1. Data Controller

Cvolton, based in the Czech Republic, is the data controller for personal data processed through GDHistory.

2. What Data We Collect

2.1 Geometry Dash level and player data (archived, not "about you" as a site visitor)

GDHistory's core purpose is archiving historical data from Geometry Dash's public game servers — level metadata (IDs, names, star ratings, download counts, timestamps), and creator information such as Geometry Dash usernames and account/user IDs. We obtain this data by querying the same public Geometry Dash server API endpoints (e.g. getGJLevels, downloadGJLevel) that the official Geometry Dash game client itself uses to browse and download levels — the same responses any player's game client receives. GDHistory is an independent, unofficial project and has no data-sharing arrangement, partnership, or affiliation with RobTop Games AB (the developer of Geometry Dash); we do not receive data directly from RobTop, and RobTop's own privacy policy does not extend to or govern GDHistory's archive. This data may include personal data (e.g. a Geometry Dash username) about level creators and players who are not users of GDHistory itself and did not interact with our site directly.

Because GDHistory is independent from RobTop Games AB, deleting or changing your Geometry Dash account directly with RobTop does not automatically remove or update historical records already archived by GDHistory — please contact us separately (see Section 7) if you want us to review or remove archived data relating to you.

2.2 Account data (registered users)

Uploading a save file or submission currently requires a login. Accounts are created by the site administrator rather than through public self-registration. If you have an account, we store your username, a hashed password, and any other fields associated with your Django user account (e.g. email address, if one was set).

To have an account or upload save files/submissions, you must be at least 15 years old (the age of digital consent in the Czech Republic under Section 7 of Act No. 110/2019 Coll.) or have the permission of a parent or legal guardian.

2.3 Save file / submission uploads

Save files: If you upload a Geometry Dash save file, we parse it and extract and store:

• Your in-game player name, player user ID, and player account ID
• The level history data contained in the save (level records, versions, timestamps, etc.)
• A copy of the raw save file itself, with the account password field stripped out before storage
• Any comment you attach to the upload, and the submission timestamp

Manual submissions: GDHistory also accepts manually-submitted JSON files listing specific levels and timestamps (e.g. for levels not captured by a save file). These are validated for structure (level IDs, dates) and linked to your account and any comment you provide, but — unlike save file uploads — do not involve extracting a player name or account/user ID from the file itself.

Because a GD save file can contain data relating to your Geometry Dash account, by uploading a save file you confirm that it is your own, or that you have explicit permission from the account owner to share it.

Please also note that level descriptions, comments, or other free-text fields inside your save file are archived as-is if included in your upload. If you've put real names, contact details, social media handles, or other personal information into a level description or comment, it may end up stored and displayed publicly as part of the historical archive — please review your save file's content before uploading if you'd rather that information not be preserved.

2.4 Technical / server log data

The Service's web application (nginx, application server, database) is hosted on Contabo infrastructure within the EU. Our nginx web server automatically logs standard technical data for security and troubleshooting purposes — typically IP address, browser/user-agent, requested URL, and timestamp. These logs are rotated on a 15-day cycle (the current day's log plus 14 archived days), after which they are automatically deleted. We do not use this data for profiling. (A separate netcup VPS hosts only our Meilisearch search index and does not receive or log web traffic — see Section 4.)

2.5 Analytics

GDHistory uses two analytics services:

• Google Analytics (via a Google "gtag" integration), which sets cookies and processes your IP address (subject to Google's own data handling practices) to generate usage reports such as page views and visitor statistics. Google Analytics only activates after you accept analytics via the cookie/consent banner shown on the site; you can change your choice at any time using the "Cookie / analytics settings" link in the site footer, or opt out further using a browser extension such as Google Analytics Opt-out.
• Cloudflare Web Analytics, a privacy-focused analytics service that does not use cookies or any client-side state to track visitors, and does not track individual users across sites. It reports only aggregate, anonymized usage statistics (page views, load times, referrers).

Because Google Analytics uses cookies and processes personal data (IP address) for cross-session tracking, it requires your consent under Czech/EU cookie rules; Cloudflare Web Analytics, being cookieless, generally does not.

2.6 What we do not collect

We do not process payment information, and we do not knowingly collect data through a public account-registration form, since registration is admin-managed. We do not use any personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

3. Why We Process This Data (Legal Basis)

4. Data Sharing

We do not sell personal data. Data may be shared with:

• netcup GmbH and Contabo GmbH, our hosting/infrastructure providers, both operating infrastructure within the EU. Contabo hosts the application server, database, and static files; netcup hosts a separate VPS running only our Meilisearch search index for archived Geometry Dash level data (level names, IDs, and creator usernames) — this VPS does not process account data, save file uploads, or server/technical logs.
• Google, via Google Analytics, subject to Google's Privacy Policy.
• Cloudflare, via Cloudflare Web Analytics (and if Cloudflare is also used as a CDN/proxy in front of the site, Cloudflare additionally processes connection metadata to serve that role), subject to Cloudflare's Privacy Policy.
• Publicly, as part of the archive itself: level metadata, creator usernames, and — where a submission is marked "browsable" — level history derived from an uploaded save file, are displayed publicly on the site or via our public API, consistent with the Service's purpose as a historical archive.

We do not otherwise share personal data with third parties, and do not use it for advertising or profiling.

5. Data Retention

• Archived Geometry Dash level/server data is retained indefinitely. Historical preservation is the core purpose of the project, and this retention relies on the archiving-purposes exemption in Article 89(1) GDPR (archiving in the public interest / historical purposes), which permits longer retention than would otherwise be appropriate, subject to appropriate safeguards (e.g. only the data actually needed for the archive is kept, and it is not repurposed for unrelated processing).
• Account data is retained for as long as the account exists, plus 30 days after deletion is requested, to allow reversal of accidental deletion.
• Uploaded save files and submissions are retained indefinitely as part of the archive, unless you request deletion (see Section 6) — note that data already incorporated into public historical records (e.g. a level's recorded history) may be retained even if the originating account is deleted, to preserve archive integrity.
• Server/technical logs (nginx) are retained for 15 days (current day plus 14 rotated archives) before automatic deletion.

6. Your Rights

If you are in the EU/EEA (including the Czech Republic), you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten"), subject to our reliance on the Article 89(1) GDPR archiving exemption and legitimate interest in preserving historical archive integrity for already-published archive records
• Restrict or object to certain processing, including analytics
• Data portability for data you provided directly
• Withdraw consent at any time where processing is based on consent (e.g. analytics, save file uploads), without affecting the lawfulness of processing before withdrawal
• Lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.cz), or your local supervisory authority

To exercise any of these rights, contact [email protected].

7. Data of Third Parties (Level Creators / GD Players)

Because GDHistory archives publicly-broadcast data from Geometry Dash's servers, it may contain personal data (such as usernames) of Geometry Dash players who have never visited or interacted with GDHistory directly, and this data is not collected from those players directly. Individually notifying every such player is not practically possible given the scale and nature of the archive; we therefore rely on the exemption in GDPR Article 14(5)(b) (disproportionate effort) for this category of data, and provide this Privacy Policy plus the removal process below as our safeguard instead.

If you are a GD player and want to request removal or correction of data relating to you from the archive, contact [email protected] — we will consider requests on a case-by-case basis, balancing your rights against the project's historical/archival purpose. In particular, upon a verified request from the original Geometry Dash account owner, we will anonymize identifying details (such as a username) associated with that account in the archive where practical, even where we retain the underlying historical level record for archive integrity.

8. Cookies

The Service uses:

• Essential cookies (e.g. Django session/CSRF cookies) required for login and core functionality
• Analytics cookies, set by Google Analytics — see Section 2.5

Cloudflare Web Analytics does not set cookies, so it is not listed above.

9. Security

We take reasonable technical measures to protect stored data (e.g. password hashing, stripping account passwords from uploaded save files before storage). Data transmitted between your browser and our servers is encrypted using HTTPS/TLS. No online service can guarantee absolute security.

10. Children

GDHistory is not specifically directed at children. Accounts and save file/submission uploads require the account holder to meet the age of digital consent described in Section 2.2. Because Geometry Dash has a young player base, archived usernames or account IDs of minors may incidentally appear in the archived game data (Section 2.1) — this data is not collected via GDHistory accounts and is addressed separately under Section 7; we do not knowingly collect additional personal data about children beyond what is publicly broadcast by Geometry Dash's own servers.

11. International Transfers

All of the Service's infrastructure (application server, database, uploaded save files, account data, server logs, and the Meilisearch search index) runs on Contabo and netcup servers located within the EU, so no international transfer of personal data occurs for our own hosting.

If Google Analytics or Cloudflare process data outside the EU/EEA, such transfers rely on the safeguards those providers publish (e.g. Standard Contractual Clauses under the EU-US Data Privacy Framework where applicable).

12. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

13. Contact

Questions, requests, or complaints: [email protected]