Privacy notice

This notice explains what personal data PP2 Forum processes, why and for how long, and what rights you have. It has been prepared in accordance with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act.

1. Controller and contact details

The administrators of the PP2 results service and the forum (a hobby service run by private individuals, not a company). For privacy matters: info@propilkkitulospalvelu.fi.

The service is not an official service of Procyon Products.

2. What data we process

As a reader (without an account)

• No tracking. The forum uses no analytics, advertising, external fonts, scripts, images or embeds. Nothing is loaded from third parties.
• Server log. The web host (Domainhotelli, Planeetta Internet Oy) keeps a technical log (IP address, time, requested page, browser) for security and troubleshooting. The log is kept by the web host, not by the forum administrators.
• A technical cookie for forms. When you open a form (for example, log in), we set a session cookie that is needed to prevent forged form submissions. It expires after 2 hours of inactivity and contains no personal data.

As a registered member

• Account: nickname (visible to everyone), email address (not shown to other members), a hash of your password (not the password), join time, last visit time, and the time when you accepted the rules and confirmed that you are at least 13 years old.
• Optional profile details: PP2 player name, an introduction, game details (e.g. favourite lake, the year you started playing, platform, time zone), up to three links, the avatar colour and, if you wish, your own profile picture. The profile picture is stored re-encoded as a 128-pixel image without picture metadata (such as location); the original is not kept. It is shown publicly next to your nickname until you remove it or your account. Pictures you attach to posts are stored re-encoded (at most 1600 pixels, without metadata) and are visible to the readers of the post like the post itself; they are removed when you remove them or your account, or when the post is edited so that it no longer refers to the picture. In the profile settings you decide whether the introduction, post history, event history, last-seen time and clan are visible to everyone, only to logged-in members or only to you. By default the introduction, post history and clan are visible to everyone, the event history to logged-in members and the last-seen time only to you. The post history contains only public, visible posts; hidden, deleted and staff posts do not appear in it.
• Posts: the threads and posts you write, the edit history (earlier versions are visible only to moderators and administrators) and the reports you make.
• Session: the login session cookie (__Host-fsid) that keeps you logged in. It is necessary and is not shared with other sites. A member's session lasts 30 days from the last visit, staff sessions 2 hours.
• Age group (under 18 / adult): your own statement at registration or in the private message settings. It is not shown to other members; only moderators and administrators see it. We use it only to protect minors in private messages (an adult cannot start a private message with a minor) and to prioritise reports. We do not verify age. It is deleted when you delete your account.
• Private messages: the content of messages, the participants and times, the users you have blocked and your message settings. Nobody but the participants reads the messages; staff see a message only if a participant reports it (then the reported message and up to five before it are stored as a snapshot and shown to moderators). A conversation is deleted 12 months after the last message; you can delete a conversation for yourself at any time, and when both have deleted it the messages are removed completely. Handled reports are deleted after 90 days. When you delete your account the messages you sent are deleted. Messages are not end-to-end encrypted. The email notification does not contain the message content.
• Two-factor authentication (mandatory for administrators and moderators, recommended for other members): the secret and hashes of the recovery codes.
• Trusted device (only if you choose "Remember this device" when logging in): a random token in your browser's cookie (__Host-fdev, 30 days); its hash, creation time, last use and the browser identification string are stored on the server. You can remove all trusted devices in the settings; they are also removed when you change your password.
• Login notice: when you log in with a code (from a device not marked as trusted), at most three times a day, we send you an email with the time, browser identification and IP address. The message is not stored anywhere except the mail sending log, which follows the other log retention periods.
• Security log: logins, failed attempts and security-related actions (time, IP address, account). Only administrators can see it.
• Clan discussion areas: threads and posts written by clan members are stored like other posts, but they are visible to the clan's members only (not in search, lists, the sitemap, the API or to others in profiles). Staff see a thread only if it contains a reported post, and only while the report is being handled. When a member leaves, their posts stay in the clan's archive under their nickname; dissolving the clan, or deleting the account of the leader when there are no other members, deletes the areas and posts permanently.
• Clan: if you found or join a clan, the clan tag, name and your membership (role, join date). You can hide yourself from the member list; then the tag is not shown on your posts or in the data passed to the results service.
• Event sign-ups: when you sign up we store your player name and clan tag as of the sign-up, your role (player, host, referee), an optional note and host details. They are shown in the participant list on the event page and passed to the results service (propilkkitulospalvelu.fi) for the participant list through a read-only API. Your email address is not passed on. You can withdraw your sign-up at any time.
• Email: verification and password messages. Notifications about replies and mentions are sent by email only if you have chosen this in your settings.

3. Purpose and legal basis

4. Retention

• Account and posts: until you delete the account or ask for deletion. You can delete the account yourself in your settings; you can choose whether your posts remain visible under the name “Deleted user” or are deleted.
• An unverified account is deleted after 7 days.
• Event sign-ups: deleted when you delete your account. The results service is responsible for retaining the data already passed to it, in its own notice.
• Security log, three levels: failed sign-in attempts and rejected requests 30 days; the IP address is removed from each row after 90 days (the row stays); other events 12 months. Deletion is automatic.
• Session records disappear when the session ends or expires.
• Backups: a copy of the database is taken daily and the 14 most recent are kept. Deleted data disappears from the copies within 14 days at the latest.

5. Who receives the data

Data is not sold or disclosed for marketing. Public posts and profiles are visible to everyone, including search engines. Event sign-up details (player name, clan tag, roles) are passed to the PP2 results service (propilkkitulospalvelu.fi), which is run by the same operator. In addition, your profile picture (only a picture you uploaded yourself, not the default forum avatar) and your nickname are passed to the same results service only if you have separately allowed it in your profile settings. Sharing is available to adult members only: the picture of a member under 18, or of a member who has not stated an age group, is not passed on. You can withdraw the permission at any time, and the picture is then removed from the results service. For the technical operation of the service we use a web host (a data processor; Domainhotelli, Planeetta Internet Oy; according to the agreement the data centers are mainly in Finland; any transfers outside the EU/EEA require the safeguards defined in the agreement).

6. Your rights

You have the right to check your data, have it corrected, ask for its deletion, restrict processing, and object to processing based on legitimate interest. You can download your own data as a machine-readable file in your settings. Send other requests to the contact address above; we reply within one month.

If you believe that we process your data unlawfully, you can complain to the supervisory authority: the Office of the Data Protection Ombudsman.

7. Security

Passwords are stored only as hashes. Forms are protected against forgery, the number of login attempts is limited, and two-factor authentication is mandatory for moderators and administrators and recommended for other members. If we detect a data breach, we will notify those concerned and, where required, the authority within the time set by law.

8. Changes

We update this notice when processing changes. The current version is always on this page.