Privacy

This is a translation for your convenience. Only the German version is legally binding.

1. Controller

The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

There is no data protection officer, as there is no obligation to appoint one. Please address all questions to the email address above.

2. Overview

• No tracking, no analytics tools, no ads, no social media plugins.
• Fonts and scripts are delivered by our own server, nothing comes from third-party CDNs.
• Every user sees only their own characters. In the app the admin sees only who uses EveCrew (including the names of the linked characters) and whether they paid.
• Data is not sold, exported or passed on to third parties, except to the parties named below, as far as this is technically necessary.

3. Hosting

EveCrew runs on our own server (Kubernetes/k3s) in Germany, operated in the data centre of WilMa Digital GmbH. All data named below is stored there.

4. Visiting the website and server logs

On every visit the web server processes technically necessary data: IP address, time, requested address, status code, amount of data transferred, referrer and browser identifier (user agent). Errors of the application are logged with time and error message.

The purpose is secure and stable operation, for example to detect faults and attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the security and functioning of the service. The logs are kept only for a short time and rotated automatically; they are only analysed in case of faults or abuse.

5. Login with EVE Online (EVE SSO)

The login runs through the single sign-on of CCP hf., Reykjavík, Iceland (provider of EVE Online). You sign in on CCP's page, EveCrew does not learn your password. CCP's privacy policy applies to the login there. Iceland is part of the European Economic Area, the GDPR applies there as well.

After the login CCP transmits to EveCrew, and we store:

• character ID and character name
• the owner hash, by which we recognise a change of the character's owner
• the permissions (scopes) you granted
• an access and a refresh token with expiry time; we store both tokens encrypted

Your EveCrew account itself consists only of a name (that of the first character), a remember token for "stay logged in", the language if you chose it with the language switch, and the times of creation and last change. We do not store an email address or a password.

The legal basis is Art. 6(1)(b) GDPR (providing the service you want to use).

6. Data from the ESI

With your tokens EveCrew fetches data of your linked characters every 15 minutes through CCP's official interface (ESI), depending on the permissions granted:

• publicData: Public character data (name, character ID), for the login
• esi-skills.read_skills.v1: Trained skills, skill points and attributes: for the ship matrix, roles and training times
• esi-skills.read_skillqueue.v1: Skill queue: current training and a warning when the queue is empty or paused
• esi-clones.read_clones.v1: Jump clones with location and implants, time of the last clone jump: for the career page
• esi-clones.read_implants.v1: Implants of the active clone: for attributes and training times
• esi-planets.manage_planets.v1: PI colonies with their layout (read only): for the PI overview, logistics and extractor warnings

We also store the time and error message of the last fetch per character as well as technical cache entries (ETag, expiry time), so that unchanged data is not fetched again. Public data without personal reference (ships, skills, market prices for skillbooks) is also fetched from CCP.

The legal basis is Art. 6(1)(b) GDPR. With every fetch CCP learns that EveCrew accesses this data with your token.

7. Character portraits

Inside the app and on the login page your browser loads character portraits and ship images directly from CCP's image server (images.evetech.net). CCP receives your IP address and browser identifier in the process. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is showing the official images without copying them ourselves. The public pages (start page, pricing, FAQ, imprint, privacy) load no content from other servers.

8. Cookies and local storage

EveCrew sets only technically necessary cookies:

• laravel-session: session cookie, keeps you logged in during the session; the session expires after 120 minutes without activity.
• XSRF-TOKEN: protection against forged form requests (CSRF), same lifetime as the session.
• remember_web_…: after the login, so that you stay logged in until you log out (at most about 400 days).
• evecrew_locale: your language (German or English) when you choose it with the language switch; valid for one year.

For every session the server stores the IP address, the browser identifier and the time of the last activity; expired sessions are deleted automatically.

Your choice between the light and dark design is stored locally by your browser (localStorage, entry evecrew-theme); it is not transmitted to us.

The legal basis for storing on your device is § 25(2) no. 2 TDDDG (strictly necessary), for the processing Art. 6(1)(b) and (f) GDPR. There are no tracking or advertising cookies.

9. Payment in ISK

Access is paid in ISK, by an in-game transfer to the character Caleb Jere. In the process we process the sending character, amount, time and the optional text in the "Reason" field as well as the date until which your access is paid. We do not process real money or payment data such as account numbers. The legal basis is Art. 6(1)(b) GDPR.

10. What the admin sees

In the app the admin sees per user only: name of the main character, names and IDs of the linked characters (to match payments), paid until, last login, status paid/demo and payments (amount, date, paying character, note). Every booking by the admin is logged with admin, time and content. No skills, no colonies, no tokens, no export and no logging in as another user. As operator of the server the controller technically has access to the database and uses it only for operation, backups and troubleshooting. The legal basis is Art. 6(1)(b) and (f) GDPR.

The admin signs in with a separate admin account (email address, password and authenticator app), apart from the login through EVE Online. This account holds only the operator's data; player accounts still have no email address and no password, and nobody gets into the admin area with an EVE login. Failed sign-in attempts and lockouts of the admin account are logged with the time, the email address entered and a non-reversible code (hash) of the IP address formed with a secret key, never with the password entered and not with the IP address itself. This protects the admin account against attacks; the legal basis is Art. 6(1)(f) GDPR.

11. Recipients

• CCP hf. (Iceland, EEA): at the login, with every ESI fetch, when tokens are revoked and when images are loaded, as described above.
• WilMa Digital GmbH: as operator of the data centre in which our server in Germany is located.

There is no transfer to countries outside the European Economic Area.

12. Storage period and deletion

• We store account, characters, tokens and ESI data as long as your account exists. With every fetch the data is replaced by CCP's current state.
• Remove a character (crew overview, "Remove"): EveCrew revokes the token at CCP and deletes the character with all its data immediately.
• Delete the account (crew overview, "Delete my data"): EveCrew revokes all tokens at CCP and deletes the account, characters, all ESI data and your sessions immediately.
• If a character is sold and linked by the new owner, we first delete the character's previous data.
• Inactive accounts: If a character's token stays invalid for more than 90 days (access revoked at CCP or expired), we automatically delete the character with all its data. Accounts without a login for 12 months are deleted with all characters and data; we try to revoke the tokens at CCP in the process.
• Payments and the log of admin bookings are kept as evidence even after the account is deleted, then without connection to the account (only paying character, amount, date). They are deleted after three years.
• Logged failed sign-in attempts of the admin account are deleted after 90 days.
• Sessions expire after 120 minutes without activity, server logs are rotated automatically.

You can also revoke EveCrew's access at any time on your EVE account page under "Connected applications". After that EveCrew fetches nothing any more; you delete the data already stored as described above.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21). To do so, write to the email address under point 1.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement.

14. Obligation to provide data, automated decisions

EveCrew cannot be used without logging in with EVE Online; there is no legal obligation to provide the data. Automated decisions within the meaning of Art. 22 GDPR do not take place. Role ratings and warnings are calculations for you, not decisions about you.

As of: October 2026