Version: 3 August 2026 | Controller: Tim Ebner (see legal notice)
Sproutverse / Beanlings is a free hobby project. We only collect the data that is technically necessary to run the service. There is no disclosure to third parties, no advertising and no commercial background. Use requires a minimum age of 16 years.
| Data | Purpose | Retention |
|---|---|---|
| Discord user ID | Player account, collection, progress | Until deletion request |
| Player name / display name | Profile, social feed, community | Until deletion request |
| Game activity (timestamps) | Inactivity system, daily rewards | Until deletion request |
| Beanling collection | Game content, album display | Until deletion request |
| TCG card collection | Collection tracking, progress, value calculation | Until deletion request |
| Posts, comments, likes | Social feed (public if profile is public) | Until deleted by user or moderation |
| Uploaded images | Social feed posts, profile picture | Until deleted by user; compressed to max. 150 KB |
| Followers / following | Social network feature | Until deletion request |
| Bio, interests | Profile display | Until deletion request |
| IP address | Technical server logs, abuse protection | Max. 7 days |
| Session token | Authentication | 30 days |
| Seeds / stardust | In-game currency | Until deletion request |
| Location data (Sproutverse Live) | Game mechanics, distance measurement — only with consent | Only during the session; distance until deletion request (details: section 3a) |
Processing is based on Art. 6 (1) (b) GDPR (performance of contract / use of the service) and Art. 6 (1) (f) GDPR (legitimate interest in operating the service).
Sproutverse Live is an optional game feature that lets you collect items by walking in the real world. Using it requires your explicit consent (Art. 6 (1) (a) GDPR).
| Data | Purpose | Retention |
|---|---|---|
| GPS coordinates (latitude/longitude) | Game mechanics: show nearby items, measure distance | Last position only during an active session, anonymised afterwards |
| Distance covered (metres/day) | Game progress, achievements, daily statistics | Until deletion request |
| Items found (type, time) | Inventory assignment | Until deletion request |
| Speed (calculated) | Anti-cheat: ensuring the game is played on foot | Not stored permanently |
Important:
Safety note: Always pay attention to your surroundings and traffic while playing. Do not enter private property. Do not play while driving. Sproutverse accepts no liability for accidents or damage occurring while playing in the real world.
Sproutverse runs on the Discord platform. Discord Inc. processes data under its own privacy policy — please also see the Discord privacy policy.
| Service | Purpose | Privacy |
|---|---|---|
| Discord OAuth2 | Sign-in via Discord account (optional) | Discord privacy |
| Cloudflare Turnstile | Bot protection at registration | Cloudflare privacy |
| Google Ads (Consent Mode v2) | Measuring ad campaigns — only with consent | Google privacy |
| pokemontcg.io API | Card data and images (MIT licence) | pokemontcg.io |
| Cardmarket | Card prices as reference values | Cardmarket privacy |
| CartoDB / CARTO (map tiles) | Map display in Sproutverse Live | CARTO privacy |
| Leaflet.js (open source) | Map framework in Sproutverse Live | No data transfer (client-side) |
No personal data is passed to these services unless expressly described (e.g. Discord OAuth2 for authentication).
To exercise your rights, e-mail datenschutz@beanlings.com or send a Discord direct message to the server admin. Requests are handled within 30 days.
The web app runs on a private server at Amazon Web Services (AWS) in the EU (Frankfurt) region. AWS processes data under the AWS privacy notice.
The web app uses one technically necessary session token (cookie), which expires after 30 days. In addition, the following service is used:
| Service | Purpose | Provider |
|---|---|---|
| Cloudflare Turnstile | Bot protection at registration (CAPTCHA alternative); sets its own verification cookies. | Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA. Privacy |
No advertising or analytics cookies are set. There is no third-party tracking.
When registering for Beanlings Play we store: player name (freely chosen), password (encrypted as a bcrypt hash — industry standard, never in plain text) and optionally an e-mail address (only for password reset). We also store game progress (stardust, babies, Beanlings) and timestamps (creation, last visit).
The e-mail address is not used for advertising or newsletters. You can delete your account completely at any time via the profile settings in the game (right to erasure, Art. 17 GDPR). All associated data is then irrevocably removed.
Beanlings Kickoff is a football management simulation available as a Discord bot and browser game. You can register with a player name and password or sign in via Discord OAuth2.
Stored data:
No real personal data (address, phone, date of birth) is collected. No e-mail address is required. No payment data is stored.
Publicly visible data: player name, club name, league table, match results, club and player profiles. These can be viewed without logging in, as they are part of the game.
Your rights:
Cookies: Beanlings Kickoff uses only technically necessary cookies:
play_token (authentication, 30 days) and coach_lang
(language setting, 1 year). No tracking, analytics or advertising cookies are set.
IP addresses and fair-play protection: To detect abuse and fraud (in particular multiple accounts that violate the terms of use) we store the last IP address used by your account and evaluate technical matches between accounts (legal basis: Art. 6 (1) (f) GDPR — legitimate interest in fair play). Findings are stored only as long as needed to resolve the case and are not shared with third parties.
Usage statistics: We record anonymous, aggregated metrics (e.g. landing page views, registration steps, daily active players) exclusively on our own servers (first party). No external analytics services are used.
Browser notifications (web push): You can optionally enable push notifications (consent via the browser, Art. 6 (1) (a) GDPR). A technical push subscription is stored until you revoke it in the browser or in the settings.
To protect the community we partly use automated and AI-assisted systems:
Important: You can contest any automated decision (e.g. suspension, renaming, rollback) — contact us on Discord (#kl-hilfe) or by e-mail at datenschutz@beanlings.com and a human will review the case. Parts of the game content (e.g. news summaries, support replies) may be AI-generated.
EU AI Act (Regulation (EU) 2024/1689): Our AI-assisted features are limited-risk systems within the meaning of the regulation. We meet the transparency obligations of Art. 50: where you interact with an AI system or content is AI-generated, we disclose this (see above). There is no emotion recognition, no social scoring and no biometric identification; we do not operate high-risk AI systems within the meaning of the regulation. You can always have any automated measure reviewed by a human.
The Endless World is a browser game at beanlings.com/welt2. You play with your Beanlings Play account (section 7a) or via Discord — one account for everything.
Stored data: the position of your character inside the game world (game coordinates — no real location data, no GPS), steps and explored areas, your collection (creatures, finds, records, chronicle), bag, market and trade offers, daily path and streaks, language setting, and timestamps (creation, last movement).
Publicly visible: your player name appears as first discoverer on areas you entered first. Players near you see your character and name while the “visible to others” setting is on — it is on by default and can be turned off at any time in the settings.
Deletion: you can delete your account completely in the world’s settings (Art. 17 GDPR). Your collection and game data are removed; first-discoverer entries are anonymised.
Statistics: page views are counted anonymously and exclusively on our own servers (no IP storage, no personal reference, no third parties).
Using Sproutverse / Beanlings requires a minimum age of 16 years (in line with Art. 8 GDPR and the Discord terms of service). By registering you confirm that you are at least 16 years old. Parents of minors may request the immediate deletion of all stored data.
Card prices are fetched automatically from public sources (Cardmarket, Pokémon TCG API) and serve as reference values only; they are not a buying or selling recommendation. Card images come from official APIs (pokemontcg.io, Pokellector) and are used solely to identify cards. All trademark rights remain with their owners (The Pokémon Company, Disney/Ravensburger, Konami, Wizards of the Coast etc.).
Besides official TCG sets, the tracker supports community-created TC sets (e.g. Topps®, Kakawow, VeeFriends). This data is maintained by volunteer community editors. Uploaded card images are used exclusively for identification. All trademark rights in Topps®, Kakawow, VeeFriends and other named brands remain with their respective owners.
Passwords are stored as bcrypt hashes (industry standard), never in plain text. Discord OAuth2 tokens are used only for one-time authentication and are not stored permanently. You can delete your account completely at any time in the profile settings (Art. 17 GDPR).
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the state data protection commissioner of your German federal state.
Parts of the service are in a beta phase. Features may change and temporary outages may occur. We are not liable for data loss caused by technical problems. You can report feedback and errors via the feedback buttons in the apps.