Privacy Policy

For Beanlings Kickoff (beanlings.com/kickoff, apps for iOS and Android, Discord bot) · As of 30 October 2026

This translation is provided for your information. The German version is legally binding. German version

Here we explain in simple terms which data Beanlings Kickoff processes, for what purpose, on what legal basis and for how long. This policy applies to Beanlings Kickoff in the browser (beanlings.com/kickoff), in the apps for iOS and Android and to our Discord bot. The German version is authoritative.

1. Controller and contact

Cards and Supplies, Armin Müller, Polarstr. 24, 95448 Bayreuth, Germany
E-mail: armin.mueller.bayreuth@gmail.com

Support and data protection requests about the game: support@beanlings.com

Technical operation and development are carried out on our behalf by Tim Ebner, c/o MDC#1263, Welserstraße 3, 87463 Dietmannsried, Germany. He processes data only on our instructions on the basis of a data processing agreement (Art. 28 GDPR). For servers and e-mail he uses Amazon Web Services and IONOS as sub-processors (section 16).

We have not appointed a data protection officer.

2. What this is about

Beanlings Kickoff is a free football manager game. You can play it in the browser, in the app for iOS or Android and partly via our Discord bot. All of these use the same game account. Some services from the Beanlings family are connected to Kickoff (pinnry, Beanlings Wildlands, Konterjagd); what flows between these services is described in section 11.

3. Account and login

Registration. We store your player name (freely chosen, publicly visible), your e-mail address (mandatory since 31 August 2026; older accounts without an address remain valid), your password only as a bcrypt hash and the time the account was created. You confirm that you are at least 18 years old and accept the Terms of Use; since 26 October 2026 we also store the time, the version of the Terms of Use and the channel (for example website or Discord). When you register you receive a recovery code; of this, too, we store only a hash. Legal basis: Art. 6(1)(b) GDPR (providing the game) and (c) or (f) (proof of consent).

Bot protection at registration. We use Cloudflare Turnstile. Cloudflare processes data from your browser and your IP address to detect automated sign-ups; for the check we also transmit your IP address to Cloudflare ourselves. In addition, we limit the number of new accounts per IP address and day. Legal basis: Art. 6(1)(f) GDPR (protection against mass and fake accounts).

Password check. We check new passwords against known data breaches (the “Have I Been Pwned” service). Only the first five characters of a hash value leave our server, never the password itself.

Logging in. After login we set the cookie play_token (30 days). If you log in on several devices, we store one session per device with the time it was last used; we delete unused sessions after 60 days. After 10 wrong passwords we lock the account for 15 minutes. If your password or e-mail address changes, we send a security e-mail to the previous address and end other sessions.

Logging in or linking with Discord (optional). If you connect your account with Discord, we receive your Discord user ID and your Discord name from Discord (permissions “identify” and “guilds.join”). With “guilds.join” we add you directly to our Discord server if you wish. Logging in via Discord can create a game account without an e-mail address; you then confirm the minimum age and the Terms of Use when you first open the game.

Forgotten password. At your request we send a one-time code, valid for 60 minutes, to your confirmed address (at most three e-mails per 24 hours).

4. Game operation and what is publicly visible

Game data. Club (name, crest, colours, stadium, finances), squad, line-ups and tactics, results, transfers, bids, coins, gems, inventory, collectibles, achievements, redeemed codes, daily tasks, language setting and the times of login and last activity. For the Pro area we record the tactics for each competitive match (analyses for your own club). Legal basis: Art. 6(1)(b) GDPR.

Public. Kickoff is a game played with others. Visible without login are: player name, club name and club profile (including badges such as “Supporter”), player profiles, tables, results, match reports, rankings, season reviews, share images, the Supporter wall, public ideas and the “Open Topics” (“Offene Themen”) list.

Posts outside the game. Our bots and accounts publish game events with club, player and manager names, for example:

• Discord: results, transfers, pack openings and new clubs (German and English), the “Fan Favourite of the Week” (“Fan-Liebling der Woche”; player and club with the most balls), winners of prize draws, community and tournament announcements. We name new Supporters only with your consent.
• Bluesky and YouTube (automatically generated short videos with weekly highlights and matches of the day).

Legal basis: Art. 6(1)(b) GDPR (public game operation is part of the game) and (f) (making the game known). You can object to your club being named in posts outside the game (Art. 21 GDPR, to support@beanlings.com). We take this into account for future posts and, on request, remove posts already published as far as we are able to.

Inactive clubs. If you are away for a longer time, a computer manager takes over your club (details in the Terms of Use). Your account remains.

5. Your own content, moderation and reports

What you enter. Club name, stadium name, fan chants, mottos, mascot names, guestbook entries, comments in Friends Leagues (up to 140 characters), ideas, contributions to “Open Topics”, feedback and questions to the Coach. We store this content with your club. Public content is visible to everyone.

Moderation. We check names and texts automatically with word filters; certain texts are checked by a human before publication. On our Discord server an automatic guard deletes clear spam and fraud (for example phishing links) and can, for this purpose, temporarily mute accounts or, in cases of clear fraud, remove them from the server. All other measures are decided by a human. You can contact support@beanlings.com about any decision; a human will then review it again.

Reports of illegal content. We store reports sent to support@beanlings.com with their content, location and outcome in order to handle them and to meet our obligations under the Digital Services Act (Art. 6(1)(c) GDPR).

6. Inbox, e-mails and newsletter

In-game inbox. Messages about your club (matches, transfers, rewards, campaigns, replies to feedback) arrive in your club’s inbox. We delete read messages after 90 days.

Necessary e-mails. We send you the password code, security e-mails and important notices about the contract (for example about changed Terms of Use) without separate consent (Art. 6(1)(b) GDPR).

“Kickoff-Post” newsletter (optional). You receive promotional e-mails only if you subscribe and click the confirmation link (double opt-in, Art. 6(1)(a) GDPR). This applies to:

• the getting-started tips for your club in the first days (three e-mails),
• at most two reminders if, as a new manager, you have not been around for a few days,
• drops (roughly every 14 days), codes, campaigns and news about Kickoff and from the Beanlings family (for example Beanlings Wildlands, pinnry).

As proof we store the time of subscription and of confirmation; after you unsubscribe, this proof remains on your account marked “unsubscribed” for as long as the account exists. Every e-mail has an unsubscribe link; you can also unsubscribe in the settings. Without confirmation we send at most one reminder to confirm. You subscribe to the newsletter separately from the account; the checkbox is never pre-ticked.

Sending. We send all e-mails via our mailbox at IONOS (1&1 IONOS SE, Montabaur).

7. Push notifications (optional)

You receive push messages (for example “your match is starting”, calendar doors, campaigns, important notices) only if you switch them on (Art. 6(1)(a) GDPR). We then store, per device, the push address including keys or the device token, the selected types and your club.

• Browser and Android app: delivery via the push service of the browser vendor (for example Google, Mozilla, Apple).
• iOS app: delivery via the Apple Push Notification Service.

Only the push address or token and the content of the message go there. If you switch push off in the settings, we delete the address; we delete invalid addresses and tokens automatically.

8. The apps for iOS and Android

The apps display the Beanlings Kickoff website; the same information applies as in the browser. In addition:

• App detection. The cookie store_app remembers that you are using the app so that the app shows the right content (for example no purchase notices in the app).
• Usage figures. We count app launches as a daily total per platform. So that a device is not counted twice on the same day, our server forms a check value from the IP address and browser identifier using a random key that changes daily and is held only in memory; only the total is stored. We also store on your account when you were last on the web, in the iOS app and in the Android app. We do not set cookies for this (until 26 October 2026 these were kl_app_tag and kl_plat). Legal basis: Art. 6(1)(f) GDPR (improving the apps).
• Rating. Occasionally (at most three times a year) we ask for a rating via the Apple or Google function. We do not learn whether or how you rated.
• Stores. The terms and privacy notices of Apple (App Store) and Google (Google Play) apply to downloads and updates.

9. Discord server and Discord bot

Our community server runs on Discord (Discord Inc., USA). Everything you do there is also subject to Discord’s terms and privacy policy. Our bots process the following:

• Access and language. When you choose a language in #start-hier (Deutsch, English, Français, Español, Português, 日本語), the bot assigns roles; your channels and private replies then appear in your language. After you choose a language we welcome you publicly (in German in #allgemein, otherwise in the English area).
• Tickets. A ticket is a private thread that only you and the team can see.
• Playing via Discord. Commands such as /kl run via your game account; for this we store your Discord user ID.
• Turnier-Arena. During events in the “Turnier-Arena” voice channel, the bot records how long you are present and credits gems for it.
• Roles from the game. Supporters, ambassadors and testers receive matching roles; for this we match your Discord ID with your game account.
• Voting on top.gg (optional). If you vote for the bot, top.gg reports your Discord ID to us so that we can credit the reward.
• Moderation. See section 5.

Legal basis: Art. 6(1)(b) GDPR (participation in the community and the game) and (f) (a secure server).

10. Coach, AI and automation

Coach in the game. Questions to the Coach are answered by a knowledge search on our own server using help articles and data about your club (next match, season standing). Your question does not leave the server. We store the question, answer, language and your rating (helpful yes/no, optionally a comment) to improve the Coach, and delete these entries after 12 months (Art. 6(1)(f) GDPR).

AI service for community and operation. Replies on Discord, translations of German announcements into English, the analysis of feedback, the maintenance of the “Open Topics” list and parts of moderation are produced or prepared by an AI service. For this it processes messages from public channels and tickets, feedback texts, player names and club data. The provider is Anthropic (AI models “Claude”); data is transferred to the USA in the process, where the level of data protection may be lower than in the EU. We only send the content needed for the task in question, never passwords or payment data (section 16). Legal basis: Art. 6(1)(f) GDPR (running and supporting a community with a small team).

Generated content. Match reports, the league newspaper, press conferences, graphics, short videos and social media posts are created automatically or with AI assistance. Exactly how is described on the AI transparency page (beanlings.com/ki).

No automated decisions with legal effect (Art. 22 GDPR). Bans in the game, chargebacks and the rejection of names are decided by a human. The exception is the removal of clear fraud accounts from the Discord server (section 5); you can contest this as well.

11. Connections to other Beanlings services

All services named here are also operated by Cards and Supplies. Data flows only between our own services on the same server and only if you establish the connection yourself (Art. 6(1)(b) GDPR), unless stated otherwise below.

11.1 pinnry (shop, Ink, Supporter, calendars, fan merchandise)

Sales, payments, delivery addresses and Ink (“Tinte”) accounts are handled by pinnry (pinnry.com). pinnry’s privacy policy applies there; Kickoff receives no payment data.

Establishing the connection. You connect your pinnry customer account with your game account via a confirmation step in the game. For this, Kickoff stores the number of your pinnry account and the e-mail address of that account. You can remove the connection in your pinnry account.

What pinnry reads or receives from Kickoff: the number of your game account and of your club, club name, founding date and last activity of the club, your Discord ID (for the Supporter role), for fan merchandise the data of the chosen players (name, shirt number, position, statistics) and the season.

What Kickoff receives from or unlocks via pinnry: redeemed or automatically redeemed codes (cosmetics, player codes, Friends League packages), Pro access and Supporter badge, contents of digital calendars (doors, gems, coins, items), bonuses for fan merchandise (coins and tickets, shown only on the web) as well as Ink balance and the result of Ink transactions.

Ink and open Friends Leagues. Kickoff does not keep an Ink account. For a place, Kickoff sends pinnry the number of your game account or club, the amount, the name and link of the league, a booking key and the deadline, and later the instruction to redeem or release. pinnry replies with your available and reserved balance and the result. For each place, Kickoff stores the league, club, amount, booking key, reservation number and status for as long as the league exists, at the longest until your account is deleted. There are no Ink functions in the app.

Kurven gift. Whoever buys a Kurven gift (“Kurven-Geschenk”) gives Supporter months to randomly drawn managers. For this, pinnry uses Kickoff data to check who is eligible (active in the last 7 days, club at least 14 days old, not currently a Supporter, no gift in the last 90 days). Winners are informed in their inbox; on Discord we name the club. Legal basis: Art. 6(1)(f) GDPR (passing the gift on to the community). You can object to taking part in such draws at any time (support@beanlings.com); we will then no longer draw you.

Fan merchandise and authenticity page. Personalised fan merchandise can only be ordered by someone whose pinnry account is connected to the club. pinnry has it produced and shipped by a print service provider (Spreadconnect); the print motif (club name, player data) and delivery data go there. Details are in pinnry’s privacy policy. Each item carries a QR code leading to the public authenticity page beanlings.com/k/<code>. This page shows anyone who knows the code: item, item number, player (short name, number, position), club, season, code and status, never the buyer’s name or address.

Book notice. Whether the notice about a Wildlands book appears is checked by the Kickoff server based on the pinnry connection or your confirmed e-mail address; nothing is stored in the process (Art. 6(1)(f) GDPR).

11.2 Beanlings Wildlands

If you connect your Wildlands keeper to your club via a code, Kickoff sends the ID and name of your club to Wildlands; Wildlands reports your keeper name as well as the date and level of your active test days. Purpose: tester bonus (coins, gems, packs) and the prize draw for Golden Sports Bags. Bonuses already credited remain if you remove the connection in the Wildlands settings.

11.3 Konterjagd (formerly Beanlings Live)

Konterjagd (beanlings.com/live) is a separate game. You log in with your Kickoff account; this policy applies to that. At your request, Kickoff provides the game with your account number, player name, club with squad and player ratings, language and the offers on the transfer market (read-only); replies to your feedback reach you in your Kickoff inbox. Everything else is described in the Konterjagd privacy policy (beanlings.com/live/datenschutz).

11.4 Beanlings Blitz

The tournament game Beanlings Blitz has been closed since 27 September 2026. Stored Blitz data (tournament name, squad, line-ups, results, entries) is still linked to your account; on request to support@beanlings.com we will delete it.

12. Campaigns, prize draws, invitations and Twitch

Inviting. If you invite someone with your code or link, we store who invited whom and check the activity of the new club (for example 7 active days) before any rewards are given. The invitation code is contained in the link (?ref=…) and is passed on via the address until registration, not stored in a cookie.

Kurven campaign (Kurven-Aktion, 14 October – 9 November 2026) and other campaigns. We evaluate confirmed new sign-ups and show a public ranking with club names. Each campaign and prize draw (for example the Kurven campaign, the Wildlands tester prize draw, the calendar prize draw) has its own terms of participation. We notify winners in their inbox and name the club on Discord. For prize draws with a verifiable draw, we publish the random value. If you open the campaign page of the Golden Box (“Goldene Box”), the cookie kl_ref remembers the campaign code for up to 7 days so that the roll promised there is credited when you register. Legal basis: Art. 6(1)(b) GDPR (participation).

Twitch (optional). If you link your Twitch name via a confirmation code, we use the Twitch interface to check whether you are watching the stream of our partner channel and credit gems for it (with a daily limit). We store your Twitch name and the credits.

13. Cookies and storage in the browser

We only set cookies that are necessary for a service you explicitly use (§ 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act)). No consent is required for this, which is why there is no cookie banner.

Discontinued. Until 26 October 2026 we also set cookies for statistics: kl_sid (visitor identifier, also in local storage), kl_quelle (source channel), kl_app_tag and kl_plat (app and platform counting) as well as kl_ref via the reel link. We no longer set these; we remove existing ones on your next visit. Since then, counting has taken place without storing anything in your browser (section 14).

Local storage. In your browser’s local storage (localStorage) we remember settings and convenience values, for example your language, which notices you have closed, which beginner tips you have seen and where you want to return to after login. This stays in your browser and is not used for statistics. We do not embed advertising, tracking or analytics services from other providers.

14. Statistics and reach

• Registration statistics. For the path from the start page to registration we store, for each step, the time, referring page, browser identifier, IP address and a check value. Our server forms the check value from the IP address and browser identifier using a random key that changes daily and is held only in memory; this allows steps on the same day to be linked without storing anything in your browser. After registration we store your account number and the channel through which you came (from the link, for example ?quelle=instagram, or from the referring page). We delete these entries after 7 days. We also use the IP address for the limit on new accounts per IP address and day. We do not count recognisable search engines and preview services.
• Page counter. Views per day, page and platform with a device value hashed from the login cookie, without IP address.
• Languages. Daily totals per language; we count the number of users with a random value that changes daily and is held only in memory.
• Countries. From the IP address last used by your account we determine the country on our server, evaluated only as a total per country. No IP address is sent to other services for this.

Legal basis: Art. 6(1)(f) GDPR (improving the game, translations, kick-off times). Shop statistics are kept by pinnry in accordance with its own privacy policy.

15. Security, fair play and abuse prevention

• Server logs. The web server logs IP address, time, requested address and browser identifier; we delete the logs after 14 days. We automatically block repeated attack attempts (for example requests to typical attack addresses) for 24 hours; we throttle logins per IP address.
• Security log. We store security events with a hashed IP address for 180 days.
• Multiple accounts. To detect prohibited multiple accounts we store the IP address last used by your account. If several people play via a shared connection, we can manage them as a shared household (Spielgemeinschaft); trading among them is then blocked.
• Ink. To keep Ink fair, pinnry compares the IP address last used by new Kickoff clubs with new sign-ups at pinnry and Wildlands, only as an HMAC hash; the check values are deleted after 30 days. Nothing is blocked automatically as a result; anomalies are reviewed by a human.

Legal basis: Art. 6(1)(f) GDPR (secure operation, fair play). You can object to this on grounds relating to your particular situation (Art. 21 GDPR).

16. Recipients, service providers and transfers to third countries

For recipients outside the EU, we base the transfer, where available, on an adequacy decision of the EU Commission (for the USA the EU-US Data Privacy Framework, insofar as the recipient is certified) or on standard contractual clauses (Art. 46 GDPR). For services that you use directly yourself (Discord, Twitch, top.gg, app stores), their own privacy notices also apply. For the AI service, see section 10.

We do not sell data and do not pass it on for advertising purposes.

17. Retention periods

18. Deleting your account and your rights

Deleting. You can delete your account at any time in the settings. Player name, password hash, e-mail address, inventory, achievements, invitations, private messages and statistics entries relating to your account are removed. Your club remains in the game under its name and passes to a computer manager so that the current season continues for everyone; public posts then appear as “Gelöschter Manager” (“Deleted manager”). Further linked entries (push addresses, Coach questions, Twitch and pinnry connection, Blitz data, login sessions and newsletter delivery logs) are deleted automatically at the same time. We only keep the record that you accepted the terms and the privacy policy, because we are legally required to prove it. Data that pinnry must retain under tax and commercial law (orders, purchased Ink) remains there.

Your rights. Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20, Settings → data export as JSON) and objection to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consents (newsletter, push) at any time with effect for the future. Write to us at support@beanlings.com.

Complaint. You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority), Promenade 18, 91522 Ansbach.

19. Minimum age

Beanlings Kickoff is intended for adults. When registering, you confirm that you are at least 18 years old. If we learn that an account belongs to a younger person, we delete it.

20. Accessibility

We pay attention to colour contrast, keyboard operation, labels and the “reduce motion” setting. If something gets in your way, write to us at support@beanlings.com.

21. Changes

If features or the legal situation change, we adapt this policy. We inform you about significant changes in the game. The current version is always available at beanlings.com/kickoff/datenschutz.

Impressum · Nutzungsbedingungen · Zurück zum Spiel