the mod in config/scamradar/anruf.json, stays the volume per person, remembered by that person’s Minecraft UUID (at most 200 people), as does which microphone and speaker you picked; that is not sent to us. Leveling, limiting and buffering the audio happen on your device only; the mic test and the sample voice send nothing to us (the sample voice is only downloaded). If someone who was in the call reports, the call can be part of their evidence replay like any voice (only if they have Simple Voice Chat, which packs the voices for it). Who may call you (friends, all contacts, nobody) is stored with your account. At smp.winku.de/account/messenger (opens in a new tab) you see these settings, your block list and your devices. You can also use the messenger in the browser at smp.winku.de/messenger (opens in a new tab). Each browser is then a device of its own: its keys are created in the browser and stored there, non-extractable, in this site’s browser database (IndexedDB), together with your chat history, received pictures and small settings (last selected Minecraft account, whether browser notifications are on) — the history is stored there encrypted. We only get what we also get from the mod: the device’s public keys, a device name such as “Browser (Firefox)” and when it last connected. If you clear this site’s browser data or sign the device out, keys and history are gone from that browser; a new device only gets new messages. Browser notifications only appear if you turn them on yourself; they show the name and — depending on your setting — the start of the message or just “New message”. You can also record voice messages in the browser: the microphone is only on while you record (one minute at most), your browser encrypts the recording just like the mod does, and it is kept encrypted in the browser database like pictures. Groups: for group chats we store who is in which group, who is an admin and who invited whom. The name of a group is end-to-end encrypted by the members’ devices like the messages; we do not know it. We delete open invites after 14 days and a group without members right away; otherwise who is in a group is deleted 365 days after the last message in it. If you report something from a group, the number of members is kept with the report and, if your mod sends it along, the group’s name. The group’s picture is also end-to-end encrypted by the members’ devices like the messages; we do not know it. If you report something from a group, your mod or browser sends the group picture along (shrunk, at most 8 KB); we store it with the report, only the team sees it there, and it is deleted together with the report. Online status: while one of your devices is connected to the messenger (mod or website), we process in memory only that you are connected, where (on HugoSMP.net (opens in a new tab), otherwise in Minecraft, or on the website — the mod reports each change) and whether there has been no input for ten minutes. From this we show your friends (if you have added each other) and people with whom you have both accepted a chat whether you are online, away or on “Do not disturb” and where — never to people you blocked or who blocked you. We do not store this; it is gone with your last connection, and there is no “last online” time. With your account we store the status you chose (online, away, do not disturb, invisible) and an optional status text of at most 60 characters with its expiry until you change them, the text expires or you delete your account; with “invisible” you appear offline to everyone. The profile card in the messenger only shows what your profile on smp.winku.de (opens in a new tab) shows anyway (Plus style, showcase; never with a warning, never in incognito). If you gift Plus from a chat, the Plus page opens; afterwards the mod asks us for up to 15 minutes whether you gifted Plus to that person (from the gifts we store anyway) and then puts an encrypted card into the chat. Messages to players without the mod go, when you click, as “/msg” through HugoSMP.net (opens in a new tab) and are not encrypted by us; they never reach our server unless you report them. Chats with people without Wink that only run via /msg are always in the messenger (with older versions of the mod only if collecting is on); whether your /msg with people who have Wink end up there too, and whether they also stay in chat, belongs to your settings with your account. The /msg themselves only stay in the mod on your PC. If you report a chat that also contains /msg, your mod sends the /msg lines you picked along as text – they count as “not verifiable”. If the team takes a messenger report into the reporting system, it becomes a report by you with the same messages; from then on its rules and retention periods apply. The legal basis is the use of Wink (Art. 6(1)(b) GDPR); for spam limits, bans and reports it is our legitimate interest in a safe community (Art. 6(1)(f) GDPR). Wink Karaoke (formerly “Sing Stage”): You can only take part with Simple Voice Chat. While you take part, we process in memory only: your account, your Minecraft UUID and name, which lobby you are in, which seat you are sitting in (only its number, no coordinates), whether you sign up for a song or vote to skip it, whether you are muted in voice chat, your game language, and your stars, reactions and tomatoes in the current round. 1–2 stars while someone sings count as booing; so that people on the same network (such as several accounts on one connection) don't count more than once, we derive a non-reversible value from your IP address, which is never stored. Anyone booed off can't take part for a while; that too is only kept in memory. There is no stage in the world: Wink Karaoke runs in a hall of its own that only the participants’ mods draw. Only the other participants see your figure (skin) on your seat and your name; anyone who is not taking part sees neither figures nor names. If you switch lobbies, we tell a participant there your Minecraft name so their mod accepts your TPA request. The voice group of a round gets a group name and a password, both kept in memory only. We permanently store only counters per account: how often you signed up, how often you got a turn, how many rounds were rated, and the sum and number of your stars — so people who rarely got a turn go first and well-rated singers can't be booed off. We don't store who rated whom and how. A tomato is a booking in your ledger (the price goes to us). If you request a song, we store your account, the song, whether you paid with your balance or with the daily free request of Wink Plus, the day and whether it was sung, skipped or refunded; everyone in the round sees who requested it, with your Minecraft name. We delete the entry after 30 days, immediately with your account; the booking is in your ledger like every booking. Recordings: only if you explicitly agree in the mod (off by default), the mod records your singing while you sing and uploads it. We store the recording, your account, your Minecraft UUID and name, the song, its length, the stars of that round and when you agreed. Poorly rated recordings are deleted right away. Only the team listens to the others; it can pick one per song as a preview, which everyone in the hall then hears before the singing. Recordings are kept as long as Wink Karaoke exists, unless you delete them (Account → Data & deletion) or your account. The legal basis for recordings is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time; for taking part it is the use of Wink (Art. 6(1)(b) GDPR), and for the protection against organised booing our legitimate interest in fair rounds (Art. 6(1)(f) GDPR). Tips to singers are recorded in the ledger like all tips (sender, recipient, amount, fee, time). In Karaoke your round sees whether your mic is muted or your sound is off; this is only kept in memory for the current round. If you tip anonymously, others see the amount and the coin rain but not your name. The volumes in the voice window stay on your PC only. Muting, blocking, reporting: if you mute someone only for this round, you no longer hear them; this applies only in your mod while you are in the hall and is neither sent to us nor stored. If you block someone, we store that like any personal mute (voice and chat) until you lift it. You can report other players as anywhere else (place “Karaoke”, see “Reports”). The team enters song titles, artists and lyric parts. Hide me as a reporter: if you turn this on under Account or in the mod, we store this setting with your account until you change it or delete your account. While it is on, we don't show others that you have reported people successfully: you don't appear on the hall of fame or the reporter leaderboards, you carry no reporter badges for others, your reporting achievements don't count on public leaderboards, and you don't get reporter roles on Discord. The team still sees your reports.
Subscriptions and Wink Plus: Wink Plus is the only subscription; you pay it from your in-game balance on smp.winku.de/plus (opens in a new tab) or in the mod’s Plus window — for that the mod only sends the term or the add-on with its term, a discount code if you enter one, and a one-time ID, so a purchase sent twice is only booked once, and for a price question only your answer; trying things on (themes, emotes, chat colour) only happens on your computer and sends nothing. Former single subscriptions run until the end of their paid time and do not renew. If you take one out, we store for your account which feature or which package it is, since when it has been running without a break and until when, whether it should renew, the price and term you booked, the time of the last charge, whether a renewal failed because the balance was not enough and — if an automatic renewal would cost more — which new amount we announced to you and when, from which day it applies, a price that has already taken effect and your answer (“Keep Plus” or “Not at the new price”) with its time, so that we only charge announced amounts and carry out your decision; we replace or clear these details at the next price change or renewal; the charge itself appears as a booking in the ledger. If you gift Plus to someone or get it as a gift, we store who gifted how many days to whom, when and for what amount; the recipient gets a notice with the giver’s Minecraft name. For Wink Plus we also store what you choose under Account → Wink Plus (name colour, gradient, banner, up to three achievements for the showcase and its frame, photo booth frame) — even while Plus is not running, so that everything is back the next time you book. A paint job you chose here earlier we carry over as a setting of your item. Visible to others: your Plus mark (its level shows how long you have had Plus in a row; with Plus Gold it is gold), small behind your name in chat, in the tab list, on your name tag and wherever the Wink mod shows your name with rank and clan (menus, board, winners’ podium, hall of fame, achievements showcase, plane), for all players with the mod and on your profile on smp.winku.de (opens in a new tab) — never with a warning mark, not in incognito and not in matches; name colour, gradient, banner and showcase on your profile for signed-in accounts with access to Wink, but never while you carry a warning mark; emotes you show — for this we keep your Minecraft UUID and the emote in memory for a few seconds without storing them, and not at all in incognito. On Winku’s Minecraft game servers (section 2a) these emotes work the same way: the mod only sends the emote and the time with your account token and only tells the service that you are on a Winku game server – not which world, location or address; emotes that need a location, money or another player (handshake, hug, deal, Money Flex, tomato) are not available there. For the “Money Flex” emote (for everyone) this includes the amount you pick, so that the other players’ mods show the same bills — the amount is taken from your balance and appears as a booking in your ledger (it goes to us); only your mod remembers the last amount, on your PC. For the selfie the mod sends whether you use the selfie stick; angle, distance and zoom stay on your PC. If you throw at someone with the tomato emote, the mod sends who you are aiming at (their Minecraft UUID) and which way you are looking while you throw (turn and tilt, rounded, no location); whether the tomato hits is decided from their “Tomatoes on me” setting (everyone, friends only or nobody), their friends list and whether they have muted or blocked you — never in matches or fights. Your viewing direction goes along with the emote to the other mods nearby, so that everyone sees the same throw, and is kept in memory only while the emote runs. None of this is stored; the other players’ mods only show the throw and the hit, and a hit is only visual. Anyone who has blocked you does not see your throw. Band emotes (instruments and vocals): if you join someone who is playing a band emote right now (with the key “Band: jam along”), the mod sends their Minecraft UUID along so that our service can check that they are playing and have not muted or blocked you; we do not store it. For emotes with a cooldown (such as fire extinguisher and Money Flex) the service remembers in memory, until a restart, when you last used them. For the handshake (an emote for two; starting it needs Wink Plus, anyone with the mod can shake on it), the mod sends us your coordinates and the name of the world when you hold out your hand or shake on someone’s, so we can check that you are at most four blocks apart; while you hold out your hand, it checks in with your position every 15 seconds. We keep this only in memory while the invitation runs (if your mod stays silent for 45 seconds, we delete it), do not store it and never pass it on. Other players with the mod only see that you are holding out your hand or whom you are shaking hands with — like any emote. There are no handshakes in incognito or with a warning mark. Money handshake (deal): When you offer a deal with money in game, the mod sends us the amount, optionally the Minecraft name of the player allowed to accept, your coordinates and the name of the world. We keep this only in memory while the offer stands (two minutes at most) and do not store it. We only pass the amount on to players with the mod who stand at most twelve blocks away and are allowed to accept – if the offer names someone, only to that player. Others only see that you are holding out your hand. When someone shakes on it, we tell your mod who it was; the payment happens entirely in game through HugoSMP.net (opens in a new tab)’s /pay command, which your mod sends for you – we do not book any money and do not see the payment. So that the money arrives, the recipient’s mod briefly allows /pay in their HugoSMP.net (opens in a new tab) settings and switches it back afterwards (only in their game). The mod stores the limit for the deal only on your computer. The legal basis is the use of Wink (Art. 6(1)(b) GDPR). We calculate your stats from your games of the last 90 days when you open them and show them only to you; the history of AH values contains no details about people. For subscriptions we also keep until when you paid for a subscription yourself (separate from gifted days or days added by the team). That way, if a subscription is ended early, we only refund time you paid for. It is deleted together with the subscription, at the latest with your account. With Wink Plus your photo booth photos stay 365 instead of 30 days; when Plus ends, the normal period applies again and we delete older photos at the next clean-up. If the moderation team extends a subscription by hand or ends it early, we record that with the reason in the log (365 days); if it books the unused part back, that refund also appears as a booking in the ledger, and you get a notice. What Plus includes and what everyone has without it is shown on smp.winku.de/plus (opens in a new tab). Reporting, the warning list, warnings, protection against TPA traps, the evidence including its length and where warnings appear on screen are excluded and stay free for everyone. The legal basis is the use of Wink (Art. 6(1)(b) GDPR) — including that others see your Plus, because that is exactly what you book. We delete the subscription, your choices and gift records when you delete your data at Wink — gifted time stays with the recipient, just without any link to you; we also delete a subscription when we make the feature free for everyone again. The retention period of the ledger applies to the related bookings. We store your chat colour with your mod settings. While Plus runs, everyone with Wink sees it on your chat lines, not with a warning mark and not in incognito. Whatever has no effect without Plus (theme, chat colour, word filters beyond 5 or highlights beyond 3, showcase slots beyond 3, own emotes beyond 1) stays stored and rests. Plus days from “invite friends” are booked like a gift without a price. Plus Gold: for every match and withdrawal with a reduced fee we store how much you saved, with time and reference (match or withdrawal), to keep the cap of $150,000 per 7 days; the rows are deleted with your account. They are also included in your data export. With Plus Gold, everyone with the mod sees your Plus mark in gold — like the Plus mark itself, not in incognito and never with a warning mark. Discount codes: if you redeem a discount code when buying Wink Plus or Plus Gold, we store the code, your account, the subscription, the term, the benefit (amount saved or free days), the reference of the booking and the time, so we can settle the benefit correctly and keep to the code’s limits (in total and per account) (Art. 6(1)(b) GDPR); we delete this 365 days after redemption or with your account, and it is included in your data export. If you check a code without buying, we store nothing; to stop guessing we only count attempts per account in memory (see “Notices, log, abuse protection”). We record changes to prices, discounts and discount codes in the history of the price page: what was changed, when, and how many players were notified, without the team member who made them. Which team member made a change is only kept in the internal moderation log, which only the team can see. Neither contains anything about individual subscribers. Risk-free refund: if you buy Wink Plus or Plus Gold during such an offer (including buying more time or an automatic renewal), we store for that purchase your account, the subscription, a reference to the booking, the amount, the days bought and how many of them were paid, when the bought time starts, the time of purchase and the refund window — and, if you take it back, when, how much was refunded and what was deducted. To work out the deduction we count your photo booth photos that were free with Plus or the fees you saved with Plus Gold since the bought time began. The purpose is to run the offer and limit abuse (Art. 6(1)(b) GDPR). We delete this data with your account and at the latest 365 days after the window has closed; it is part of your data export. The credit is in the ledger like every booking, the refund is also in the moderation log, and you get a notice. In moderation the team sees the latest refunds with Minecraft names and the figures per offer. Which team member started, scheduled, changed, cancelled or ended an offer is in the moderation log; who started or scheduled it and who ended or cancelled it is also stored with the offer.

Looking into your ender chest: With “/ecsee” the mod shows you what was in your own ender chest the last time it saw it — only for looking, you cannot take anything out there. Where that snapshot comes from is your choice in the mod: if you open your chest in the game yourself, the mod keeps the exact contents (with names and enchantments) in a file on your computer — for at most 30 days and only for your own chest on HugoSMP.net (opens in a new tab); we learn nothing about it and only store with your settings on your account whether the “Keep on PC” switch is on (on by default; turning it off deletes the file right away). The same applies when the mod sends the command to HugoSMP.net (opens in a new tab) on your behalf. If “Bot may fetch” is on (on by default, only with a linked account), our bank bot opens your chest in the game for a moment, reads it and closes it again right away; we then store for your account, per filled slot, the item as it is in the game — type and count, enchantments, names and descriptions, colour, durability and the contents of containers such as shulker boxes (at most 512 KB per chest) — together with the time. If you hid your ender chest in the /settings of HugoSMP.net (opens in a new tab), the bot cannot see it either; we then only store that the look did not work for that reason, until the next try. There is only ever the latest snapshot; we delete it at the latest seven days after the last look, and immediately together with your data at Wink. We fetch such a snapshot solely for the account that asks for it itself, and only for the Minecraft account linked to it; nobody can view another player’s ender chest this way. The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Wink Arcade — games and lobby: For every game we store the game, the stake, the Winku and Minecraft accounts taking part (four in 2v2), the course of the game (such as revealed blocks or bids), the result and the times, as well as whether the game ran during an event and whether you searched through “Any game” with variety (the fee depends on it) and how long the search took until an opponent was found (from this we show an approximate waiting time while searching, only as a figure across many games, without names); we delete finished and cancelled games after 90 days. The number of your wins, losses and draws per game remains until you delete your data at Wink. While you have a page of Wink Arcade open, other signed-in accounts with access to Wink see in the lobby your Minecraft name and head, whether you are free, looking for an opponent or playing, and your record, and whether you are in a party for 2v2 with someone — they then also see with whom; you can switch this off under “Visibility”. In the lobby you appear under a random ID, not under your account number. Unless you switch off there that others may see when you are online on HugoSMP.net (opens in a new tab) (on by default), the bank bot reports to us whether your linked Minecraft account is currently in the server's player list, and the lobby shows this, as well as whether your Wink mod is ready for a 1v1 right now; we only keep the latest state, in memory. The legal basis for this is our legitimate interest in showing other players who is available for a game right now (Art. 6(1)(f) GDPR); you can object at any time with the same switch. If someone challenges you, you get a notice on the website and in the mod; whether others may challenge you at all, and from which stake, is set on your account under “Who sees you” (by default: yes, at any stake); others see the minimum stake in the lobby. For “Any game” in quickplay we store with your account which games you last picked and with which price range, so that your choice is there again next time, and likewise the game, stake, arena and “Flexible” range (from–to) you last searched or challenged with; if you invite someone into your party for 2v2, they get your Minecraft name with the invitation, and while you play together the lobby shows who plays with whom — invitations and parties are only kept in memory and end as soon as someone leaves the lobby; your friends list from the mod — the names you mark with ★ in it — can also be seen and changed on smp.winku.de (opens in a new tab) since 22 September 2026, and next to each name we only show what the lobby shows about them anyway: anyone who hides in the lobby or has not allowed their presence on HugoSMP.net (opens in a new tab) to be shown appears as not around. From there you invite someone on the list into your party — anyone who is only online on HugoSMP.net (opens in a new tab) at that moment gets the invitation as a notice with your Minecraft name and a few minutes to open the lobby. Since 22 September 2026, anyone you add first gets a request if there is a Winku account behind the name: we then store who asked whom and when, with both Minecraft names, and show the request to both sides — plus a notice to the person being asked. Once it is accepted, declined or withdrawn it is deleted — but if you decline, we remember for 30 days who declined whose request (both accounts and until when), so the same person cannot ask again right away; your data export only shows until when that block runs, and it goes with your account; if it stays unanswered, it remains until one of you answers or withdraws it or deletes their data at Wink; only by accepting do you end up on each other's list. Removing someone takes effect at once and on both sides and needs no consent. If the name does not belong to a Winku account, it stays a quiet note as before — there is nobody there who could accept, and that person is not told about it; when you report a 2v2 game, you pick which of the two opponents you are reporting; if you call out for an opponent for a fight in the mod's chat, we show the mode, stake and arena for one minute in the mod of every player on HugoSMP.net (opens in a new tab) — without your name, which your opponent only sees once the fight is binding; the call is only kept in memory; if you take part in the survey “Rate ScamRadar and Wink Arcade” (smp.winku.de/survey (opens in a new tab), voluntary), we store your answers with language and time with your account to improve the mod and website — only moderators may read them, and they are deleted one year after you last sent them and with your account (a free-text answer the team takes over as an idea or bug is then handled as described under “Ideas and bugs”); the legal basis is your consent by sending (Art. 6(1)(a) GDPR), which you can withdraw at any time via support; after Wink Arcade matches, when it is busy or now and then at quiet times for comparison, your browser sends a few measurements of how smoothly the match ran for you (how evenly the game states arrived, how long a move took to be answered and how many frames per second your browser could draw), and sometimes we ask “Did the game run smoothly for you?” (answering is voluntary); we keep these numbers and your answer only in the service’s memory together with your account, for at most one week and never in the database, to tell whether the Arcade is too full right now and then let fewer matches start at the same time; the legal basis is our legitimate interest in games that run smoothly for everyone (Art. 6(1)(f) GDPR); if you give feedback after your first game of a kind (the “How was it?” button on the result board of the Wink Arcade or at the end of a title game, voluntary), we store your answers with the game, the match, language and time with your account; if you send the recording along after a bad experience, we also store a copy of that match’s recording (every move of both sides, including your opponent’s) or, for a title game, a video of the playing field only, without sound, that your browser records during your first run and only uploads if you tick it, otherwise it discards it; only moderators may read this, to improve the games; we delete the recording after 90 days and the answers one year after sending, everything with your account (if the team takes your text over as an idea or bug, that copy follows “Ideas and bugs”); if your opponent deletes their data at Wink, this copy still stays until its 90 days are over; the legal basis is your consent by sending (Art. 6(1)(a) GDPR), which you can withdraw at any time via support, and for your opponent’s moves our legitimate interest in finding bugs in the games (Art. 6(1)(f) GDPR); if you take a photo in the mod's photo booth, the mod sends the screenshot (your game window at that moment, with your character and whatever else is in the picture) to us — we store it re-encoded and without metadata with your account under a random address that only people you give the link to know, and delete it after 30 days (365 days with Wink Plus), with your account or right away when you delete it on the photo page; the legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR); if you release a photo on purpose — with the button in chat right after the shot or on the photo page — the mod puts it on the sign next to the photo booth, where every player with the mod sees it, for as long as it is one of the two newest released photos; you can take that back on the photo page at any time and it disappears from the sign; the legal basis for this is your consent (Art. 6(1)(a) GDPR); while you are searching, others see your price range in the lobby and, in the queue, your stake and range without your name (in the player list with your name as before). In quickplay you only see the name of your opponent once you are in the arena. For the live display, the open page keeps a connection to our server; no further data arises from this. On the winners’ podium in the world, the mod shows, for each unlocked 1v1 mode, the players with the most wins — all time and in the current calendar month — with Minecraft name, rank, clan, badge, a figure made from the skin and the number of wins. Everyone with the mod can see the podium, even without a linked account. You only appear there if you are visible in the lobby and not playing in incognito. We store nothing extra for this: the monthly count is calculated from the stored matches of the last 90 days, the total from your record. The legal basis is our legitimate interest in showing the best Wink Arcade players (Art. 6(1)(f) GDPR); you can object by switching off “Visible in the lobby”.
Human check in the browser games: In the games with a stake (Sonic Echo, Bid Wars, Safecracker, Master Builder, Blade Duel) and in the small games in the sky that have a leaderboard (Wink Run, Tall Stacker, Ore Rush, Bargain Hunt, Market Crier) we make sure the game is really being played by hand — otherwise a script would win every game that comes down to hand and eye, and the leaderboards would be worthless. In the small games WE have been doing the scoring since 20 September 2026, not your browser: every few seconds it sends us what you did at which point of the run — jumped, ducked, dropped a row, mined a tile, ran left or right — plus when you pressed a key and how long you held it. Which key it was is neither sent nor stored, and your browser no longer sends your score at all: we replay your run with the same game rules and count for ourselves. In the games with a stake your browser also sends, with each move, your pointer movement from the last two and a half seconds or so: the kind of pointer (mouse, finger or pen), its positions in the window with the time between them, for a finger also pressure and contact size, and how long you pressed. Blade Duel works differently: there your browser sends no pointer movement, only which game keys you are holding or pressing (move, jump, slash, parry, lunge) — those are the moves themselves, and we calculate the whole fight. We do measure how long after your opponent's wind-up your parry reaches us; these times only go into the spread values. In Jelly Volley your browser likewise only sends which game keys you are holding (move, jump); we calculate the ball, the points and the items, and we measure no reaction time there. The former check where a dot travelled across a field for you to follow is gone — it only held up honest players and proved nothing. We evaluate all of this in memory only and discard it with the game; it is not stored anywhere permanently and never combined with other data. What is stored is only the result as a number: for a game with a stake a value between 0 and 100, two spread values, the keywords of whatever stood out, and how often a reaction was faster than a human can react; these numbers sit with the game and are deleted with it. On top of that, in Sonic Echo and Safecracker your browser sends the time of every click by its own clock (in Sonic Echo the time since the round started). These times are kept in the game’s state (in Safecracker those of the last four clicks) and are deleted with it; if they repeatedly do not fit what is possible by our clock, we note that as a keyword with the game and in the moderation team’s log. Your account only keeps marks: how many you have, the keyword of the latest one and when it was set. The same details stay for one year in our moderation team's log, including things that had no consequences for your account. You only get a mark for something that PROVABLY cannot happen: more game world than time has passed since the start, an input from outside your run, or a reaction faster than a human can respond to something that just appeared. Everything else — suspiciously even key timings and the like — only goes in the log and locks nobody by itself; a person always decides that. Marks from the same session count as one, after thirty days a mark no longer counts, and only after the third one do your runs in the small games stop counting towards the leaderboards and your previous best scores stop being shown there; nothing is deleted, and you can keep playing at any time. In the games with a stake, two such proofs mean you can no longer start games with a stake — friendly games without a stake stay open. You can have either of these reviewed by a person via support on winku.de (opens in a new tab), who can also undo it. The legal basis is Art. 6(1)(b) GDPR (running the game you started fairly) and Art. 6(1)(f) GDPR (our interest in protecting games with a stake and leaderboards from scripts).
Reports and recordings in Wink Arcade: We save every game in Wink Arcade as a recording at the end — for the browser games the game states both sides saw during the game, in Blade Duel, Jelly Volley and Plank Drop your key inputs with the time they reached us, plus the ping our server measured and, except in Plank Drop, the figures of the human check. The recording contains both players' Minecraft names and IDs and is deleted after 14 days. Anyone who played in the game can report it up to 48 hours after it ended (a reason and, optionally, a short text); the recording is then kept until a decision is made and for 30 days after that. Reports — who reported whom, in which game, for what reason — are deleted one year after the decision. Only our moderation team sees recordings and reports; whoever was reported is not told by whom. If two different players report the same account from games with a stake, we freeze it until a decision is made (no games with a stake, no withdrawals); if the team finds cheating, we lock games with a stake for that account and settle its balance as described in the terms of use. For this the account only stores since when it is frozen, whether it is locked and how many of its own reports were rejected. In Blade Duel, Jelly Volley and Plank Drop your browser keeps a direct connection (WebSocket) to us open during the game; through it our server continuously measures the round-trip time of your connection (ping), and briefly in the lobby before a search — this value stays in memory and in the recording only. If it is too high before the game starts, the game is cancelled. The legal basis is Art. 6(1)(b) GDPR (running games with a stake fairly) and Art. 6(1)(f) GDPR (our and the other players' legitimate interest in uncovering cheating and compensating those affected).
Emote Guess: For each answer we store your guess, the time from display (measured by your browser and checked against our server clock) and typing figures: time to the first key, number of keys and deletions, gaps between keys, paste attempts and switching tab or window. This serves fairness and protection against cheating. Anything unusual goes into the moderation log and the game recording, which is kept for 14 days like for all Arcade games (after a report until the decision plus 30 days). A human always decides; an automatic mark is only given if a correct answer provably arrived faster than a person can see and type. We render the emote pictures ourselves for every round; your browser never talks to 7TV for this. The legal basis is the use of Wink Arcade (Art. 6(1)(b) GDPR), for the typing figures our legitimate interest in fair games with a stake (Art. 6(1)(f) GDPR).
Wink Arcade — fights with the mod as referee (1v1 Arena, Fist Fight): In a 1v1 you fight on HugoSMP.net (opens in a new tab); the referees are the Wink mods of both players. For this, your mod sends the RTP command (and picks the world in the HugoSMP.net (opens in a new tab) menu without showing it to you) as well as /tpa, /tpahere and /tpaccept with your opponent's name on your behalf, accepts only their teleport request and reports to Wink during the game: that it has taken over the game, your vanilla statistics (deaths and player kills) at the start and after the round, the world and the coordinates where you arrived after the RTP or the teleport (this gives the centre of the arena, which your opponent also learns), every two seconds whether you are inside the arena, your health and whether it sees your opponent and whether they are inside the arena, and immediately when you or your opponent died, left the arena, teleported away, changed worlds or lost the connection, together with short measurements (such as how far someone stood beyond the edge). Before the RTP it reports your health every second (current and maximum), your hunger bar and for how many more seconds HugoSMP.net (opens in a new tab) shows you as “in combat” — this is how Wink sees whether you are both ready; a change is noted in the game log. After the teleport, for the cross-check, it reports every second where it sees your opponent and how many other players are in the arena, and during the teleport which steps it took and which confirmations from HugoSMP.net (opens in a new tab) it saw (such as “request sent” or “accepted”). From your teleport into the arena it locks your commands, the chat and, before the start, server menus (before that you are free); if someone tries to get around that, it reports the kind of attempt (command, chat, hit, menu) and, for a command, only its first word. If a hit lands between you before the start, or another player appears by teleport right next to you or your opponent, it reports that together with the distance. If a third player enters the fighting area, it reports their Minecraft name. If your opponent dies, it reports how long ago your last hit was and how much health you have left; the winner’s health is shown in the result, which the loser sees too. In a fist fight, where you start with an empty inventory (one stack of food may stay — the mod does not count it and holds it in place from your teleport on), it also reports HOW MANY slots of your inventory are filled — before the teleport, after landing and during the fight; it does not send what is in them. If it throws away an item that turned up on you during the fight, it reports that item's name (such as "Dirt"), so it stays traceable that someone planted it on you. What your opponent visibly carries in their hands or as armour is something your mod sees in the game anyway; if it reports that, it is part of the game's log. It does not send chat, the contents of your inventory or any positions other than those named. Wink decides the game from the reports of both mods; if they contradict each other, the moderation team sees both logs and decides. During a game Wink also keeps when your mod last checked in and the time of its reports — this shows whether you are still there before the RTP and whether a report came before the end of the fight time. In 2v2 your mod also reports where it sees the other three players of the game (position, whether visible, whether in the ring) and, for an observation, which player it concerns. Both are part of the game log. We delete the log of a game (reports, coordinates, statistics) 30 days after it ends, for disputed games not before the decision; the game with its result after 90 days. How often you were in the wrong in a disputed game is noted on your account until you delete your data at Wink; from two notes on, fights are locked for you. If the teleport gets stuck after the RTP and the steps of both mods show it was on your side, we note that in the moderation log (deleted after 12 months); after two such notes within 7 days, Wink pauses fights for you until the older one is 7 days old. Wink decides this automatically; if it was not your fault, the moderation team lifts the pause when you message support. While your mod checks Wink Arcade, Wink knows — only in memory, until 60 seconds after the last check — that you are ready for a 1v1. While you use the mod on HugoSMP.net (opens in a new tab), it only tells the service, as keywords, whether anything is still missing for an immediate fight in the fighting modes (golden hearts, Health Boost, hearts not full, hunger, HugoSMP.net (opens in a new tab)’s combat display, items in a fist fight, blocked TPA requests) — no values. This stays in memory only, at most 90 seconds after the last report, and is used solely to queue or pair you only once you can fight right away. In the get-ready phase the mod also reports your golden hearts and whether Health Boost is active; like health and hunger, this is kept in the game’s log. If the mod sees HugoSMP.net (opens in a new tab) announcing that a world or the server is restarting, it sends the world ID and the announced time to smp.winku.de (opens in a new tab). This is kept in memory only (at most until the announced restart plus 2 minutes). If a fight is cancelled because of it, we store that with the game and in the moderation log. So the team can trace exceptions and refunds, we also keep a history of world and server restarts: the world, the kind of restart, the times, how many mods reported the announcement, the reason, whether and by which team member the world was released early, and for each cancelled game only its number, game type, stake and reason — no player names. Only admins see this history; we delete it after 365 days. The legal basis for this is our legitimate interest in traceable refunds (Art. 6(1)(f) GDPR). The legal basis is the use of Wink Arcade (Art. 6(1)(b) GDPR); we process the name of a third player in the arena, blocked attempts and the note about a stuck teleport on the basis of our legitimate interest in fair games (Art. 6(1)(f) GDPR).
Leaving Wink Arcade games: If you leave a Wink Arcade game early (giving up, losing the connection without returning within 90 seconds, leaving a fight by command, not showing up after “Ready”), we store this with your account: game, type of game, how you left, time, your level and any resulting temporary lock (from a warning up to at most seven days). Purpose: fair play for everyone. Legal basis: contract (Art. 6(1)(b) GDPR) and our legitimate interest in fair games (Art. 6(1)(f) GDPR). Individual entries are deleted after 30 days, your status at the latest 30 days after you last left a game or 30 days after a lock ended. If the team lifts a lock or resets your level, we keep the reason for the same time. You can see your status in the lobby and in your data export.
Bank bot for Wink Arcade: You send deposits in HugoSMP.net (opens in a new tab) in-game money via /pay to the Minecraft account of our bank bot; the bot transfers withdrawals and refunds via /pay. The bot is a Minecraft account of Winku that runs without a screen on a Winku computer in Germany. Of what HugoSMP.net (opens in a new tab) sends to its account, it only evaluates system messages about payments, its balance and its transaction log (/money log), plus private messages that consist of nothing but a link code, and the server's automatic announcements (such as event notices or that chat has been slowed down). It sends these announcements to Wink so the Wink mod can offer them to you one by one to hide and can tell you about a slowed chat; Wink stores the most recently seen wording of each announcement — as every player sees it in chat, so including player names the server mentions in it. It neither evaluates nor stores the text of public chat messages from players or other private messages; it only counts public chat lines (see “Chat statistics”). The bank bot also records spawn from time to time the way every player sees it there — blocks, biomes, holograms, signs, heads, banners, item frames, paintings and the server’s figures (NPCs, with their skin) as well as the address of the HugoSMP.net (opens in a new tab) resource pack — so the team can prepare changes to spawn and video recordings of the mod on a separate build server. Texts on holograms and signs may contain player names the server shows there publicly, and heads may carry a player’s skin; it does not record players themselves, animals or chest contents. Only the team sees these recordings; we keep the last five (a new one comes about every six hours) plus the one the build server is currently built from. The legal basis is our legitimate interest in rebuilding spawn faithfully for changes and recordings (Art. 6(1)(f) GDPR). The legal basis for the announcements is our legitimate interest in showing you the server's messages in a clear way that you can switch off (Art. 6(1)(f) GDPR). For every payment it records the Minecraft name, UUID (from the server's player list), amount and time and reports them to Wink. It deletes its own cash journal after 14 days and completed orders 30 days after Wink has received the result; Wink deletes the bot's reports and the orders to it after 30 days. You can also link your Minecraft account by sending the bot the code from the “Bank” page via /msg; the code is valid for 15 minutes, we store it only as a hash and delete it one day after it expires. If you send the bot money from a Minecraft account that is not linked to any Winku account, we pay it back. The bot's log contains no chat, player names only for payments, and is continuously overwritten (15 MB at most). The server HugoSMP.net (opens in a new tab) processes the payments themselves under its own responsibility.

Bank inside the mod: In the pause menu (ESC) the mod shows your Wink Arcade balance and the amounts that are possible right now. To do so it asks us every time you open the pause menu or the bank — with the mod’s credential, that is, for your account. We do not store these requests separately; all you see in them is what your ledger holds anyway. If you pay in from inside the mod, it sends the command “/pay” to the Minecraft account of our bank bot and also answers the server’s confirmation question — exactly as if you had typed both yourself; that command goes to HugoSMP.net (opens in a new tab), not to us. A payout you order from us, and the bank bot transfers it as before. The mod never does the arithmetic itself: every amount it shows comes from our server.
Market bot for Wink Arcade stakes: The quickplay stake levels follow the value of money on HugoSMP.net (opens in a new tab). For this, a second Minecraft account of Winku (market bot, also running without a screen on a computer of Winku in Germany) regularly reads the offers in the auction house and the buy orders. It uses a seller's name only to recognise the same offer the next time: the name goes into a salted hash together with item, quantity and price, which the bot keeps for 48 hours; it does not store names. Item, quantity and price of the offers it has seen stay on the bot's computer for 90 days. For this it sends Wink only the value of money and prices per item, with no information about persons — except for the mapart shop (next paragraph); Wink keeps the history of the value of money for 400 days. In addition, every two minutes it reads the server's player list on the side (Minecraft name, UUID and the clan and rank tag shown there) and, from public chat lines, only the prefix before the text (clan, rank and name), never the text itself (exception: a code from the “Checklist for HugoSMP”, see there), and sends both to Wink for the player directory (next paragraph); it keeps none of this on its computer. The legal basis for briefly processing sellers' names is our legitimate interest in fair stakes that match the value of money (Art. 6(1)(f) GDPR). The Wink mod fetches these prices per item with a linked account and only on HugoSMP.net (opens in a new tab), after you join and then about every 30 minutes, to show the AH value calculated from them under items (can be switched off in the mod under Options → More; the choice belongs to your account like your other settings); it sends nothing but the request with its pass.
Mapart shop and mapart preview: Our market bot reads the public auction house of HugoSMP.net (opens in a new tab). For maps whose name carries a mapart number we store map number, name, part, original author, the seller’s Minecraft name, price, amount and expiry of the offer and, if the bot can see it, the map picture. We delete an offer once it expires or is no longer listed, at the latest 30 hours after it was last seen; map pictures 14 days after no matching map is offered any more. The Wink mod only fetches this list with a linked account and shows it in the mapart shop. When parts of a mapart are in your inventory, you see them in an item frame or your game otherwise receives their picture from the server (e.g. in the auction house or a chest), the mod saves the pictures of these maps with map number, mapart name, part and – if the map shows one – the Minecraft name of the original author on your PC (config/scamradar/karten) so it can show you the whole picture in chests and after a restart; it deletes the oldest after 30 days or beyond 4,000 maps, and switching off “Mapart preview” deletes all of them right away. Whether the preview is on, we store with your settings on your account. Mapart offers you see in the auction house yourself are kept by the mod in memory for at most 20 minutes. With a linked account it asks smp.winku.de (opens in a new tab) at most every 15 minutes which mapart offers in the auction house still lack a picture; if it has saved one of those pictures, it sends it (128 × 128 colour values) with the map number and your device number to smp.winku.de (opens in a new tab), so every player gets a preview in the mapart shop (each map at most once per game start; pictures of maps nobody is currently offering never leave your PC) — we keep the report for 14 days and only show an image once it belongs to a current offer; when buying, it only sends the command /ah with the mapart’s name to HugoSMP.net (opens in a new tab). The legal basis for the shop is our legitimate interest in showing maparts from the auction house as one picture (Art. 6(1)(f) GDPR) — the data is public there; for the preview and its switch it is the use of Wink (Art. 6(1)(b) GDPR).
Misleading listings in the auction house: For every listing in the HugoSMP.net (opens in a new tab) auction house, ScamRadar compares the displayed name with the item itself. If the name claims something other than what the item is — for example "netherite chestplate" on a piece of leather armour — we store that single listing: the seller's name and Minecraft ID, the item, the name of the listing, price, amount and the time, for 400 days from when it was last seen. The listing was seen either by our market bot or by the Wink mod of a player who looked at it in game; in the mod, reporting can be switched off under Options → Evidence, and it is still marked there. If the same seller puts up several such listings, ScamRadar creates a report about that player on its own, which feeds into their warning level and risk value like any other report and is marked as “checked automatically”; the listings found are shown on their player page, because they are the evidence for it. This never leads to a strong warning on its own — that is still set by a person. As with any warning, you can object to it. The legal basis is our legitimate interest in protecting players from misleading listings (Art. 6(1)(f) GDPR).
Player directory and name suggestions: From the player list and chat prefixes the market bot sends, Wink keeps a directory of HugoSMP.net (opens in a new tab) players with UUID, Minecraft name, rank, clan and when a player was first and last seen; we delete an entry 90 days after the player was last seen. The directory serves name suggestions and checking whether a player you report has already been seen on HugoSMP.net (opens in a new tab) (see “Reports”). When you type a Minecraft name on smp.winku.de (opens in a new tab) or in the mod, we suggest matching players with head, rank, clan, badges and warning level; whether someone is on HugoSMP.net (opens in a new tab) right now is only shown if they allowed it in the Wink Arcade lobby. Under “Find a player” on smp.winku.de (opens in a new tab), signed-in accounts with access to Wink see statistics from it: numbers (how many players are seen online right now, were seen in the last 24 hours and 7 days, are new and which rank they have) and the clans with their member and online counts. For the history we only keep, every 10 minutes, the number of players seen online, without names, for 90 days. Below that, the players seen in the HugoSMP.net (opens in a new tab) player list within the last 24 hours are listed with Minecraft name, head, rank and clan (at most 200, most recent first) — with “online” or with when they were last seen; anyone playing incognito with the mod is not listed. If we do not know a fully typed name, we ask Mojang for the matching account. Only signed-in accounts with access to Wink and linked mods see the suggestions; we do not store what you type. The directory also concerns players without a Winku account. The legal basis is our legitimate interest and that of our users in reports, searches and challenges reaching the right player (Art. 6(1)(f) GDPR); the directory only holds what anyone on HugoSMP.net (opens in a new tab) sees in the player list and chat anyway. You can object at any time via the support form (Art. 21 GDPR): we then delete your entry and keep only your UUID so that it is not created again. Rank and clan history: If the rank or clan of a player who is already in the player directory changes, we store that change — Minecraft UUID, whether it was the rank or the clan, the old and new value and the time; players seen for the first time get no entry. Signed-in accounts with access to Wink see this history on the player profile and on the page of the rank or clan. That page also lists, with Minecraft name, head, rank and clan, the players who have the rank or clan right now (at most 300, most recently seen first) — with “online”, since when they have it or when they were last seen — and who had it before; a clan’s page also lists its members with their role, as anyone can see them in the clan menu on HugoSMP.net (opens in a new tab) (see “Clans”). Anyone who has objected to the player directory or is currently playing incognito with the mod is not listed by name on rank and clan pages. We delete history entries together with the player directory entry (90 days after the player was last seen, or on objection) and with your account, after 365 days at the latest; they are part of your data export. Legal basis and objection as for the player directory. Player count: our server asks HugoSMP.net (opens in a new tab) how many players are online the same way every Minecraft client’s server list does; we do not read the names the server may send along. We also keep this number every 10 minutes, without names, for 90 days.
Trophies and leaderboards: We store the trophies you earn on smp.winku.de (opens in a new tab) with your account, together with the time. Some follow from what Wink stores about your account anyway (such as a linked mod or a game played), others from the title games; still others are detected by the site in your browser, such as which areas you have visited, what time of day you drop by or whether you know a secret key code — only which trophy you earned is transmitted. From the title games “Wink Run”, “Tall Stacker”, “Ore Rush”, “Bargain Hunt” and “Market Crier” we store your best score, when you reached it and the number of your scored runs. So that nobody makes up points, the server recomputes every run from your inputs (see “Human check in the browser games”); the run ID and the inputs are only held in memory and disappear with the run. If a new best score lands in the top ten of a title game leaderboard when it is scored, we also record this in a separate log: the game, points, rank, your Minecraft name and UUID at that moment, and when it happened. Only the Wink team can see this log; it stays even if you later drop out of the top ten, so that suspicious top runs can still be traced, and each entry is deleted after 365 days (legitimate interest in fair leaderboards, Art. 6(1)(f) GDPR). Anyone who opens smp.winku.de (opens in a new tab) can see the leaderboards (most trophy points, best runs), even without signing in. They show every account with its Minecraft name — the same name you play under on HugoSMP.net (opens in a new tab), which everyone there sees anyway —, the head from its skin (your browser loads it from Wink, not from Mojang) and, if the team has given it one, the icon of its badge; this cannot be switched on or off. Anyone who has not linked a Minecraft account yet appears there as “???”, and rank and points remain visible. The legal basis is our legitimate interest in showing leaderboards as known from games (Art. 6(1)(f) GDPR). You can object to this at any time via the support form (Art. 21 GDPR); we then delete your best scores and trophies and with them your entries in the leaderboards. You also appear without a name if you unlink your Minecraft account under “Account”. If the scoring of a title game changes so that old scores are no longer comparable (Ore Rush on 29 September 2026), we keep the old best scores (account, game, score, number of runs, when reached) separately as “old scoring” and show them in a separate leaderboard on the trophies page; the same applies to it as to the other leaderboards. Otherwise, trophies and best scores remain until you delete your data at Wink.

Cosmetics: The Wink mod draws cosmetics onto your character — the radar watch handed out by the team, the radar drone, which you earn in the air at the drone hangar (25 of them, numbered in the order the flights were accepted), the radar antenna for referrals and the crown drone, of which there is exactly one — for the winner of the hangar contest. For this we store your Minecraft account’s UUID, which item it is, its number, since when you have it and when you last put it on (if two items don’t go together, the one put on last stays). Every player’s mod fetches the list of who wears what without signing in — there is no other way for it to draw the item on your character, and in game everybody with the mod sees it anyway. At smp.winku.de/cosmetics (opens in a new tab) the 25 numbers of the radar drone are listed with the Minecraft name, the head from the skin and the date — the same details as in the leaderboards — and for every number the flight that earned it (see “Drone hangar”). If you play incognito you are left out of the list other people’s mods fetch, and your character wears nothing for them. At smp.winku.de/account (opens in a new tab) you set whether your item is shown in game at all and how you wear it (wrist, shoulder, spot on the head, paint, engraving on or off); we store that setting with your item and pass it to the mods along with the list, because otherwise they would not know how to draw it. For some items you choose a short text of your own (such as the line on the gingerbread heart, at most 18 characters) — we store it with your item as well, check it for links, phone numbers and banned words when you save it, and pass it to the mods along with the list: everybody with the mod sees it on your character. You choose the paint of your item like the other settings in the mod’s cosmetics window or at smp.winku.de/account (opens in a new tab); it goes to the mods with the same list. The pink look (boost pink, boost violet, pink haze) for drone, antenna and watch only exists while your boost runs. If you hide it, it is no longer in the list — your slot at smp.winku.de/cosmetics (opens in a new tab) stays filled all the same, because the number is still yours. The preview there fetches your skin from Mojang through our server; your browser does not talk to Mojang itself. The legal basis is our legitimate interest in making a visible collectible visible (Art. 6(1)(f) GDPR); you may object at any time via the support form (Art. 21 GDPR), and we will then take your cosmetic off the list. If you buy a cosmetic in the shop (on smp.winku.de (opens in a new tab) or in game), we take the price from your balance (booking “Shop” in your ledger) and store the item with the Minecraft account you bought it for; you can put it on, take it off and set it up on smp.winku.de (opens in a new tab) and in game. Otherwise it stays until you delete your data at Wink or unlink your Minecraft account. If you pick ‘Random from my inventory’ for a bag or backpack, your mod sends us up to four item types from your inventory every few minutes (e.g. ‘apple’). Amounts, names and enchantments are never included, and neither are valuable items. We keep the pick in memory only, for at most 20 minutes after the last update, and pass it on to the mods of players who can see your character. Nothing is sent in incognito. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by switching back to ‘Just for show’ — we then delete the pick immediately. If you wear the gaming headset and have set ‘When muted’, your mod reports whether your mic is currently muted (yes/no only). We keep this in memory only, for at most two minutes, and pass it on to the mods of the players who can see you — so that your mic is flipped up for them too. Nothing is sent in incognito. If you click a partner link, you leave our site; the partner may then set its own cookies and learns that you came from us. We ourselves transmit no data about you in the process.
Picks from the shop and purchased emotes: If you buy an emote in the shop (on smp.winku.de (opens in a new tab) or in game), we take the price from your balance (booking “Shop” in your ledger) and store with your Winku account — not with a Minecraft account — which emote it is and since when it is yours. With Wink Plus you can also pick from the shop (see “Subscriptions and Wink Plus”): for this we store with your Winku account, for each slot (three for cosmetics, six for emotes), which cosmetic or emote is in it, since when, until when it is locked and whether it was picked at random with your first Wink Plus. Our server makes the random pick from the emotes you do not have yet; it evaluates nothing about you for this. While Wink Plus is running, we list a cosmetic from your picks for all your Minecraft accounts linked to Wink in the list the mods fetch (see “Cosmetics”), and everyone with the mod sees a picked or purchased emote when you play it; others do not see your slots, their locks or whether something is bought or on loan. When Wink Plus ends, the picks stay stored but have no effect until Plus is running again; you keep purchased emotes without Plus. The legal basis is the use of Wink (Art. 6(1)(b) GDPR). We pass these details on to nobody and store them until you delete your data at Wink or your account is deleted; they are in your data export. The booking follows the retention period of the ledger. If the team gives you cosmetics or emotes for a limited time, we store on the item until when it applies; after that we take it back automatically and let you know.
Ad links to peepoPlush: In the shop and at PEEPO there are ad links to our partner peepoPlush (peepoplush.com (opens in a new tab)). If you click one, your browser opens their site; peepoPlush receives your IP address and, via a link parameter, learns that you came from us so that a commission can be attributed. It costs you nothing extra. We do not send any data to peepoPlush ourselves. peepoPlush’s privacy policy applies to processing on their side. The legal basis for offering the links is our legitimate interest in financing Wink (Art. 6(1)(f) GDPR).
Birthday (optional): Under “Account” or in game at the birthday table you can enter the day and month of your birthday, and the year if you like. We also store when you entered it (it can only be changed once a year), on which day it was last celebrated and — only for that one day — which of your Minecraft accounts received a birthday cosmetic; we note in the log that you entered (with or without a year) or deleted it, but not the date itself. With a year we only accept the entry from age 14. You decide who sees the day and month on your profile on smp.winku.de (opens in a new tab): everyone, only the people on your friends list (the default) or nobody. We only show your age (only if you entered the year) if you turn that on (off by default), and never the year itself. We store both choices with your entry, and you can change them at any time; entries from before 3 October 2026 are set to “friends only” and “age off”. If you carry a warning mark or are incognito, your profile shows your birthday to no one. On your birthday your Minecraft name and a figure made from your skin appear at the birthday table in game: for this our server hands out who has a birthday today (Minecraft name and UUID) to the mods without sign-in — not while you are incognito, carry a warning mark or have picked “nobody”. So that others near you can join in, your mod sends your world and coordinates about every 20 seconds on your birthday; anyone joining in sends their own position and whose birthday they are celebrating. We keep positions in memory for at most 45 seconds, never store them and never pass them on. The legal basis is your consent (Art. 6(1)(a) GDPR); you withdraw it by deleting your birthday — the date is gone immediately. Only the time you entered it stays until a year later, so the lock cannot be bypassed by deleting and re-entering (legitimate interest, Art. 6(1)(f) GDPR). Deleting your account deletes everything; your data export contains all of it.
Drone hangar: At the hangar on spawn you fly a test flight in the Wink mod. When you take off, we roll the course and store with the flight your account, your Minecraft account, the number the course is built from, and our time. At the end the mod only sends the moments in which you gave thrust — no keys, no mouse movements, nothing from your screen. From that we recompute the flight ourselves and store the result (cleared or crashed, how far, how many signals) and whether it earned you a radar drone. With every flight we also store the level (1 to 5) and the difficulty it was flown at (easy, normal or hard on level 1, fixed from level 2); which levels you have cleared follows from your stored flights. The radar drone is only available on level 1. While the hangar contest for the crown drone is running, we also note whether a flight counts for it (it has to start within the contest period — on level 1 at the contest’s difficulty — while you are playing on HugoSMP.net (opens in a new tab) with the mod; older versions of the mod always fly at “Normal”, versions without levels always level 1). Your points are the signals of a cleared flight; your best flight on each of levels 1 to 5 counts, added up (in contests with single-flight scoring only your best flight on level 1). With every contest we store how it is scored. At the hangar in the mod and on smp.winku.de/cosmetics (opens in a new tab) we show who is in the lead — Minecraft name and points — and the best pilots of each level with Minecraft name and points. When it ends we store the winner (account, Minecraft account, points, the flight) and how many pilots took part; the winner is listed with Minecraft name, head and points on smp.winku.de/cosmetics (opens in a new tab), and the winning flight is shown as a replay on smp.winku.de/cosmetics/crown (opens in a new tab). We keep the thrust timings only for cleared flights: for every drone handed out, smp.winku.de/cosmetics (opens in a new tab) shows the flight that earned it as a replay together with your Minecraft name, and the leaderboards there (one per level) list the best pilots with Minecraft name, head and number of signals. If the thrust timings of a cleared flight are suspiciously uniform, we note that in the moderation log — only as a hint for the team, nothing is ever decided automatically. If the team finds cheating, it can revoke a drone; its number then stays empty. Flights without a drone are deleted after 30 days, except your best cleared flight on each level (for the leaderboards and for which levels you have unlocked); flights of a running contest stay until it has been scored, and the winning flight stays. Flights with a drone stay as long as the drone exists. If you delete your account, all that remains of a win is the period and the score — without you. Everything is part of your data export and is deleted with your account. The legal basis is the use of Wink (Art. 6(1)(b) GDPR); for the public replay, the leaderboard and showing the leader and winner of the contest it is our legitimate interest in letting everyone see how the drones were earned (Art. 6(1)(f) GDPR) — you may object to that via the support form (Art. 21 GDPR).
Referrals: During the first 7 days after creating your account you can say who showed you Wink — in the mod's welcome window, on smp.winku.de/welcome (opens in a new tab) or in your account. We then store whom you named, when and where (mod or website), and count on how many different days your mod runs on HugoSMP.net (opens in a new tab) afterwards; after 3 days within 14 days the referral counts. The person you named learns your Minecraft name and whether the referral counts. While you are waiting, we check in memory whether you both play from the same network: for that we derive a check value from the IP address with a salt that changes daily, and store only the result yes or no, as a hint for the team. Referrals earn achievements, a Discord role (if you linked Discord), the radar antenna and, if there is a subscription on offer at the time, subscription time; we store which level you reached so nothing is handed out twice. If someone advertises it in the HugoSMP.net (opens in a new tab) chat or cheats, the team can revoke referrals or block the account from referrals; we store that too, with the reason. Everything is part of your data export and is deleted with your account, on both sides. The legal basis is the use of Wink (Art. 6(1)(b) GDPR), and for the network check our legitimate interest in spotting referrals through one's own second accounts (Art. 6(1)(f) GDPR).
Lounge: There is a common room at spawn. Inside it you only hear players in voice chat who use Wink — while you are in there, your mod asks us every few seconds whose mod is currently running and gets back those players' Minecraft UUIDs. Nothing new is stored for this: we know a mod is running only because it is connected to us at that very minute, and your mod keeps the answer only for as long as you stand in the room. The list goes to mod users only, not to the website and nowhere else. Anyone playing incognito is not in it and is therefore silent to the others inside. Whom your mod mutes is decided on your machine alone; we make no note of it, and outside you hear everyone again straight away. The board in the room names nobody — it only says how many people are in and how many of them have the mod. The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Lounge cinema: There is a screen in the lounge that plays YouTube videos requested by players (in game with /scamradar kino or on smp.winku.de/lounge (opens in a new tab)). If you request a video, we store which video (its YouTube ID and title), when, and from which Winku and Minecraft account the request came, and for which lounge in which HugoSMP.net (opens in a new tab) lobby (every lobby has its own programme) — so that you can remove it yourself and the team can see who posted it in case of misuse. Other players do not see who requested a video. We delete these details after 30 days, and straight away with your account; they are part of your data export. We do not download or keep the video itself: when a video is requested, our server only asks YouTube (Google Ireland Limited) publicly whether the video exists, what it is called, which channel it is from and whether the channel allows playing it outside YouTube — only the video’s ID is sent, nothing about you. When you are near the lounge, your mod only fetches from smp.winku.de (opens in a new tab) which video is playing there right now and from which point; as with every request we briefly process your IP address to slow down too many requests, and we do not store it. As soon as its player knows, the mod reports the length of the video or that it cannot play it; we store that with the video and keep who reported an error only briefly in memory. The legal basis for this is the use of Wink (Art. 6(1)(b) GDPR). The video is played in your mod itself, in YouTube’s embedded player (youtube-nocookie.com (opens in a new tab)): for this the mod starts an invisible browser that is already on your PC (Chrome, Edge, Brave or Chromium) with an empty profile, which it deletes again when it stops. It only does so after you have clicked “turn on the YouTube player” on the screen once; the choice applies to this PC. Your PC then connects directly to YouTube: Google learns your IP address and details about browser and device, can store information in that browser’s profile and may also transfer data to the USA (Google LLC is certified under the EU-US Data Privacy Framework, Art. 45 GDPR); Google’s privacy notices also apply. The legal basis for this is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); you can withdraw it at any time with “/kino youtube off” — the screen then asks again with the next video.
Plank Drop: At spawn there is an arena on stilts above the water where two players with Wink play against each other, also for a stake. When you are nearby, your mod keeps a connection to smp.winku.de (opens in a new tab) open so that you can see the arena and running games; as with every request we briefly process your IP address and measure the round-trip time of the connection (ping), without storing either for this. Your mod also sends which HugoSMP.net (opens in a new tab) lobby you are in, so that every lobby has its own arena; this is kept in memory only while the connection is open. If you play against someone from another lobby, the people at both arenas see the game. You can also play Plank Drop in the browser (smp.winku.de/arcade/plank-drop (opens in a new tab)), also against people who play at the arena in Minecraft with Wink; rules, stakes and queue are the same. Your browser then keeps a direct connection (WebSocket) to us open, through which you see the queue and can watch running games; as with every request we briefly process your IP address, without storing it for this. During a game your browser only sends which keys you are holding or pressing (move, push, brace); we calculate the rest. To practise, you play alone against a practice bot that runs entirely in your browser — nothing is sent to us. If you join the queue, your Minecraft name, the stake you chose and, if you switch on “Flexible”, your range are in the queue — only in memory, visible to everyone at the arena and to everyone who has Plank Drop open in the browser, and gone as soon as you leave or play. For 2v2 you form a team there: whoever you invite gets the invitation with your Minecraft name; invitations and teams are kept in memory only. During a game everyone at the arena and everyone watching in the browser sees the players’ Minecraft names, the score and a small figure made from your skin — also if you play in Minecraft and your opponent in the browser; likewise, if you play in the browser, you see the names and figures of the people at the arena. We store the game itself like every Wink Arcade game (players, stake, result, settlement), plus a recording of your keys (direction, push, brace) with their timing and the measured ping, so that the team can review a report and recompute the game step by step. This recording follows the same retention periods as the recordings of the other Arcade games. The legal basis is the use of Wink (Art. 6(1)(b) GDPR), for the recording also our legitimate interest in fair games for money (Art. 6(1)(f) GDPR).
Tournaments: If you sign up for a tournament, we store your account, your Minecraft name and UUID, your entry fee, your placement and your winnings; for hosts also that and by whom they were approved, and the tournaments they run. If the team approves a creator for tournaments, we store that (who, when, by whom, an optional lower stake limit and a note visible only to the team) until it is revoked or the account is deleted. For each tournament we store whether an admin, host or creator created it and how often its start time was moved after the first sign-up. All players see the hosting creator’s name on the tournament page. Kept like the other tournament data. We show the bracket with Minecraft names on the tournament pages of smp.winku.de (opens in a new tab) and to everyone with the mod on the tournament board in the world. We only know who is at the arena while they are connected. We delete finished and cancelled tournaments together with the sign-ups after 90 days, like Arcade games; the bookings stay for the retention period of the ledger. The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Lounge and photo booth, addition: If you sit down on a seat in the lounge, your mod reports the lounge, your HugoSMP.net (opens in a new tab) lobby and the seat to smp.winku.de (opens in a new tab) so that other players with Wink see you sitting there — together with your Minecraft UUID, only in memory and only while your mod keeps reporting (at most one minute after you stand up); if you play incognito, nothing is passed on. The lounge cinema has its own programme in every lounge and every lobby: your video request belongs to the lounge and lobby you make it in; on smp.winku.de/lounge (opens in a new tab) that is the lounge you are in right now or were in up to two minutes ago. Whoever presses ▶ on the screen controls the player as host until they leave the lounge or switch lobby; meanwhile their Minecraft name is shown on the screen (only in memory). Every mod plays the video itself in the YouTube player (see “Lounge cinema”); the host only decides what plays and from which point. While you are in a lounge, smp.winku.de (opens in a new tab) keeps your account, your Minecraft UUID, your Minecraft name and your lobby for about 15 seconds, so the next person can become host if the host is voted out; after that it stays in memory for up to two more minutes so that a request on smp.winku.de/lounge (opens in a new tab) goes to the lounge in your lobby. If you vote against the host, your vote (your account) is only kept until the vote is over or you leave the lounge; if you are voted out as host, we keep your account for 30 minutes so you cannot control the cinema during that time. None of this is stored permanently; it is gone when the service restarts. To check whether a requested video is age-restricted, smp.winku.de (opens in a new tab) requests the video's public page from YouTube — YouTube only sees our server, not you. If you queue for Plank Drop, the others at the arena see you as a small figure made from your skin on the stage. Photos from the photo booth show the date and time of the shot in the frame; your mod also saves the same framed picture as a screenshot on your computer. The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Plank Drop, walking on the platform: If you walk through the arch of the arena, you keep walking on the stairs and the stage in your own view; on the server you still stand at the arch. So that other players with Wink see you up there, your mod sends your position on the platform and the direction you are looking in to smp.winku.de (opens in a new tab) over the connection to the arena, and the service passes it on, together with your Minecraft UUID, to the others currently connected to the same arena. This is kept only in memory and is gone as soon as you walk out or the connection ends; nothing is stored. The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
WINKHUB (big hall in the air, drawn by your mod): When you enter the WINKHUB, the mod continuously sends your position in the hall (coordinates within the hall, the direction you are looking in, whether you are sitting, sneaking or in the air) to the service – while you walk, up to ten times a second. The service passes it on, together with your Minecraft UUID, only to other players who are in the WINKHUB at that moment, in the same world and lobby. The data is kept in memory only and is not stored; it is gone as soon as you leave the hall, the connection ends or nothing arrives for 20 seconds. Your real body stays at the spawn meanwhile and is hidden from others (see “Players invisible to bystanders”). During an event you can switch to our game server for Nebelflucht at the Nebelflucht stand after confirming; before that the mod asks that server once for its status (it sees your IP address). The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Question of the day: At spawn there is a board with a question that changes every day at midnight (German time); the same question is on smp.winku.de/question (opens in a new tab). The mod fetches the question, its answers to pick from and yesterday’s result near such a board even without an account. You can only answer when signed in or with a linked mod. Since 29 September 2026 you pick one of two or three given answers; we no longer accept free text. We store with your account the day, which answer you picked and when you picked or changed it — one answer per day, which you can change or withdraw until midnight. The next day the board and the page show how many players picked which answer (count and share), without names. Free answers from before that date are shown, until they are deleted, as before: only the ten most common ones given by at least three different players, without word filter hits and without anything that looks like a player name; the team can hide individual ones. Nobody can see who answered what, not even the team. We delete answers after 30 days; if you delete your data at Wink, they go with it right away. The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Donations to creators: If you donate to a creator, we store who donated how much to whom (your Winku account, your Minecraft name and ID, amount, fee, time), your message, whether you donate anonymously and, if you send a video along, its YouTube ID, title, start time and length. Your donation is shown publicly on the creator's stream: your Minecraft name (with “anonymous” only “Anonymous”), the amount and — from the thresholds the creator sets — your message, also read out. We generate the voice on our own server (Piper voices, no outside service); the audio file stays in the cache for at most 24 hours. If you send a video along, it goes into the creator's video queue with us — with YouTube ID, title, channel, start time, length, YouTube's numbers (views, likes, publication date, total length) and your Minecraft name (with “anonymous” only “Anonymous”); the creator and the moderators they add see it there and approve or reject it. It is played in the creator's overlay with the YouTube player without cookies (youtube-nocookie.com (opens in a new tab)): the creator's computer talks to YouTube, not yours. Whether the video exists and may be embedded, plus its title, thumbnail and the numbers mentioned, our server fetches from YouTube (YouTube Data API); YouTube only sees our server, not you. When you pick the segment on the donation page, only then your browser loads the YouTube player without cookies (script from youtube.com (opens in a new tab), player from youtube-nocookie.com (opens in a new tab)) — YouTube (Google) then learns your IP address and which video you watch. The same applies to the creator and their moderators when they watch a video before approving it. We pass nothing on to vidono.de (opens in a new tab) or other services. We delete message and video after 90 days; who donated how much to whom stays in the ledger for 180 days like every booking and also remains in the creator’s donation list without a fixed period — if you delete your data at Wink, the donation stays there without any link to you: your name is replaced by “gelöscht” (deleted), and we remove the message and the link to your account. The creator sees their donations with names (except anonymous ones), amount and message and can block donors (we then store the blocked person's account and Minecraft name). For the alert in OBS the creator gets a secret link; their settings for it (including the title and description of their donation page), their video queue, the list of videos they have blocked and their moderators (account, Minecraft name and what they may do) are stored with us. What is done to the video queue — who approved, rejected, skipped or blocked a video, who paused or played something themselves — we log with Minecraft name, video title and time for 30 days; the creator sees this log. If the creator switches on “recently played”, their donation page publicly shows the most recently played videos with the donor’s Minecraft name (with “anonymous” only “Anonymous”). When a creator switches donations on, the players currently supporting them with their creator code get a one-time notice. We delete the alerts themselves after 7 days. The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Gallery: If you upload a picture, we store the file (rewritten as PNG, without metadata), title, description, size, edition, price and offer and the status of the sale (on sale, paused and why, resting, sold out or closed) with the time, plus checksums of the picture. The checksums stay even after blocking or deletion, so that the same picture cannot come back. Publicly on smp.winku.de (opens in a new tab) and in the mod we show the picture, the painter’s Minecraft name, size and edition of the work and whether it is on sale right now, who owns which piece (with its number) and whether it is hanging, the provenance of every piece with names, kind (bought, taken, returned), price and date, and the price history and what follows from it (first price, last trade, market value, lowest offer). If you hang a picture, we store world, coordinates and direction: only you see the location on the website, but in game everyone with the mod sees the picture there with your name. While the gallery is open to you, the mod asks every few seconds, with your world and your approximate position (x and z), which pictures hang around you; we do not store this position. If someone tries to take a picture, we store who tried when and whether it worked; for this the mod sends the player’s position to our service. Purchases and fees are in the ledger like every booking. To apply your limits in the gallery, we check whether your Wink Plus is running, how many works you have on sale and have submitted in the last seven days, since when your Minecraft account is linked and whether your account is frozen or banned in Wink Arcade; if you are over a limit, we pause sales of your newest works, move extra pictures into your collection and send you a notice. So that nobody plays tricks through friends or further accounts, with every purchase, resale and attempt to take a picture we check whether the accounts involved (and the painter) are linked to each other: through the friends list and open friend requests, through the same network, through the same Minecraft account (link, mod device, deposits and withdrawals) and through gifted Wink Plus. For the network we store, with every gallery action of your account, a shortened and salted identifier of your IP address (never the address itself) and delete it 30 days after it was last used; we also use the network identifiers from reports and good experiences for this. Other players never learn with whom or through what an account is linked. If we refuse something for this reason or a trade stands out (for example far below market value or again and again between the same accounts), we note for the team which accounts were involved, which picture it was about and which kind of link matched — without any address; we delete these entries after one year. The legal basis for this is our legitimate interest in a fair market without straw-man deals (Art. 6(1)(f) GDPR). If you report a picture, we store reason, text and your account; the team sees your name. If the team bans someone from the gallery, we store the account, reason, duration and who imposed the ban until the team lifts it or the account is deleted. In your profile a gallery block shows your showpiece, what you own, your own works and numbers, such as how many one-of-a-kind pieces you own (never a location); you can hide it and single pictures, and in incognito it does not appear. If you delete your account, your pieces lapse, the provenance of other pieces no longer shows your name, and your own pictures owned by others stay for them without your name. We delete attempts to take a picture (who tried to take which picture from whom, when and with what result) one year after the attempt, and reports about pictures one year after the team’s decision; open reports stay until they are decided. Pictures, pieces, provenance (“bought from …”) and price history have no fixed deletion period, because they are the gallery itself: they remain until you delete your data at Wink (then as just described). The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Reporting photos, photo booth ban, lounge cinema on the web: when logged in you can report a photo from the photo booth. We store the photo, your Winku account, the reason you chose, your optional text and the time so that the team can decide; if three people report the same photo, we take it off the sign straight away. Only the team sees who reported. We delete handled reports after 30 days, and straight away with your account. If the team bans someone from the photo booth, we store the account, duration, reason and who banned until the ban expires. For the lounge cinema we also store for every request who was standing in that lounge at that moment (Winku accounts, reported by the mod while you are inside) — only these people and the current host see the request on smp.winku.de/lounge (opens in a new tab); we delete that list as soon as the video has played or was removed. For every video we show the title, channel and thumbnail, which our server fetches from YouTube (it keeps the thumbnail in memory for at most one hour); your browser does not contact YouTube for this. You can report a video in the lounge cinema (on smp.winku.de/lounge (opens in a new tab) or in the mod’s cinema menu). We then store your Winku account number, which request you report (its ID, the YouTube ID, title and channel of the video, lounge and lobby and the account that requested it), the reason you pick (sexual or nude content, violence or shock content, hate or harassment, spam or noise, something else), the time and the team’s decision. The team sees the report together with your name; whoever requested the video never learns who reported it. If two different accounts report the same video, it skips right away, and whoever requested it cannot request or control anything for 30 minutes; the team can block them for longer or lift the pause. We store such a block with the account, its end, the reason and the account of the team member who set it (for the pause: automatic). We delete reports after 30 days like the requests themselves and expired blocks after one day; deleting your account removes your reports, the reports about your requests and your block. Your data export lists your reports and a block. The legal basis is the use of Wink (Art. 6(1)(b) GDPR), for reports and bans also our legitimate interest in a clean service (Art. 6(1)(f) GDPR).
Emotes in chat: In the HugoSMP.net (opens in a new tab) chat the Wink mod shows the 7TV emotes of the Twitch channels we pick for this (currently LetsHugoTV; which ones they are right now is on smp.winku.de/emotes (opens in a new tab)), emotes from Wink itself and the custom emotes of players with Wink Plus as a picture instead of a word — only in chat lines from players, never in warnings, TPA, payment or trade lines and never on numbers. Some emotes are Wink Plus only; whether one shows as a picture, the recipient’s mod decides by whether the sender wears the Plus badge — nothing extra is sent for this. The mod fetches the list of emotes and the pictures only from smp.winku.de (opens in a new tab), never from 7TV or Twitch: the list on start and when something has changed, plus once a preview pack with still pictures of all emotes (kept on your PC under “config/scamradar” and replaced by the next one when the list changes); moving pictures only once an emote is on screen. Without a linked account it sends nothing about you, when linked it sends its pass along; as with every request we only briefly process your IP address to slow down too many requests, and we do not store it. Our server asks 7TV (SEVENTV SARL, 7tv.app (opens in a new tab)) about every minute which emotes these channels have set up right now; only the channel’s public Twitch ID or the ID of the 7TV set is sent, nothing about you. From 7TV we store for each emote its ID, name, features (animated, overlaying, 7TV flags) and the public name of its creator on 7TV, which we show as its origin on smp.winku.de/emotes (opens in a new tab) and in the mod. Our server fetches the pictures from 7TV and only keeps them as a cache: we delete them 7 days after they were last used and straight away when the channel removes an emote, we take a channel off our list or the team hides it. Which emotes were added, removed or renamed, we keep for 90 days. Whether emotes appear, whether they move, how big they are, whether you see other players’ custom emotes, your favourites and the emotes you hid for yourself belong to your mod settings on your account; the mod may cache the pictures on your PC under “config/scamradar” and remember the emotes you used last there (at most 24 names). With Wink Plus you upload up to five custom emotes on smp.winku.de (opens in a new tab). For this we store the picture (rewritten as WebP, without metadata), the name, the state of the review, the reason for a rejection or block, when you uploaded it and when the team decided, and check sums of the picture to spot identical pictures; how often you uploaded, we count for 8 days. The moderation team sees every custom emote first. Once approved it is in the list for the mod with your Minecraft UUID and Minecraft name, all players with the mod see it in your chat lines, and its picture can be fetched from its address on smp.winku.de (opens in a new tab) — only while Plus is running, and never while one of your Minecraft accounts has a warning mark, you play in incognito or you are banned from custom emotes. When Plus ends, your emotes are paused; after 365 days without Plus we delete them together with the picture. Rejected and blocked emotes are deleted together with the picture 30 days after the decision; we keep the check sum of a blocked picture (not the picture) for 365 days so the same picture does not come straight back. If you delete an emote yourself, it is gone right away. If you report an emote, we store the emote, the reason, the time and your account; the team sees the reasons and the number of reports, not who reported, and we delete decided reports 365 days after the decision. If the team bans you from custom emotes, we store the reason, the duration and who banned you until the ban ends. For each channel we include we store the address of its public profile picture; only our server fetches the picture (from Twitch or 7TV) and shows it in the mod's emote menu – nothing about you is sent. The legal basis is the use of Wink (Art. 6(1)(b) GDPR) — also for others seeing your custom emotes, because that is exactly what you upload them for; for the names of creators on 7TV it is our legitimate interest in stating an emote’s origin correctly (Art. 6(1)(f) GDPR).
Vouchers: The team can hand out codes that give you a subscription to a feature or a package (such as a 7-day Wink Plus trial), a cosmetic or — only with approval from the HugoSMP.net (opens in a new tab) server management — in-game balance, one of them or all at once. When you redeem one, we store which code it was, that your account redeemed it and when; that is how we know a code is not redeemed twice by the same account. For a Wink Plus trial we also check whether your account has had Plus before or has already redeemed a trial — then it does not work. What you get is recorded as it always is: balance as a booking in the ledger (noting that it came from a voucher), a subscription among your subscriptions, a cosmetic on your Minecraft account. The code itself was created by the team; it belongs to nobody until someone redeems it. Your redemptions appear in your data export and are deleted with your account — the count of how often a code was redeemed in total stays behind as a bare number. The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Escrow trading through the mod: When you trade through the escrow with the Wink mod, we process your Wink account and the other player’s, both Minecraft names and UUIDs, the items offered (fingerprint — a checksum of type, name, lore, enchantments, durability and container contents —, amount, tooltip lines), the price, the fee, the time of every step and both mods’ reports on the handover (time, fingerprints, differences, whether the other player left the server). Freezing, payment to the seller and the fee appear as bookings in the ledger. If you use “Safe handover” in escrow trading, we additionally store the course of the handover with the trade: who agreed when, the phases with times, the meeting point (world and coordinates), whether both were ready (health, combat, free slots), how many of the bought items the buyer had before the handover and at spawn, and reasons for cancelling (e.g. restart, death, offline). This is used to verify the handover and is deleted with the trade (365 days after completion, mod reports after 90 days). In a dispute or review both mods upload their game replay of the handover; the team then sees the replays, the reports and your reason. Every completed trade appears in both players’ trust breakdown on the player page and in the mod’s player info (name, month, number of trades, the partner’s playtime, account age and number of trades — no price, no items); both see this before confirming. We delete trades 365 days after completion (disputed ones not before the decision), mod reports after 90 days and dispute replays 90 days after the decision; a false claim found by the team counts for 180 days. If you are banned from trading because of this, we store the end date and the reason with your account; we delete the reason with your account. If you delete your data at Wink (only possible without an open trade), we delete all your trades, including from your partners’ breakdowns. The legal basis is the use of Wink, i.e. safe handling and settling disputes (Art. 6(1)(b) GDPR), and for protection against fraud and the breakdown our legitimate interest (Art. 6(1)(f) GDPR).
Moderation team decisions: When the moderation team decides on a report, an appeal, an Arcade report, an escrow trade or another measure with “Undo” (for example a mod ban, a reporting ban, a good experience, a second chance, freezing an Arcade account or a creator application), we store the decision (which team member, which item, the choice and reason, the time) as pending for 60 seconds so it can be undone; after that it takes effect. We delete these entries after 7 days. Which cases a team member skipped is kept only in their session. If the team moves a report to another player because the wrong player was reported (mixed-up names, alt account), we store on the report the Minecraft name it was first filed under and the time. If the team adds an accomplice, we store on their report the case they came from and their role (accomplice or knew about it). This information keeps moderation traceable, only the team sees it, and it is deleted together with the report. On the case we also note when the team last looked at new reports on an already confirmed case; this is deleted together with the case. When we replaced old umbrella terms (for example “Toxic”) in case summaries with the exact offence or the label “Formerly: …” on 26 September 2026, we kept the previous text for each case so we can check and undo the change; this backup only contains those ready-made texts, no reporter names, and we delete it 90 days after the change. The legal basis is our legitimate interest in careful decisions that can be corrected (Art. 6(1)(f) GDPR). Internal team notes: Moderators and admins can add short notes (up to 1,000 characters) on a person (their Minecraft account) or on a case to coordinate within the team — for example, what still needs checking. We store the text, who wrote it, when the note was created, edited or deleted and by whom; if someone edits their note, the earlier version stays attached to it as history. In the moderation area only moderators and admins see these notes — not reviewers and never the public; nobody on the team sees or writes notes about themselves. The moderation log only says that a note was added, edited or deleted, never what it says. We delete notes on a case together with the case; notes on a person once there is no case, no open appeal, no running mod ban and no running reporting ban left for them and the note has not been edited for 30 days. A deleted note disappears from view right away and is gone for good, with all earlier versions, after 30 days. If you delete your account, notes on your Minecraft account still follow these deadlines. If a team member deletes their account, their notes stay without their name (“former team member”). The data export you download under “Account” contains the notes on your Minecraft accounts and on cases in which you are the reported player — with text, date and earlier versions (including ones the team has already deleted, until they are gone for good), but never who wrote them; notes on cases in which you only reported someone are not included. The legal basis is our legitimate interest in coordinated, traceable moderation (Art. 6(1)(f) GDPR). Exports: Only admins can download the “All cases” list (case number, Minecraft name and UUID of the reported player, status, level, risk, times — no reporters) and the moderation log as a CSV file, solely for the team’s own work; every download is recorded in the moderation log. The file is created when it is downloaded and is not kept on our server; admins delete it after use.
Oversight of the moderation team: For reviewers, moderators and admins we evaluate from the moderation log how they work: how many and which decisions they make, on which days, how much time lies between two decisions, how often they confirm or reject cases, how long their reasons are, how often their decisions were appealed and how often a decision was overturned — each compared with the team average. Only admins see this. Anyone new to the team is on probation: their first 15 decisions only take effect once an admin approves them. The same applies when an admin puts someone under supervision, and automatically when someone makes very many decisions in a short time or several of their decisions were overturned. For this we store for each team member whether and why they are under supervision and since when, how many approvals their probation still needs, a paused role with its reason and a note by the admins, and for each pending decision whether it is waiting for approval, who approved it or the reason why not — this applies to every decision with “Undo” (see above). Admins can take back decisions that are already in effect so that someone else decides again; the reporters, whoever filed an appeal, and the team member (with the reason) then get a notification. Admins can download this evaluation as a CSV file (the same figures as on the page, without the admins’ note, for internal use only and to be deleted afterwards); every download is recorded in the moderation log. If an admin ticks off a technical signal (for example a server with problems or a mod error that is hitting many players right now — the signals themselves only contain technical data and numbers), we store their team account with it until the signal has gone, at the earliest two hours after ticking it off and for 30 days at most; the moderation log records this like any other action. Which world releases and finished feedback a team account has recorded is part of that account’s data export; if a team member deletes their account, these records stay without any link to them. The supervision data stays as long as the account exists and is deleted with it; we delete the moderation log after 12 months. The legal basis is our legitimate interest in fair and reliable moderation (Art. 6(1)(f) GDPR).
Checklist for HugoSMP: At smp.winku.de/hugosmp/review (opens in a new tab) the team of HugoSMP.net (opens in a new tab) decides together with us which Wink features are allowed on the server. Our admins get in with their Winku account; HugoSMP team members without a Winku account get in like this: the page shows your browser a random code valid for 10 minutes. If you write it in the public chat on HugoSMP.net (opens in a new tab), our market bot reads your Minecraft name and rank from that chat line, checks both against the tab list (UUID, rank, clan) and sends code, name, UUID and rank to smp.winku.de (opens in a new tab). If the rank is a team rank, we unlock the browser session (cookie smp.sid) for 12 hours and store name, UUID, rank and validity in the session. For any other rank the waiting page shows the name and rank of whoever wrote the code for at most 10 minutes. Nothing of this is stored on the bot’s machine. We record every unlock with name, UUID, rank and time for 90 days, visible only to our admins. Every decision on an item (status, note, who — Minecraft name, UUID and rank or Winku account —, when) is kept with its history for 2 years and visible to everyone with access to the checklist; our admin gets a notification with name, rank and item. The legal basis is our legitimate interest in keeping agreements with the server team traceable (Art. 6(1)(f) GDPR). With a Winku account this data is part of your data export; if you delete your account, your decisions stay without your name and your sign-ins are deleted. Without an account, contact support for access, objection or deletion.
Chat statistics: At smp.winku.de/chat-stats (opens in a new tab) we show signed-in users how busy the public chat of HugoSMP.net (opens in a new tab) is. For this, since 03.10.2026 our bank bot (see “Bank bot for Wink Arcade”) counts per Minecraft name and hour how many public chat lines someone writes, together with the clan tag and rank as they appear in the line before the name. It never reads, sends or stores the text of the messages; it does not count private messages or its own. It also records the server’s public announcements when the chat is slowed down, paused, opened again or cleared — with time, cooldown, announced duration, wording and, if the server names them, the Minecraft name of whoever triggered it. The bot keeps the numbers in memory only and sends them to Wink every minute (if Wink cannot be reached, for about two hours at most); nothing of this is stored on the bot’s machine. Wink links a name to its UUID if the Minecraft account is linked to Wink or listed in the player directory. The page shows totals per day and time of day, the players with the most messages (25 at most), clans, ranks and the history of the announcements. We delete counters with names and the name and wording of an announcement 90 days after the day; totals per day and hour without names as well as type, time and duration of announcements are kept permanently. The legal basis is our legitimate interest in showing statistics about the public chat, which everyone on the server can read anyway (Art. 6(1)(f) GDPR). You can object: with a linked account you hide yourself in your account settings (box “Chat stats”, switch “Show my name in the chat stats”) — then you appear in no list and in no announcement by name, and your lines only count towards totals, clans and ranks; while incognito or after an objection to the player directory you are hidden as well. Without an account, contact support. With a Winku account your counters are part of your data export; if you delete your account, we delete the counters of your Minecraft names and remove your name from the announcements.
Usage statistics: To see what gets used how often at Wink, since 30.09.2026 we count page views per area and page (the address without numbers and codes), how many sessions with the Wink mod there are and how long they last, how many calls are started and answered and how long they last, and how often the title games are played. Only the total per day and hour is stored, never who did something. To count how many different people used the site or the mod on a day, we keep a list of hashed identifiers in memory until midnight, with a key that is created anew every day and never stored; only the number goes into the database. We keep a running mod session in memory until it ends. Data that is stored anyway (such as matches, hangar flights, messages, pixels and reports) is evaluated by admins as counts per day and hour; only the lists of the most active players per area show admins Minecraft names with the count. We delete the totals after 400 days. The legal basis is our legitimate interest in shaping Wink around what is actually used (Art. 6(1)(f) GDPR).
Mod bans: If someone breaks our rules, we may ban their Winku account and/or Minecraft account (UUID) from using the Wink mod for a limited time or permanently, and if needed also from using the website (signed-in areas; your account, data export, deletion and the legal texts stay available). For this we store the account or UUID, the Minecraft name at that time, start and end, whether the website is blocked too, the reason shown to you, an internal team note, who set or lifted the ban and when. The purpose is to protect the community and the mod from abuse; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR) and the performance of the terms of use (Art. 6(1)(b) GDPR). The data is deleted 365 days after the ban ends; a permanent ban stays as long as it applies. If you delete your account, the link to the account is removed; a ban tied to your Minecraft UUID stays until it expires so it cannot be avoided by deleting. If we lock your games with a stake for cheating or ban you permanently from the website as well, we pay your balance out to your linked Minecraft account; the payout appears in your ledger like any other, with the reason. If no account is linked, the balance stays reserved. Your data export includes the duration, scope and reason, plus the team’s internal note and, if the ban was lifted, the reason for lifting it — each with its date, never with the name of whoever wrote it. In general, all internal records the team keeps about you (on bans, mod bans, the camera in the Chat House and the team’s notes) are part of your data export with text and date, never with their author.
Photo booth price: when you take a shot in the photo booth, we store a reservation with your account: a random ID of the shot, the price, whether the photo was free with Wink Plus, its status (reserved, paid, free, refunded), the ID of the photo and the times. We use it to charge each photo at most once, to count the photos that are free with Plus per day, and to refund the price if the team deletes a photo. The charge and any refund appear as entries in the cash book. For a photo with LetsHugoTV we only remember, per photo, whether he is in it (yes/no), so that the surcharge is right. Unused reservations are deleted after one day, the others once the photo is deleted (after two days at the earliest), and all of them right away with your account. The legal basis is your use of Wink (Art. 6(1)(b) GDPR).
Trusted in the mod: Whoever you mark as “Trusted” in the mod (at most 200 Minecraft names) is stored with your settings on your account. Only you see the list; the people on it learn nothing about it and get no request. Everyone you had marked with ★ before was moved to this list once. We delete it with your account or when you remove entries. The legal basis is your use of Wink (Art. 6(1)(b) GDPR) — you create the list yourself; for the names of the players on it, our legitimate interest in your mod recognising them on every PC (Art. 6(1)(f) GDPR).
Automatic 2FA for HugoSMP (mod, optional): If you set up the two-factor login (2FA) of HugoSMP.net (opens in a new tab) through the mod (command /2fa), the mod stores the key of this 2FA — the secret the codes are made from — on your PC (on Windows encrypted with the Windows data protection interface, DPAPI) and, encrypted, with us on your account, linked to your linked Minecraft account. We also store when the key was stored and when your mod last fetched it. Purpose: the mod enters the code by itself when you join (it goes to HugoSMP.net (opens in a new tab), just as if you typed it yourself), and the key is back on a new PC. Neither the mod nor we store backup codes. Your data export only says that and since when a key is stored, never the key itself. You can delete it at any time under “Account” in the section “2FA for HugoSMP” (“Remove”); if you turn off 2FA at HugoSMP, the mod deletes both copies, and it also goes when you unlink the Minecraft account, and with your account. There is no separate deletion period: the key stays until you remove it or the link ends. You can switch the function off in the mod’s options under “Automatic 2FA” — then the mod enters no code any more and neither stores nor fetches a key. Important to know: whoever is signed in to your Windows account on your PC can get at the key on that PC; lock the PC when you leave. The legal basis is the use of Wink (Art. 6(1)(b) GDPR) — the function only runs if you set up 2FA through the mod.
Mod lag reports: if the mod itself slows your game down for a longer time, with a linked account it sends technical values at most every 30 minutes (cause, frame rate and frame time, cost of its parts per frame, server TPS, ping, memory, CPU cores, render distance, graphics card name, number of mods, running game, versions), but no position, no chat and no names. We don’t store them with your account but with an ID that can only be recognised for one day, so we can count how many players have a problem, and we delete them after 30 days. The legal basis is our legitimate interest in finding and fixing lag caused by the mod (Art. 6(1)(f) GDPR).
Troubleshooting connection problems: The mod and the games on smp.winku.de (opens in a new tab) send us a short technical summary once a minute when there is something to report: whether connections to us dropped (close code), how long reconnecting took, response times, gaps between game updates, failed requests per area and whether your game or browser froze for a moment, plus the mod and Minecraft version or the game. No content, chat, names, positions or installed mods are included. We store this with your account and derive detected disruptions from it, which may list your account. The purpose is stable operation and troubleshooting; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). It is deleted after 14 days; the service's own measurements, which carry no personal data, are kept for 2 days. In the mod you can turn this off under Options → More → “Send technical measurements”. Nothing is stored in your browser for this (no cookie, no local storage).
Question of the day – suggestions: if you suggest a question, we store with your account the text, your two or three answers to pick from, the language, whether your name may be shown, the time, the team’s decision and the day it runs. We only show your Minecraft name if you tick the box. Declined ones are deleted 30 days after the decision, used ones 30 days after their day, unhandled ones after 90 days, and all of them right away with your account. The legal basis is your use of Wink (Art. 6(1)(b) GDPR); for showing your name, your consent via the tick box (Art. 6(1)(a) GDPR), which you can withdraw at any time via support — the question then shows without your name.
Clans: our market bot reads the public “Browse clans” menu on HugoSMP.net (opens in a new tab). For each clan we store its tag and colours, name, number of members and how many are online, its clan duel rank and when we saw it. From the clan profile we only take who is a member and in which role (leader, co-leader, moderator, member). The profile also shows whether and when someone was online and where they are playing; we neither read nor store that. This lets the Wink mod and smp.winku.de (opens in a new tab) show names with the right clan tag in its colours. If we later see a player differently in the tab list or chat, the newer information wins. Clans we haven’t seen for 30 days and memberships not confirmed for 30 days are deleted. The legal basis is our legitimate interest in showing names the way they look on HugoSMP.net (opens in a new tab) (Art. 6(1)(f) GDPR) — the data is public there.
Statistics and balances from /statsall: Every player our market bot sees on HugoSMP.net (opens in a new tab) in the player list or in public chat is checked one after another in the statistics view “/statsall”, which any player there can open for any other player — at most once a day per player and at a calm pace; whoever has never been checked, or was checked longest ago, comes first. Until the first check, only a player’s Minecraft name sits on a waiting list. After that we store, per player, the Minecraft name and, where known, the UUID, the latest and previous balance with the time it was read (if someone hides their balance on HugoSMP.net (opens in a new tab), we only note “hidden”) and the other values of that view with the time: playtime, blocks placed and mined, mob kills, ranking position, kills, deaths, K/D and the duel values (queue and 2v2). We show these other values to signed-in accounts with access to Wink in the player profile under “Stats on HugoSMP” — without the balance. From the balances we work out how money is spread across the server (such as the median and shares) and keep these figures, without names, for 400 days. Only the Wink admins see the balances of individual players, for example to judge how much a reported loss weighs; we do not show them publicly. Nothing of this stays on the bot’s computer, except batches Wink does not accept at that moment (at most 7 days). We delete a balance and the other values 30 days after the last check; a name on the waiting list that we have neither checked nor seen again in that time is deleted as well. The entry for your linked Minecraft account is part of your data export and is deleted with your account. This concerns every player on HugoSMP.net (opens in a new tab) that we see this way, including players without a Winku account. The legal basis is our legitimate interest and that of our users in judging players and amounts in reports and in the game correctly (Art. 6(1)(f) GDPR) — the data is visible to all players on HugoSMP.net (opens in a new tab). Objection as for the player directory: we then delete your entry and stop checking you.
Clan board (optional): On smp.winku.de/clan-board (opens in a new tab) you can post that your clan is recruiting (only as leader or co-leader — we take that from the clan list, see “Clans”) or that you are looking for a clan. We store your text, your Minecraft name and your Minecraft UUID (for your skin’s head and the link to your profile), for a clan post the clan’s tag and name, your Winku account and when you posted. Every signed-in visitor sees the post with the Minecraft name, head, a link to your public player profile and — if you are on the warning list — your warning level, or with the clan; with a linked mod this also works in the game. If someone reports a post, we store who reported it; after three reports it is hidden until the team decides. If you show interest in a clan or, as leader or co-leader, invite someone, we store the request with your Minecraft name and UUID, the clan, your sentence (optional, up to 160 characters), who receives it, its status and the times. The recipient sees it together with the head and warning level and gets a notification, and so do you when they accept or decline; you can withdraw an open request at any time. A post stays up for 14 days; 7 days after that we delete it together with its reports and requests, and you can take it down at any time. The legal basis is your consent (Art. 6(1)(a) GDPR), for reports our legitimate interest in a clean board (Art. 6(1)(f) GDPR). Deleting your account deletes everything; your data export contains it.
Price alerts (optional): Under “Market prices” or on smp.winku.de/price-alerts (opens in a new tab) you can set up to 10 alerts: an item and a maximum price per piece. We store your Winku account, the item, the price, when you set the alert and when it last fired at which price. If our market bot sees the item in the auction house at that price, you get a notification (can be switched off under Notifications); the alert then rests for 12 hours. Alerts stay until you delete them; deleting your account deletes them. The legal basis is your consent (Art. 6(1)(a) GDPR).
Ideas and bugs (optional): On smp.winku.de/ideas (opens in a new tab) you can send in ideas and bugs once your Minecraft account is linked. We store your Winku account, whether it is an idea or a bug, the area, title and description, the time and the team’s decision (status, rating, reply to you, who and when). If something is built or fixed, you earn points; we store your points balance and every booking, including when you swap points for days of Wink Plus (the days are then added to your Plus like a gift, see “Subscriptions and Wink Plus”). Visible to everyone: what is planned or in progress is shown by title (for ideas also with the description, for bugs never) and without your name; only what is built or fixed shows your Minecraft name, and the leaderboards “Top idea makers” and “Top bug hunters” show your Minecraft name, your head and your points from it. The team can hide individual submissions. The team can also turn your feedback after a game or your free-text answers in the survey into an idea or bug: the text then sits with your account among the ideas (marked as coming from feedback or the survey), you see it under “What you sent in” and earn points as for your own submission; we never show it publicly, it stays with the team and you. From then on that copy follows the deadlines for ideas instead of being deleted after one year. If the team ticks off a piece of feedback or a survey answer as done, we only store which one it was, which team member, when, and the number of the idea it became, if any — no text; we delete this record after 400 days. You get a notification about a decision (can be switched off under Notifications, type “Suggestion”). We delete rejected and duplicate submissions 180 days after the decision, everything else with your account. The legal basis is your consent (Art. 6(1)(a) GDPR).
TPA hub (mod): TPA offers from others that the mod detects in your chat stay on your computer, in memory only (at most 60, for 5 to 30 minutes depending on your setting); none of it is sent to us. If you post an offer yourself with a linked account, we keep in the server’s memory only, until it ends: your Minecraft name and UUID, your text, the chosen occasions, the direction, the world and the duration (up to 30 minutes without Wink Plus, up to 120 with Plus; if your mod stays silent for 3 minutes, it is gone); every player with a linked mod sees it. You can add up to five tags to your offer (e.g. FFA, shop, event); like the offer itself they are kept in memory only until it ends, and everyone with a linked mod sees them. If you report an offer from the TPA hub, its number is sent along; we add the offer’s text and tags to your report and store them there like any other report. If you send a TPA to someone who is currently in the hub, the mod reports, without any text, who it went to, in which direction and how it ended. If you die shortly after a TP — whatever it was for —, it reports who the TP went to, after how many seconds you died and whether in the same world, but only while “After dying right after a TPA, ask if I want to report” is on. We keep these events in memory only for at most 60 minutes, without location; after a server restart everything is gone. From this we only show others that someone isn’t accepting TPAs right now, and show those affected how many players with the mod died shortly after a TP to the same person — never who. Nothing is ever reported automatically. The legal basis is the use of Wink (Art. 6(1)(b) GDPR), and for the notices to others our legitimate interest in warning about TPA traps (Art. 6(1)(f) GDPR).
Streamer sign: Signs at spawn show the public status of Twitch channels. For this, our server fetches only public channel data from Twitch (Twitch Interactive, Inc., USA) — name, profile picture, whether the channel is live, since when, viewer count, title and category — and stores it with the time the channel was last live, until no sign, notification or mod has needed the channel for 30 days; the profile picture stays in memory for at most 24 hours. Nothing about you is sent to Twitch; your mod asks smp.winku.de (opens in a new tab) for this data, never Twitch directly. With your mod settings on your account we store which channels you want a live notification for (at most 20), whether you also want one for the creator whose code you entered, and whether the sign shows you your creator instead of the default. If such a channel goes live, we add a notification to your account (like every notification, 60 days). You set this at the sign and in the mod’s options, and you can also switch off “Live” notifications on smp.winku.de/notifications (opens in a new tab); everything is deleted together with your account. The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Buzzers in the world: If you press a buzzer with a linked mod, we store for your account how often your press was counted on which buzzer, with the time of the first and the last one, for each buzzer who last made a counted press and when, and if you hit a round thousand, that number. At the buzzer, every player with the mod, even without a linked account, sees its name, the total and “last: <your Minecraft name>” — not while you play in incognito. The team also sees the three accounts with the most presses for each buzzer. So that auto clickers get nothing, the service keeps the times of your last presses in memory only; after an hour without a press they are gone. Your numbers stay until the team resets the buzzer or you delete your data at Wink — if the team removes a buzzer, the numbers are kept and count again as soon as a buzzer with exactly that name is back; they are part of your data export. The legal basis is the use of Wink (Art. 6(1)(b) GDPR), and for showing “last” our legitimate interest in a shared game at spawn (Art. 6(1)(f) GDPR).
Chat House (Wink Arcade): In the Chat House you meet other players at random to talk. As long as we haven’t switched it on, only admins can try it out. When you join the Chat House, Wink processes in memory, without a database (except your record on the waiting screen, see below): your Minecraft name and UUID; whether you are waiting, paused or meeting someone; who you are connected with; the last people you met (at most 15 minutes, so you don’t get the same person twice in a row); the meeting point (world, coordinates and lobby of the host); while you wait at spawn, your mod sends your world, coordinates and lobby about every 5 seconds for this, valid for at most 20 seconds. Your movement inside the house is only passed on to the other person. The other person sees your Minecraft name; on the waiting screen, others who are waiting see your name. For matching we check whether one of you has muted or blocked the other and whether a warning exists; with a level-3 warning or an active voice-chat warning from level 2 the Chat House is locked. If you block someone, we store that like any personal mute (“Never again in the Chat House”, voice, chat) until you lift it. Reports from the Chat House go through the normal report system (place “Chat House”, with replay including voice). In Cell Hunt on the waiting screen we store your record for each account: the longest time you survived there, plus your biggest mass, your Minecraft name at the time and when. The five longest are shown to everyone in the records list. If you play alone, your mod runs the game and sends us your inputs and your mass about every 5 seconds; we use them to check that your record is real — we keep this only in memory and delete it as soon as you leave the waiting screen. Your record stays until you delete your account. When you leave the mode or the service restarts, everything else is gone. Before joining you can optionally state your gender (male, female, non-binary or not saying), who you would most like to talk to, and your language (pre-filled from your Minecraft language setting). The mod stores this only on your computer; the service receives it when you join and keeps it only in memory while you are in the queue or in the house, to match you with fitting people where possible — it is never stored in the database or in logs. The other person sees your language on your profile card; nobody sees your gender or your wish. The legal basis for this is your consent (Art. 6(1)(a) GDPR); you withdraw it by choosing “not saying” or “anyone”. If your Wink Plus is active, you move further up the queue (after every two Plus spots someone without Plus always gets a turn); the service checks whether your Plus is active when you join. In the house both people see a profile card: Minecraft name with head, rank, clan, badges, Plus badge and warning status as everywhere in the mod, plus, where available, clan name, role, member count and clan-duel rank from HugoSMP's public clan menu and places in the public top 10 leaderboards; no new data is collected for this, and the card is kept only in memory while the meeting lasts. In the Chat House you can choose a mode (e.g. blind date); the choice is stored only on your computer and sent to the service when you join, which keeps it in memory only while you are in the Chat House. In blind date mode, the service remembers for the length of the meeting (and up to five minutes after it if you were interrupted) what you have shown about yourself (skin, name, profile card) and whether you want to reveal together. Pictures in the chat house: unless you switched off “Show my photo booth pictures in the chat house”, our service picks, for each meeting, a random photo you took yourself in the photo booth and shows it to the other person in a picture frame in the house (not with incognito, a blocked photo booth or reported photos, never in blind date). The photo’s ID is kept in memory only while the meeting lasts; nothing additional is stored. The photo itself stays in the photo booth as before. In the games inside the house (such as Taboo or “Who am I?”) words, guesses and answers only stay in memory while your meeting lasts and are not stored; in “Who am I?” we only send you your own word once you have guessed it or given up. So that interrupted meetings can continue, the mod tells the service whether you died, lost the connection to the world or left the server, whether you are currently ready (alive, not in combat) and, after a restart of the service, who you were last paired with — again only in memory, for at most five minutes, never in the database. Usually you both stay at spawn and only the two of you see the house; you then talk in a closed Simple Voice Chat group just for the two of you, whose name and password we create for each meeting and keep in memory only. Voice chat is carried by HugoSMP.net (opens in a new tab)’s Simple Voice Chat, not by Wink. The legal basis is the use of Wink (Art. 6(1)(b) GDPR), and for checking for warnings our legitimate interest in protecting players from harassment and scams (Art. 6(1)(f) GDPR). Camera in the Chat House (optional, off by default, Windows only): as long as we only enable the camera for selected players, we keep a list of their Minecraft names for this (and the UUID once the person joins the Chat House) until the team removes the entry; whoever is not on it uses the Chat House without a camera. If you pick “With camera”, we’d rather match you with people who have a camera (in memory only). If the other person has no camera, they can still see yours; whoever has no camera never sends a picture, and their webcam is never turned on. The camera picture only runs during the meeting inside the house, end-to-end encrypted through our server to the other person: we only pass on encrypted packets, can’t look at the picture and store or log none of it. There is no direct connection between the PCs; the other person does not get your IP address. Every picture starts heavily blurred and only turns clear once you both agree. If you report a camera, the meeting ends right away, and we store your account, the reported person’s account and Minecraft name, the reasons, your text, the time and a screenshot of the last picture you saw (for nudity, “looks too young” and unclear reasons only pixelated to 16 × 12 blocks — the clear picture then never leaves your PC —, otherwise at most 256 pixels wide). Only moderators and admins see the picture; the reported person’s camera stays off until the decision. If the team bans the camera, the reported person gets a notice with the duration and the reported reasons — never with the picture and without the name of whoever reported; the decision (cleared or banned, who on the team, for how long, a team note) is recorded in the moderation log, as is who the team adds to or removes from the access list; the team note, with its date but without any team member’s name, is also part of the banned person’s data export. We delete the picture 30 days after the decision, at the latest after 90 days, and the report 30 days after it was cleared or the ban ended, right away with your account; camera reports don’t count for the warning list. The legal basis for the camera is the use of Wink that you switch on yourself (Art. 6(1)(b) GDPR), and for camera reports and the access list our legitimate interest in protecting players from abuse and introducing the camera step by step (Art. 6(1)(f) GDPR).
Wink Canvas: When you place a pixel on the Wink Canvas (website or mod), we store the spot, the colour, your account, whether it came from the mod or the web, and the time. Everyone who can see the canvas sees your Minecraft name, your head and when you placed it when pointing at a pixel; the top list shows who placed how many pixels. How many pixels you placed per canvas, when first and last, and your place at the end are kept for the top list, achievements and the event charm. If you report an area, we store the area, reason, time and your account; the team then sees who placed which pixel there. If the team excludes someone from a canvas, we store the account, reason, who and when. 730 days after an event ends we remove the account from every pixel (the image, time-lapse and top list stay, without names at the pixels); decided reports are deleted 365 days after the decision. If you delete your account, your pixels stay in the image but without your account; participation and exclusions are deleted and your reports lose the reporter. Legal basis: Art. 6(1)(b) GDPR (using the canvas), for reports and exclusions Art. 6(1)(f) GDPR (protection against abuse).
Your own pictures for cosmetics (optional): For some cosmetics you can upload a picture of your own — a bandana design or a motif for the brooch, and as the leader of a clan with Wink Plus the motif of your clan banner. You can only upload PNG pictures of up to 256 KB in the size of the template, at most 5 in 7 days. We store the picture (rewritten without metadata, only the part that is visible), a fingerprint of its content (a checksum of the pixels and a checksum for similar pictures), your Winku account and the Minecraft account or clan it belongs to, when you uploaded it, the review status, the reason if it was rejected or blocked, who on the team decided and when, and whether others may adopt your picture; we also count your uploads in the last 7 days. The team sees every picture first; until it is approved only you see it on your character, everyone else sees the default design. If exactly the same picture has already been approved, yours counts as approved right away; if the same picture has been blocked before, we do not accept it, and if it is only similar to a blocked one, we show it to the team with that note. An approved picture goes to every mod with the list of cosmetics (see “Cosmetics”) and can be seen on your character on smp.winku.de (opens in a new tab) — the clan banner on every member of your clan who wears it, without showing who uploaded it. The clan banner only counts while whoever uploaded it is in the clan and has Wink Plus; otherwise it rests, and after 30 days of resting we delete it, as we do if the clan no longer exists. Anyone who has the same item can adopt your approved bandana or brooch design on your profile or in game: we then store a reference to your picture with their Minecraft account, who adopted it and since when. You can switch this off on your picture at any time; every adoption then ends. If the team blocks a picture, this applies to every picture with the same content, including other players’ pictures and adoptions. A blocked picture stays hidden for 14 days so you can appeal (with an open appeal until the decision), then it is gone; we keep the two checksums for a year without any link to you, so the same picture does not get through again. The team can block you from uploading your own pictures; we then store the reason, a team-only note, who blocked you, since when and until when. You can appeal once against an upload block or the block of a picture (we store your text, the decision with its reason, who and when) — someone other than the person who blocked decides. We delete blocks and appeals one year after they end or are decided. We delete rejected pictures right away and their entry after 30 days; replaced and deleted pictures right away. An approved picture stays as long as you have the item (or your clan has the banner) and goes with “Delete my picture” or with your account. Everything about your pictures is at smp.winku.de/account/cosmetics/images (opens in a new tab) and in your data export. You get a notification about approval, rejection, blocks and appeals. The legal basis is your consent (Art. 6(1)(a) GDPR) for uploading and adopting, and our legitimate interest in a safe platform (Art. 6(1)(f) GDPR) for the review, the checksums and the blocks.
Reporting cosmetics: You can report another person’s cosmetic — on their profile or in game in the player info. We store your Winku account, the reported Minecraft account, the item, what could be seen on it (the text or an identifier of the picture, at most 60 characters), the reason, whether you reported on the web or in game, when, and the team’s decision. If three different people report the same thing, we hide it for everyone until the team has decided; for this we store the person, the item, the content and since when. The reported person never learns who reported; they get a notification when their item is hidden, reset or shown again. To prevent misuse you can send at most 10 reports per hour; if you report the cosmetics of 6 different players within 24 hours or of 12 within 7 days, reporting pauses for you for 24 hours (the same pause as in ScamRadar), and the team sees a note. We delete open reports nobody has decided on after 90 days, and decided reports one year after the decision; a hiding ends when the person changes the content or no longer has the item. Deleting your account deletes your reports and the reports against your Minecraft accounts. The legal basis is our legitimate interest in a safe platform (Art. 6(1)(f) GDPR).
Clan look (Wink Plus): As the leader of a clan you can use Wink Plus to show your clan’s tag in your own colours (colour, second colour, style, effect) — for every player with the mod and on smp.winku.de (opens in a new tab), where hovering over it shows that it was set up with Wink Plus; nothing changes on HugoSMP.net (opens in a new tab) itself. For this we store per clan the chosen values, the tag, your account, your Minecraft UUID and Minecraft name, when you set it and since when it has been resting. Publicly we only show the look for the tag, never who set it. It only applies while you are in the clan and Wink Plus is running; otherwise it rests, and after 30 days of resting — or if the clan no longer exists — we delete it; with your account it is gone right away. The legal basis is the use of Wink Plus (Art. 6(1)(b) GDPR).
Show on laptop (picture from a link): Whoever uses the “Show on laptop” emote enters a link to a picture. We process your account, Minecraft name and UUID, the link exactly as entered (it can itself be personal data), its domain and, after a redirect, the target domain, a checksum (hash) and a similarity value of the picture, and the time. Our server fetches the picture; the site behind the link sees our server’s address, not yours. We create a re-encoded copy without metadata in two sizes and keep it for up to 30 days after its last use. Other players with the mod load the copy only from smp.winku.de (opens in a new tab), only near you and only while the emote runs. Whoever opens the large view sees the picture, your Minecraft name, the domain and the link and can open it after Minecraft’s confirmation; their browser then connects to the other site. To curb abuse, we store for 8 days when you loaded a new picture and whether the fetch worked (currently one new picture every 30 seconds, at most 40 a day and at most 10 failed fetches an hour). If you report a picture, we store the reason, the display (with the link and the Minecraft name of the person showing it), the time and your account; the team sees the report, not who reported. If three different people currently report the same picture, it is hidden for everyone for now until the team has decided. Blocked pictures are deleted and only checksums stay. The team can block you from the feature; we store the block with the reason, the period and who set it. Decisions by the team appear in the moderation log with team member, action and time, which we delete after 12 months. Retention: picture copies 30 days after last use (with an open report until it is decided), displays with link 14 days, decided reports 180 days, open ones 90 days, checksums of blocked pictures 365 days, blocks 365 days after they end. Legal basis: Art. 6(1)(b) GDPR (the feature) and (f) GDPR (protecting other players from unlawful content, fraud and abuse). Information and deletion are in your account.
Copycat (Wink Arcade event): If you play, the mod records your attempt to sing back a short sequence of notes during the recording time (voice chat is silent then), measures pitch and volume curve and sends the recording and the curves to us over an encrypted connection. We score the curves (points for melody, rhythm, timing and volume curve) and play the recordings to everyone in the room in the same round — you do not get the recording of anyone you have muted in voice chat, and the other way round. For this we process your Minecraft name, your UUID and your points in the room. All of this stays in memory only: recording and curve are gone after the round has been played back, right away when you leave the room, and the points when the match ends. The stage is only drawn by your mod; your real body stays where you joined and is invisible to bystanders (see “Players invisible to bystanders”). Figures: so that every mod can draw the figures on the stage, our service hands out the skin parts of everyone who is currently in a room without sign-in — limited to 120 requests per 10 minutes and IP address, which we only count in memory for this; the skin itself comes from Mojang as usual. Voice between the rounds: when nobody is recording or playing back, you hear each other in voice chat. That runs over Simple Voice Chat on HugoSMP.net (opens in a new tab), not over Wink; our service never receives these voices. Wink only issues, per room, the name and password of a closed voice group (the name of the game and four characters, such as “Copycat K7Q2”), and your mod creates or joins it; we only keep both in memory. The group name appears in the group list of Simple Voice Chat and is therefore visible to everyone on HugoSMP.net (opens in a new tab) who uses Simple Voice Chat; without the password nobody can join. Small groups: you can invite up to three others from your room into a small voice group (four including you at most); then you only hear each other. For this we keep in the room’s memory who belongs to which small group, who invited whom, when an invitation expires (after 30 seconds) and when you may invite the same person again after a decline (after 30 seconds, longer after further declines, at most after 5 minutes). Everyone in the room sees who is together in a small group; whoever is invited sees your Minecraft name. Muting, blocking, reactions: if you mute someone for this game only, you do not hear them in the voice groups, and you do not get each other’s recordings; the room only keeps this in memory until you leave. If you block someone (the mod asks first), we store that like any personal mute (voice and chat) until you lift it; our service also uses it to avoid putting you in the same room as long as someone else fits. Reactions (applause, laughing, fire, heart, amazed, thumbs up) are seen by everyone in the room at your figure for four seconds at most. Except for blocking, none of this is stored in a database or in logs. Reporting: you can report other players as anywhere else (place “Copycat”, see “Reports”); voices from the game’s voice groups can be part of the evidence replay of your report, like any voice your mod hears. With a level-3 warning you cannot take part, because you hear the voices of strangers there. Custom audios: sometimes Copycat plays a clip uploaded by admins instead of a computed sequence of notes (they confirm that they have the rights to it) or one the team accepted from players’ submissions (see “Copycat: sounds from players”). Then your mod downloads it from us before the game (with your credential) and keeps it on your PC under “config/scamradar/papagei-audio” (200 MB at most, what has not been used for a long time is dropped); we only learn which clips your mod has finished loading. What we store are the clips themselves (as Ogg and WAV) with name, category, length, time and the Winku account of the admin who uploaded it — for an accepted sound from a player also the account it comes from —, until it is deleted; we do not keep the file the admin picks, only the trimmed excerpt. The team can add a preview image to a clip (a frame from the video of the excerpt in Klippo, or an uploaded picture); we store it shrunk and without metadata next to the clip, the mod fetches it from us, all players see it on the stage, and it is deleted with the clip. Whoever uploads, changes, switches on or off or deletes in the team appears in the moderation log with account, action, clip and time, which we delete after 12 months. Otherwise we only store the state of the event (on or off, period, rounds, places, who changed it last). The legal basis is the use of Wink, which you choose yourself by joining (Art. 6(1)(b) GDPR), and for the check for warnings and the log of the audios our legitimate interest in safe interaction and in traceable work in the team (Art. 6(1)(f) GDPR).
Copycat: sounds from players (optional): Signed in and with a linked Minecraft account you can submit your own sounds for Copycat on smp.winku.de/copycat/submit (opens in a new tab). Your browser sends the audio file with the part you picked, a preview image, the title and your confirmation that you hold the rights to it. We trim the sound, even out its volume and store it as Ogg Opus and as WAV, plus measurements (length, pitch and volume curve); we rewrite the image as a 320 × 180 pixel WebP without metadata (location, camera, software and the like are dropped). We do not keep the files you select. For every submission we store your Winku account, the title, the length, when you submitted it, the review status and, once decided, when, who on the team and for what reason. To slow down abuse we store for 8 days when you submitted something (currently at most 3 submissions in 24 hours, rejected and withdrawn ones count too, and at most 5 in review at the same time). With a ScamRadar warning of level 2 or higher, or if the team has blocked you, you cannot submit; we store a block with its reason, its end and who set it until it ends or is lifted. The moderation team listens to every sound and looks at every image before anyone else gets to see or hear them. If it accepts your sound, it joins the pool of the games: the other players’ mods download sound and preview image like the team’s clips (see “Copycat (Wink Arcade event)”), and in the round as well as for signed-in visitors on smp.winku.de/copycat/sounds (opens in a new tab) the title and your Minecraft name are shown with it. If it rejects it, we delete sound and image right away; you still see title, reason and times for 30 days, then we delete those too. If the team switches off an accepted sound, we delete it after 30 days unless it is switched back on. You get a notification about every decision. If you withdraw a submission, whether it is still waiting or already in the game, we delete sound, image and entry right away; only the count used to slow down abuse stays until its period ends. Reporting: you can report any sound in the game in the Copycat bar (“⚑ Sound”) or on smp.winku.de/copycat/sounds (opens in a new tab). We store your Winku account, the sound, the reason, your optional text, when and whether you reported in game or on the web; for this the mod only sends the sound’s identifier and the reason with its credential. Whoever submitted a sound never learns who reported it. If currently 3 different people report the same sound, we take it out of the pool for now until the team has decided; whoever submitted it gets a notification. You can currently send at most 10 reports in 24 hours. We delete decided reports 180 days after the decision, and all reports about a sound together with the sound. Who submitted, withdrew, accepted, rejected, switched off or blocked something is in the moderation log with account, action, sound and time, which we delete after 12 months. All of this is stored on our server with the service’s data and in its backups. Your submissions, reports, any block and the times of your submissions appear in your data export; if you delete your account, we delete your submissions with their sounds and images (accepted ones too), your reports and the reports about your sounds. The legal basis is your consent (Art. 6(1)(a) GDPR) for submitting and for showing your Minecraft name with the sound — you withdraw it at any time by withdrawing the submission — and our legitimate interest in a safe game without infringements (Art. 6(1)(f) GDPR) for the review, the limits, the blocks, the reports and the log.
Players invisible to bystanders (Chat House, Wink Karaoke, Copycat, WINKHUB): whoever takes part in one of these modes leaves their real body standing in the game and is only elsewhere in their mod. So that nobody sees them standing around there, the other players’ mods hide their body with name tag, their voice from nearby and their entry in the “Nearby” list. For this, as long as you play on HugoSMP.net (opens in a new tab) – even without a linked account – your mod sends, on every change and at most once per second, the Minecraft UUIDs of up to 80 nearest players within 128 blocks to smp.winku.de (opens in a new tab) and only gets back those who are currently in one of these modes — never a list of everyone. As with every request we briefly process your IP address, without storing it for this. We only keep the UUIDs you send in memory; we do not store them. If no answer comes, everyone is visible again after a few seconds. The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Klippo (program for custom Copycat audios, admins only): Klippo is a PC program with which admins trim and upload clips for Copycat. What Klippo does on the PC and what it downloads from other providers is described in its own section (15p), visible to admins; this paragraph describes what happens on smp.winku.de (opens in a new tab). If you connect Klippo (you confirm a code in the browser on smp.winku.de (opens in a new tab) for this), we store per program: your account, the device name Klippo gives (such as the PC name), when you connected and when Klippo was last used, and of the program’s credential only its SHA-256 checksum, never the credential itself. The credential is valid for 30 days after last use and 180 days at most after connecting; you disconnect Klippo in the program, and any admin can disconnect it on the team page. The code of an open pairing only stays in memory for 10 minutes. Every upload checks again on our side that you are still an admin and have access. The connected programs (device name, time of connecting, last use, without the checksum) appear in your data export and are deleted when you delete your account. For every uploaded clip we also store its source: “programm” or, for a YouTube link, “programm:youtube:” with the video ID. If you removed music or background noise beforehand, “:gefiltert” (German for “filtered”) is added after the source; we store nothing more about it. The moderation log (12 months) shows account, clip, program and device name for an upload, and likewise for connecting and disconnecting. Klippo processes the files on your PC; only the selected excerpt comes to us, plus, on request, a preview image (a frame from the video of the excerpt, or a picture file from you). Your PC also removes music and background noise itself: the sound never leaves it for this. The first time you switch on “Remove music”, Klippo downloads the model for it once from GitHub (only if the checksum matches); GitHub learns your IP address this way, we do not. If you enter a YouTube link, your PC connects directly to YouTube (Google) and, the first time, to GitHub to download the tool yt-dlp (Klippo only accepts it if the checksum matches); these providers learn your IP address this way, we do not. On request, Klippo also downloads a small video track (480p at most) from YouTube; the length of the video is not limited. Klippo keeps the audio tracks, video tracks and waveform overviews in a cache on your PC for up to 14 days and at most 8 GB, oldest first; you can delete it in the settings, and we see none of it. Klippo does not copy your own video files, it only reads them. If the Microsoft Visual C++ runtime is missing on your PC, Klippo asks first and then downloads Microsoft’s official installer once (via aka.ms from the servers of Microsoft); Microsoft learns your IP address this way, we do not, and Microsoft’s terms apply. The legal basis is our legitimate interest in safe uploading for admins only and in traceable work in the team (Art. 6(1)(f) GDPR).
WinkuStore (PC program that installs the Wink mod; not public yet, only for admins and accounts with a beta or dev role): The WinkuStore can put the Wink mod into your Minecraft profiles. To do this, it only reads, locally on your PC, the profile lists of your launchers (NoRisk Client, Modrinth App, Prism Launcher and MultiMC, CurseForge, the official Minecraft launcher with its .minecraft folder); this information does not leave your PC. The store downloads the mod from smp.winku.de (opens in a new tab) and checks signature, checksum and size. For beta and dev versions you connect the store to your account once (you confirm a code that the store shows you in the browser at smp.winku.de/winkustore/connect (opens in a new tab)). We then store per connected store: your account, the device name, when you connected and when the store was last used, and of the store’s credential only a checksum, never the credential itself. When it asks for versions, the store sends its credential and a random installation ID; it is used to roll versions out gradually. A store that asks for nothing for 30 days has to be connected again; a connection is valid for 180 days at most. Connecting and disconnecting are recorded with your account and the device name in the moderation log (12 months). You can disconnect the store at any time in the store itself or at smp.winku.de/winkustore/connect (opens in a new tab). The connected stores appear in your data export and are deleted when you delete your account. The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Downloading the Wink mod: If you download the Wink mod via smp.winku.de (opens in a new tab) (also with the WinkuStore), smp.winku.de (opens in a new tab) first checks whether you may get the file and then redirects you to a short-lived, signed address at files.relvia.de (opens in a new tab). The file is delivered by our relay server at OVHcloud (Frankfurt am Main, Germany); the files themselves are kept on a Storage Box of Hetzner Online GmbH (Germany), which the relay retrieves them from. Hetzner only sees the relay, not you. The relay sees your IP address only for the transfer. Its access log contains the time, file, status, amount of data and whether the file came from the cache — without your IP address and without the signature in the address. If the relay reports an error, the error message may contain your IP address and the requested address. We delete the log and error messages after 14 days at the latest; the same applies to the programs (section 2a, “Program downloads”). The mod’s auto-update still comes directly from smp.winku.de (opens in a new tab). The legal basis is the use of Wink (Art. 6(1)(b) GDPR) and, for the secure operation of the delivery, our legitimate interest (Art. 6(1)(f) GDPR).
Announcements when something is unlocked (bell and mod): if we unlock a game mode or an event and you can play it as a result, you get one announcement in the bell on smp.winku.de (opens in a new tab) and in the mod. So that each announcement only comes once, we store per account and unlocking when it was delivered in the bell and when in the mod. We delete this 30 days after the unlocking has ended, and straight away with your account; it is listed in your data export. For this the mod asks us with your credential at start and when something has changed what you can play right now, and reports back which announcements it showed you. Whether an announcement comes to you depends on data we already have (your account, whether you are an admin, whether your Wink Plus is running, since when your account exists). You switch announcements on or off on smp.winku.de (opens in a new tab) under Notifications or in the mod under Options → Display — overall, only for events or only for game modes; the choice is part of your mod settings on your account and stays until you change it or delete your account. The history of unlockings, the templates of the announcements and the list of who switched something show team accounts only; when a team account is deleted, this is cleared there. The legal basis is the use of Wink (Art. 6(1)(b) GDPR), and for the team history our legitimate interest in traceable administration (Art. 6(1)(f) GDPR).
Spooky lobby (Halloween): If the team switches it on, night falls in the lobby now and then, and a scary figure appears in the distance that gives you a fright once. Only your mod draws this; the server and other players notice nothing. So the jump scare only happens once, we store the time it was shown to you with your account and delete it after 120 days or with your account; without a linked account only your mod remembers it, on your PC. Whether you want to see jump scares is set in the mod under Options → World. The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Boss bar filter (mod): The mod can hide advertising in the boss bar of HugoSMP.net (opens in a new tab) for you. For this our market bot reads the boss bar texts the server shows everyone and sends them to us; per text we store the wording (numbers as placeholders), how often and when we first and last saw it, and whether it is an ad, information or an event; if the team changes the classification, we store who and when. A boss bar may in rare cases contain a player name — it then appears in that text as shown. We delete texts we have not seen for 180 days. Which boss bars you have hidden and your own filter words are part of your mod settings on your account; hiding only happens on your PC, and notices such as a restart are never hidden. The legal basis is our legitimate interest in making advertising recognisable and switchable (Art. 6(1)(f) GDPR), and for your settings the use of Wink (point b).
Wink in the lobby: The first time you shake hands with the “Wink” figure in the HugoSMP lobby, we store your Minecraft account (UUID) and the time with your Winku account if your mod is linked – so the surprise only happens once per person – and unlock the “Wink figure” charm for you (see “Cosmetics”). Without a linked account the mod only remembers this on your PC (file winkfigur.json in the mod’s folder) and reports it once you link it. Everything else – waving, handshake, the animation – happens only in your game; none of it is sent to the HugoSMP server. The entry stays as long as your account exists, is included in your data export and is deleted with your account. The legal basis is the use of Wink (Art. 6(1)(b) GDPR).
Game servers: Some Wink games run on their own Minecraft servers (section 2a) – currently Nebelflucht (formerly “Dead by Minecraft”; one killer against four survivors) and Hide and Seek (the hiders are blocks, the seekers hunt them); more games may follow. You can also reach Hide and Seek directly through a server address of its own. There is also the Minecraft network WinkuGames, with a public lobby that is open to everyone; what is stored there is described in Section 2a. Reports from WinkuGames and the games also end up in the moderation area on smp.winku.de (opens in a new tab), where the team handles them (Section 2a). While we are testing, you can only get into these games if we have added your Minecraft account to the whitelist; for that, your Minecraft name and UUID are listed on the game server until we remove you again. When you join, your Minecraft game sends your Minecraft name, your UUID and your skin, as it does on any server; the server checks with Mojang or Microsoft that the account is yours. In Nebelflucht, in Hide and Seek and in the WinkuGames lobby, your game also downloads a resource pack of its own from the web server of the game servers. Like any Minecraft server, the game server keeps technical game data for your UUID (such as where you last were, your inventory and the Minecraft statistics) and remembers which name belongs to which UUID; this data stays as long as the game server in question exists. In a round, the other players in your round see your name, your skin, your role and what you do in the game. There is no chat in Nebelflucht or in Hide and Seek. If you leave a running round of Nebelflucht, you can’t join a new one for 5 minutes; the game server only keeps this in memory. Player stats (Nebelflucht only): Once you have played a round of Nebelflucht, we keep stats for your Minecraft account – your UUID, the Minecraft name we last saw, your bloodpoints in total and per category, how many rounds you have played (in total, as killer and as survivor), your wins and escapes, how often you were eliminated as a survivor and when you last played. We use them to show you your points and your stats after every round; bloodpoints are just points, you can’t buy anything with them. We don’t store IP addresses, individual events from the round or locations in the stats, and never bots (for the recording of the round, see Section 2a). The stats are kept only on the game server you played on and are deleted automatically 365 days after your last round. Round stats (also Nebelflucht only): The Nebelflucht game server also writes one line per round so that we can balance the game fairly, look at the games over time and spot who often leaves rounds early: the time, the map, the result and why the round ended, the duration, the generators completed and, for each participant, the Minecraft name, the role (killer with their power or survivor with their class), whether it was a bot, whether they left the round, how it ended for them (for example escaped or eliminated) and how often they were hooked. We keep these round stats as long as the game mode exists or until you ask us to delete them; there is no fixed deletion period for them. Neither is linked to your Winku account, so they are not part of the data export under “Account”; you can get access on request at [email protected], and if you ask, we will delete your player stats and remove your name from the round stats earlier. Hide and Seek: We keep neither player stats nor round stats here. Your points and your role (hider or seeker) exist only until the end of the round, in the memory of the game server; at the end of the round everyone in the round sees a results list with names, points and roles, and afterwards none of it is stored, except in the recording of the round (Section 2a). The legal basis is the use of Wink (Art. 6(1)(b) GDPR), and for the round stats our legitimate interest in fair, well-balanced games (Art. 6(1)(f) GDPR). The game servers run on our server in Nuremberg and are reached through our relay server at OVHcloud (Section 2a); apart from netcup and OVHcloud as our processors, only Mojang or Microsoft are involved, when your account is verified.
Party in the lobby: When you invite friends in the Nebelflucht lobby or accept an invitation, we do not store it permanently. Who is in a party with whom, who invited whom, whether you are in the lobby right now and the spam-limit counters are kept only in the working memory of smp.winku.de (opens in a new tab) and are gone at the latest 10 minutes after an invitation, shortly after leaving the party (after 2 minutes if your connection drops) or after a restart. Your mod tells the game server only the Minecraft UUIDs of your party members so you get into one round together; the game server keeps them only while the lobby is running. The invitation also appears as a card in your messenger history and with the invited person. You can only invite mutual friends. The legal basis is the use of the feature (Art. 6(1)(b) GDPR). You cannot switch it off separately – just don’t invite anyone. If you are “invisible” in the messenger or have turned it off, you get no invitations.
Voice recordings for Nebelflucht: Anyone we allow to do so can record voices for the survivors in Nebelflucht on smp.winku.de (opens in a new tab) or upload them as a file – only after giving explicit consent before the first recording. The voices belong to the survivor characters (currently Mara, Jonas, Lena and Rosa); each character is voiced by exactly one person whom we assign. For this we store which character you voice, who assigned you and when. In the game your recordings are heard for everyone who plays this character – players and bots alike. The assignment ends when we change it, withdraw your permission, you revoke your consent or you delete your account. We store the recording as it arrived (30 seconds at most) and the processed version, plus your Winku account as its author, when you recorded and selected it, when you consented and to which version of the consent text, and your permission (account, display name, who allowed you and when). This is kept on our server in Nuremberg (netcup). We keep at most six recordings per sound and delete older ones; you can withdraw a recording or delete it for good. The game server (also on our server in Nuremberg, Section 2a) collects the current recordings every minute, processes them and builds them into the resource pack; the raw file and the processed sound stay there as long as the recording is in use. To build the pack, this state is also kept on a Winku computer in Germany and replaced there the next time the pack is built. With the resource pack, all Nebelflucht players receive your voice, hear it in the game and store the pack on their device. We record new recordings, withdrawals, consent and revocation in the moderation log (365 days). The legal basis is your consent (Art. 6(1)(a) GDPR). You can revoke it at any time on the same page, even if you are no longer allowed to record: we then delete all your recordings immediately, and the processed sounds and the copies on the game server usually within one or two minutes – which also removes them from the game. An older version of the pack may stay in the Minecraft cache on players’ devices until they load it again; a deleted recording stays in our backups as described in Section 2a until they expire (30 days at most). The data export under “Account” lists your recordings (which sound, length, format, when recorded, whether it is in use or withdrawn), your consent (time and version of the text), your permission and which character you have voiced since when; the sounds themselves are included as a link to listen to and save them, which works as long as you may use the page – otherwise you can get them on request at [email protected]. “Delete everything” and deleting your Winku account remove your recordings, your consent and your permission just like revoking your consent. On the same page you can listen to models from Dead by Daylight: only when you click ▶ on one does your browser load the file directly from GitHub (raw.githubusercontent.com (opens in a new tab); GitHub Inc., a Microsoft subsidiary, USA) – not when the page loads. GitHub learns your IP address and the usual details your browser sends, but not which page you came from; these files never pass through smp.winku.de (opens in a new tab), and we store nothing about it. This involves a transfer to the USA; GitHub Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). The legal basis is our legitimate interest in giving speakers an example to listen to without distributing third-party sounds ourselves (Art. 6(1)(f) GDPR).
Real-time games on the game server: Besides the Minecraft servers, the real-time part of Wink games can also run on our game server (section 2a) – currently Plank Drop; more games may follow. Depending on load, a game runs there or, as before, on our server in Nuremberg. If it runs there, your mod gets a ticket for the game from our service at smp.winku.de (opens in a new tab), signed by us and valid for 60 seconds at most, and uses it to connect directly to the game server. The ticket contains your Wink account number, your Minecraft UUID, your Minecraft name, the room of the game and whether you are playing or watching. Only for as long as the game lasts, the game server processes this information, your inputs in the game, the game state and technical details of the connection. It only needs your IP address for the connection; it does not write it into the game server’s log (when the connection is set up, the web server in front of it only logs a shortened IP address, see Section 2a). All of this is kept in memory only and is gone after the game; the game server does not store any of it permanently. Its log contains only numbers of rooms and accounts, errors and load figures, no names, and is deleted after 14 days at the latest. The result of the game (for example winner and final score) is sent back by the game server to our server in Nuremberg, together with your inputs and the connection measurements from which the recording for reports is made; we store it there as described for the game in question (for example under Plank Drop). The legal basis is the use of Wink (Art. 6(1)(b) GDPR). For the relay server at OVHcloud and its filter against overload attacks, see Section 2a.
Purpose and recipients: Sign-in, linking, the mod, settings, your own reports and objections, the balance, bank and games of Wink Arcade as well as trophies and best scores serve the use of Wink (Art. 6(1)(b) GDPR); showing whether you are online on HugoSMP.net (opens in a new tab), showing your Minecraft name, head and badge in the leaderboards (also on the achievements showcase in the game, there with your Wink Arcade wins if you are visible in the lobby, or your podium places in the title games) and the player directory are based on our legitimate interest (see above); you can object to showing whether you are online at any time by switching it off. Outside Winku, the recipient is Mojang AB or Microsoft (proof of the Minecraft account, names and skins; their privacy notices also apply); in the cases described above also Twitch (your channel’s public ID when you apply as a creator), Discord (your Discord ID and roles via WinkuBot), YouTube or Google (your IP address and details about browser and device if you have turned on the YouTube player in the lounge cinema) and the HugoSMP.net (opens in a new tab) server (payments and the commands the mod sends there on your behalf) as well as the HugoSMP.net (opens in a new tab) server management, which gets access to the Wink Arcade settlement records (games, stakes, winnings and fees per player, see “Wink Arcade settlement with HugoSMP.net (opens in a new tab)”); what other signed-in accounts see is described above. Wink runs on our own server in Germany and is delivered via Cloudflare, the game servers also on our server, reached through our relay server at OVHcloud (Section 2a), the bank bot on a Winku computer in Germany; backups as described in Section 2a.
Access and deletion: Under “Account” you can download everything Wink stores about your account, including the balance, ledger and games of Wink Arcade as well as your trophies and best scores, and delete it with “Delete everything”: links, passes, settings and notices are removed immediately, as are the entries of your Minecraft accounts in the player directory (if the market bot sees you again, a new one is created — the objection helps for good, see “Player directory and name suggestions”), as are the balance account, ledger, deposits and withdrawals, record and settings of Wink Arcade as well as your trophies and best scores. Your reports remain until the end of their period so that warnings do not disappear, but without any link to your account: they then count together as one anonymous reporter, and evidence showing you (such as your position in the log) goes when the report goes. Decided objections remain until the end of their period, and your games remain for the opponent until the end of their period, both without any link to your account. Entries in the moderation log that concern your account stay until their period ends (365 days) as a record of how the team decided; we also note there when you deleted your data. If you still have a balance of $2 or more, a withdrawal on its way, a game running, an open trade or a frozen report deposit, withdraw or finish it first; a remainder under $2 can no longer be withdrawn and is lost on deletion, and a running Wink Plus ends without a refund. If you delete your Winku account on winku.de (opens in a new tab), we delete the Wink data in the same way along with it, and the data export on winku.de (opens in a new tab) includes it too; if there is still a balance of $2 or more, a withdrawal on its way, a game running, an open trade or a frozen report deposit at Wink, the Winku account can only be deleted once you have withdrawn or wrapped everything up.

Hide and Seek passes: You buy and use Seeker and Hider Passes (see the Terms) only on the game server. For this, the game server asks smp.winku.de (opens in a new tab) how many belong to your Minecraft account and reports there when you buy one, when a pass worked and when it is returned after a cancelled round. Only your UUID, the kind of pass and an ID of the round are sent, signed and only between our servers; your Minecraft name is not. On smp.winku.de (opens in a new tab) we store for your Winku account how many passes of each kind you have, and every purchase, use and return with its time (for use and return with the UUID and the round ID); a purchase is also booked like any other purchase with your balance. Which pass you switched on for the next round is only kept in the game server’s memory until the round starts or you leave the server. No stats about your rounds come out of this. Your passes and their history are part of your data export and are deleted with your Winku account; the legal basis is the use of Wink (Art. 6(1)(b) GDPR).

15rShowdown — Minecraft tournament with a prediction game#

Showdown (sd.winku.de (opens in a new tab)) is the website of a Minecraft tournament: teams, winners, an archive of past tournaments, the team behind the tournament, partners and a prediction game in which you predict the winning team before the tournament starts. You can read the pages without signing in.
Sign-in: To make a prediction, apply for a tournament, edit your profile or use the admin area, sd.winku.de (opens in a new tab) signs you in with your Winku account; winku.de (opens in a new tab) hands over your account ID, your display name, the address of your profile picture, – if your account is linked to Twitch – your Twitch ID and Twitch name and – if your account is linked to Discord – your Discord ID and Discord name (for applications, see below) via a single-use ticket valid for 60 seconds. Showdown does not receive your email address. Using the Twitch ID, Showdown links your Winku account to an entry it already had for you from the time when you signed in there directly with Twitch (until April 2026). Whether your account may use Showdown is checked with winku.de (opens in a new tab) using your account ID when you sign in and afterwards at most every five minutes. When you sign in, sd.winku.de (opens in a new tab) sets a session cookie (“sd_sitzung”) containing a random ID; it lasts until you close your browser or sign out, and a sign-in lasts at most 24 hours after your last visit. It is technically necessary (Section 25(2) No. 2 TDDDG). With “Sign in with Twitch”, winku.de (opens in a new tab) starts signing you in via Twitch if you are not yet signed in there; the section on signing in with Twitch applies. If you are already signed in to winku.de (opens in a new tab), sd.winku.de (opens in a new tab) signs you in without a click on your first visit in a browser session by redirecting via winku.de (opens in a new tab). So that this happens only once and not right after you sign out, sd.winku.de (opens in a new tab) sets the cookie “sd_sso” containing only “geprueft” or “abgemeldet”, with no reference to you; it is deleted when you close your browser and is also technically necessary.
What is stored: for your account your display name, a username, your Twitch ID and your Discord ID and Discord name (if linked), a copy of your profile picture on our server, the name colour and the social media links you enter (in your profile or with your application), your Minecraft name with Minecraft ID (if you have applied), your prediction per tournament (team, time; moved to an archive once the next tournament is announced), your team memberships and wins, for members of the Showdown team their role and rights in the admin area, and a log of changes to your profile and of work in the admin area. Display name, profile picture, name colour, links, Twitch name, teams and wins of everyone who plays in a tournament or belongs to the Showdown team are publicly visible, and on the teams page also the Minecraft name with the head of the skin. Predictions are not public.
Players without an account: the Showdown team adds the participants of a tournament by their Twitch name. For this our server retrieves the public profile via the Twitch API (Twitch ID, name, display name, profile picture) and stores a copy of the profile picture on our server. The legal basis is our legitimate interest in running and presenting the tournament (Art. 6(1)(f) GDPR). The provider is Twitch Interactive, Inc., USA; only the Twitch name searched for is transmitted.
Profile pictures: Showdown copies profile pictures from Twitch, winku.de (opens in a new tab) or Discord to our server; your browser loads them only from sd.winku.de (opens in a new tab). If your Winku account is linked to Twitch, Showdown retrieves your current Twitch profile picture via the Twitch API when you sign in and once per browser session; only your Twitch ID is transmitted.
Applications: at sd.winku.de/apply (opens in a new tab) you can apply for a tournament – also directly via a form of the Showdown bot on Discord –; your Twitch and Discord accounts must be linked to your Winku account and you must be on the Showdown Discord server (the website asks the Showdown bot and stores yes/no). We store the tournament, your age (only as a question, there is no age limit), your answers (why you want to take part, preferred team, anything else), your Minecraft name with Minecraft ID, when you submitted and last changed the application, its status (open, accepted, declined, substitute – then also since when –, dropped out), who decided and when, the team's message to you if declined, your team, and metrics of your Twitch channel: follower count, partner or affiliate status, channel creation date, views, date and duration of your last 20 public VODs (from which we calculate average views and the number of streams and hours in the last 30 days), the category and language you last streamed, whether you are live and with how many viewers, and the channel's name and profile picture. Our server retrieves these metrics via the public Twitch API (only your Twitch ID is transmitted): when you open the application page with Twitch linked (then kept in your session for at most 30 minutes), when you submit, and about every six hours afterwards while the tournament is the current one. Whether your Minecraft name exists is checked by our server with Mojang (Mojang AB / Microsoft Corporation, USA) via their public API (only the name or Minecraft ID is transmitted); this returns the correct spelling, the ID and your public skin, from which our server draws a front view and the head and stores them on sd.winku.de (opens in a new tab) (the response is kept for 10 minutes). Applications are not public: they are seen by the Showdown admins in the admin area of sd.winku.de (opens in a new tab) and by members with an admin role in the non-public applications channel of the Showdown Discord server (Discord Inc., USA), where the Showdown bot posts them with name, profile picture, Twitch and Discord name, age, answers, metrics and status; decisions can also be made there. If you are accepted, the bot gives you the participant role on the server and, once you are assigned to a team, your team's role, which lets you see your team's voice channel, and as a substitute the substitute role – in each case only once the teams have been published on sd.winku.de (opens in a new tab); when this no longer applies, it removes the roles it gave you. For this, Showdown stores which role the bot gave to which Discord ID until it has removed it again (even after your entry is deleted), and whether your Discord ID is on the server. If enabled, the bot sends you a direct message about the decision (also as a substitute, when moving up and when dropping out) and your team. The legal basis is processing your application (Art. 6(1)(b) GDPR).
Prize draw: the prize draw for the prediction game is organised by the organiser named in the terms of participation on sd.winku.de (opens in a new tab), not by Winku. If you win, they will contact you via Twitch or other publicly stated channels; payout details are exchanged only between you and them.
External content: your browser only loads the explainer video on the start page (YouTube, Google Ireland Limited) and the confetti effect on the winners page (jsDelivr) if you choose “Accept all” in the banner on sd.winku.de (opens in a new tab) (Art. 6(1)(a) GDPR); your choice is stored only in your browser (local storage) and can be changed there at any time. Fonts and icons are served by sd.winku.de (opens in a new tab) itself.
The legal basis for everything else is the performance of the user relationship (Art. 6(1)(b) GDPR).
Retention and deletion: Showdown deletes an application 90 days after the tournament has been set to finished or cancelled, immediately if you withdraw it (possible until a decision has been made), and together with your entry; the bot then overwrites its message in the applications channel without any details about you. Your Minecraft name and ID on your entry and the skin images are kept until you delete your entry or enter a different Minecraft name. Your Showdown entry with predictions, archive, team memberships and rights is kept until you delete it – in your profile on sd.winku.de (opens in a new tab) (“Delete my Showdown entry”) or by deleting your Winku account, in which case winku.de (opens in a new tab) deletes it as well. This also deletes your profile picture and the log entries about you; log entries about work in the admin area remain without any reference to you. Teams, tournaments and winners remain; only your membership is removed. You can get a copy of your Showdown data in your profile on sd.winku.de (opens in a new tab) or under “Your data” on winku.de (opens in a new tab).

15wStream overlays (overlay.winku.de (opens in a new tab))#

At overlay.winku.de (opens in a new tab) we provide overlays that streamers add to OBS as a browser source – for example an animated intro (overlay.winku.de/bytobi/ (opens in a new tab)) and a “Stream Starting” screen (overlay.winku.de/bytobi/starting/ (opens in a new tab)). The pages consist only of static files (HTML, JavaScript, fonts), delivered by our server in Nuremberg (netcup) via Cloudflare (section 2a). They set no cookies, need no Winku account, have no forms and store nothing in your browser. Music and sounds are generated by the page itself in the browser; nothing is loaded for them. What an overlay should currently show (such as the intro or a break) it fetches from our server as a state that contains no names. Requests for the pages appear in the server log like everywhere else (section 2, 14 days at most). The legal basis for delivering the pages is our legitimate interest in providing the overlays (Art. 6(1)(f) GDPR).
Live chat in the overlay: Some overlays show the channel’s public Twitch chat. For this, the browser that opens the page – usually the browser source in the streamer’s OBS – connects to these providers directly and on its own, not through our server: Twitch (Twitch Interactive, Inc., USA; chat anonymously via WebSocket at irc-ws.chat.twitch.tv (opens in a new tab), without signing in, read-only; images from static-cdn.jtvnw.net (opens in a new tab)), 7TV (7tv.io (opens in a new tab), cdn.7tv.app (opens in a new tab): emotes, name colours and paints), BetterTTV (api.betterttv.net (opens in a new tab): list of emotes), FrankerFaceZ (api.frankerfacez.com (opens in a new tab), cdn.frankerfacez.com (opens in a new tab): emotes) and ivr.fi (api.ivr.fi: Twitch badges). These providers see the browser’s IP address; their privacy policies apply. The BetterTTV emote images are fetched by our server on the browser’s behalf from cdn.betterttv.net (opens in a new tab): BetterTTV only sees our server, not the browser, and we do not write these requests to the server log.
What the overlay shows: It displays the public chat messages with the display name, just as they are visible to everyone on Twitch anyway. The messages are kept only in the browser’s memory while the page is open and are gone afterwards. Nothing from the chat reaches us, and we store none of it.
Overlay control: At overlay.winku.de/bytobi/control (opens in a new tab) the streamer and the mods they add there switch what the overlay is showing. You can only sign in with your Winku account via Twitch (sections 4 and 15a; if you don’t have one yet, winku.de (opens in a new tab) creates it along the way). winku.de (opens in a new tab) then passes your account number, your name and the ID and login of your Twitch account to the control panel; our server looks up your display name and profile picture at Twitch with an access of its own, without using your Twitch account. The control panel sets two strictly necessary cookies: “ovl_state” only while you sign in (10 minutes, protects against forged sign-ins) and “ovl_sitzung”, which keeps you signed in for 30 days (signed, HTTPS only, not readable by scripts; it contains your Twitch ID, login, name, the address of your profile picture and your account number); signing out deletes it. The page loads profile pictures directly from Twitch (static-cdn.jtvnw.net (opens in a new tab)), so Twitch sees your IP address. When the streamer searches for a mod, our server sends the name entered to Twitch.
What the control panel stores: For each channel, our server in Nuremberg keeps the list of mods (Twitch ID, login, display name, address of the profile picture, since when and added by whom), the current state including who switched it last, and a history of the last 100 actions (who, when, what: mode switched, mod added or removed); older entries drop out. We also remember the Twitch ID of the channel owner. Only the streamer and their mods can see this; public – for the overlay – is only the state, without names. On every sign-in the service writes a line with Twitch login and account number to its log (if access is refused, also the Twitch ID), and likewise for every switch and every change to the mod list (who, what, for mods their login and ID); IP addresses are not in it. The log is overwritten continuously (100 MB at most). The control panel’s data is included in the backups described in section 2a.
Legal basis and deletion for the control panel: We need the sign-in, session, mod list and state so that you can use the control panel (Art. 6(1)(b) GDPR); the history and the log let us trace who switched what and detect misuse (Art. 6(1)(f) GDPR). The control panel keeps mods by their Twitch ID, not by Winku account: if you delete your Winku account, an entry as a mod therefore stays until the streamer removes you or you write to us – then we delete it (section 16). History entries drop out after 100 newer actions.