MT2LIST

Privacy Policy

Last updated: September 29, 2026

Translation for convenience. The German version is the binding one.

1. Controller

P42 Studio (Sole Proprietorship), owner Thies Bergenthal, Osterstraße 32, 26847 Detern, Germany
Email: hello@p42.studio · Phone: +49 175 4511067

No data protection officer is appointed, as none is required by law. Send privacy requests to the email address above.

2. Overview

metin2-pserver.de is a toplist for Metin2 private servers. You can use it and vote without an account. We use no analytics, advertising or tracking tools, load no third-party fonts and sell no data.

3. Hosting

The site runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. Hetzner processes the data only on our behalf (Art. 28 GDPR). Legal basis: our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR).

4. Cloudflare

All traffic passes through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which protects the site against attacks and automated abuse, encrypts the connection and delivers files faster. Cloudflare processes your IP address, the requested address, browser details and technical connection data, and passes us only a country code derived from your IP address. Cloudflare is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses apply in addition. Legal basis: Art. 6(1)(f) GDPR.

5. Server log files

For every request our web server records IP address, date and time, requested address, HTTP status, bytes sent, referrer and user agent. We use the logs to fix errors and fend off attacks; they are deleted automatically after 14 days. Legal basis: Art. 6(1)(f) GDPR.

6. Cookies and local storage

We only use strictly necessary cookies and storage entries (§ 25(2) no. 2 TDDDG); no consent is needed for them.

  • metin2-pserverde-session – session, e.g. login and language, 2 hours
  • XSRF-TOKEN – protects forms against misuse, 2 hours
  • m2p_vid – random ID to recognise duplicate votes, 1 year
  • m2p-player:<server> and m2p-votes:<server> (browser local storage) – your last character name and your vote count, so you do not have to type them again; stays in your browser until you clear it
  • m2p-add-server-draft (browser local storage) – your entries in the "List Your Server" form if you are not logged in yet when you submit; filled back in and deleted after you log in, not used after 24 hours

7. Voting

So that everyone can vote once every 12 hours per server and votes cannot be manipulated, we process when you vote:

  • your IP address, stored only as a keyed hash (HMAC-SHA-256 with a secret key), never in plain text,
  • a device hash your browser computes from technical characteristics (e.g. screen size, language, number of processor cores), also only as a hash,
  • the hash of the m2p_vid cookie,
  • the country code from Cloudflare, the time and the server,
  • optionally: your in-game character name.

If you enter a character name, the operator of the server you voted for receives that name and the time through our Vote Rewards API so they can reward you in the game. The server operator is responsible for their own processing.

After 30 days we replace the IP, device and cookie hashes with random values that can no longer be linked to anyone. What remains is server, time, country code and, where given, the character name, for statistics. Legal basis: Art. 6(1)(f) GDPR (a fair ranking, protection against manipulation) and, where you enter a character name, Art. 6(1)(b) GDPR.

8. Server page views

So that server owners can see how often their page is viewed and where visitors come from, we count views of server pages. We store only a daily total per server and source type (search engine, other website, Discord, direct visit, our own site), derived from your browser's referrer. To count one view per day only, we keep a hash of your IP address in the cache until the end of the day and then delete it. Views by bots are not counted. Legal basis: Art. 6(1)(f) GDPR (meaningful statistics for server owners).

8a. Clicks to server websites

When you click "Website", we count the click for the ranking. To count one click per day, we keep the hash of your IP address in a cache for 24 hours and then drop it. After that you leave our site; the server websites are their operators' responsibility.

9. User account

For an account we store username, email address, a securely hashed password, language and the time of registration. If you sign in with Discord or Google, we receive your ID, name, email address and avatar from them; their privacy notices (Discord Inc., Google Ireland Ltd.) apply as well. We use this data to provide your account and send emails you request (e.g. password reset). Legal basis: Art. 6(1)(b) GDPR. The data is kept until you have your account deleted; write to support@p42.studio.

10. Server listings, events and reviews

If you list a server, we publish the details, images, links and events you provide on the site and in our Discord. Reviews and ratings appear publicly with your username. If you mark a review as helpful, we store that with your account so you can mark it only once; only the count is public. Server owners can reply publicly to reviews of their server, pin them to the top and report them to our team; our team decides on reports. Legal basis: Art. 6(1)(b) GDPR. You can have listings and reviews removed at any time.

11. Server trailers

If a server has a YouTube video, we show a preview image loaded from Google's servers (i.ytimg.com), which gives Google your IP address. The video itself only loads when you click play, via youtube-nocookie.com. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Art. 6(1)(f) GDPR, and for the video your consent by clicking (Art. 6(1)(a) GDPR).

12. Discord

Our Discord server and the bot "MT2-Serverlisting" run on the platform of Discord Inc., 444 De Haro Street, San Francisco, CA 94107, USA; Discord's privacy policy applies to your use of Discord. Inside Discord the bot processes your Discord ID, name and avatar to assign roles (verification), post welcome messages, provide support tickets and keep moderation logs. Legal basis: Art. 6(1)(f) GDPR (running and moderating the community).

13. Email

Emails you request are sent through our own mail server in Germany. If you write to us, we process your message and address to reply and delete them once the request is closed and no retention duty applies.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Write to hello@p42.studio.

You can also lodge a complaint with a data protection authority, for example the one responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, www.lfd.niedersachsen.de.

15. No automated decisions

The ranking follows from votes and clicks. There is no automated individual decision with legal effect on you within the meaning of Art. 22 GDPR.

16. Changes

We update this policy when the site or the law changes. The version published here applies.