Effective: May 13, 2026
1. Introduction
Proof of Taste GmbH ("Company", "we", "us") operates District ("Application"), a virtual reality DJ application distributed via Steam. This Privacy Policy explains how we collect, use, and protect your personal data when you use the Application.
This Privacy Policy covers the Application only. Our Marketing Website (district.berlin) has its own privacy notice covering cookies, newsletter signups, and website analytics.
We process your data in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection law (Bundesdatenschutzgesetz, BDSG).
2. Data Controller
Proof of Taste GmbH
Brunnenstr. 28
10119 Berlin, Germany
Email: privacy@district.berlin
3. What Data We Collect
3.1 Account Data — via Steam authentication
| Data | Purpose |
|---|---|
| Steam ID | To identify your account and authenticate you |
| Account creation timestamp | To manage your account |
| Privacy consent confirmation | To document your acceptance of this Policy and the EULA |
3.2 Gameplay Data — generated through your use of the Application
| Data | Purpose |
|---|---|
| Login timestamps and session events | Session management, daily login rewards, inactivity detection |
| In-game currency balance ($CD) | To track your virtual currency |
| Game settings and preferences | To remember your control and display preferences |
| DJ equipment configuration | To save your deck setup |
| Digital asset ownership records | To track content you have unlocked in the Application |
| Gameplay milestones and progression | To manage the progression system |
| Tutorial completion status | To track onboarding progress |
| Purchase events (asset name, $CD spent, balance changes) | To record content unlocks and currency transactions |
3.3 Technical Data
| Data | Purpose |
|---|---|
| IP address (transient) | Server connection, security, rate limiting; not stored long-term |
3.4 Optional — only if you choose to use these features
| Data | Purpose |
|---|---|
| Avaturn account link | To import a custom avatar from your existing Avaturn account |
Important regarding Avaturn: We do not send any data (such as photos or biometric information) to Avaturn. If you choose to link your Avaturn account to import an avatar you have already created, the data exchange is between you and Avaturn under Avaturn's own privacy terms (avaturn.me/privacy-policy). We only receive the avatar mesh data necessary to render your avatar in the Application.
3.5 What We Do Not Collect
- We do not collect your email address, real name, or physical address
- We do not collect payment or financial information — all purchases of the Application are handled by Steam
- We do not collect Headset tracking data, hand or body movement data, or other VR pose data
- We do not collect voice or microphone input
- We do not use cookies or tracking technologies inside the Application
- We do not use third-party analytics, telemetry, or advertising services
- We do not share your data with advertising networks
4. Legal Basis for Processing
We process your data based on the following legal grounds under GDPR Article 6:
| Legal Basis | Data | Explanation |
|---|---|---|
| Contract performance (Art. 6(1)(b)) | Steam ID, $CD balance, asset ownership, game settings, deck settings, milestones, tutorial status, purchase events | Necessary to provide the Application's core functionality |
| Legitimate interest (Art. 6(1)(f)) | Login timestamps, session events, technical logs, IP address (transient) | Necessary for security, fraud prevention, technical operation, and the daily reward system |
| Legitimate interest (Art. 6(1)(f)) | Account suspension or sanction events | Protecting other users and the Application from abuse, in accordance with our EULA |
| Legal obligation (Art. 6(1)(c)) | Documentation of EULA and Privacy consent, DSA reports and moderation activity | Compliance with consumer protection law and the Digital Services Act |
| Consent (Art. 6(1)(a)) | Avaturn avatar link | Only processed if you choose to link your Avaturn account |
5. Recipients of Your Data
We do not sell, rent, or share your personal data with third parties, except as set out below:
5.1 Steam / Valve Corporation
Your Steam ID is used for authentication and may be used by us to send you Steam Notifications regarding important Application events (e.g., upcoming content license expiration, EULA changes, or service discontinuation). Steam's processing of your data is governed by Steam's own Privacy Policy: store.steampowered.com/privacy_agreement
5.2 Railway (hosting provider)
Our backend is hosted on Railway Corp. Servers are located in Frankfurt, Germany (EU). Railway processes data on our behalf as a data processor under a data processing agreement.
5.3 Discord (backend logging)
We use Discord's webhook feature to log certain backend events for operational monitoring and bug detection. The events logged include:
- New user registration (Steam ID, internal user ID)
- Daily login events (Steam ID, $CD balance)
- Purchase events (internal user ID, asset, $CD spent)
- Milestone completion (Steam ID, milestone)
- Privacy consent confirmation
Discord, Inc. (USA) acts as a data processor for this purpose under Discord's standard Data Processing Addendum. Discord is certified under the EU-U.S. Data Privacy Framework, which provides an adequate level of data protection for transfers to the United States.
5.4 Avaturn — only if you choose to use it
If you choose to link your Avaturn account, data is exchanged between you and Avaturn directly. We do not send personal data to Avaturn; we receive your avatar mesh data which you have created in your Avaturn account. Avaturn's privacy notice applies to data they hold about you: avaturn.me/privacy-policy
5.5 Legal obligations
We may disclose data if required by law, regulation, court order, or legal process, or to protect the rights, property, or safety of our users, our Company, or third parties.
6. Storage and Security
- All Application data (Steam ID, $CD balance, asset ownership, gameplay data) is stored on servers located in Frankfurt, Germany (EU) operated by Railway Corp.
- Communications between your device and our servers use industry-standard encryption (HTTPS/TLS).
- Access to user data is restricted to authorized personnel only.
- We implement appropriate technical and organizational measures (TOMs) to protect your data against unauthorized access, alteration, disclosure, or destruction.
7. Data Retention
| Data category | Retention period |
|---|---|
| Active account data | While your account is active |
| Inactive accounts | If your account is inactive (no playtime sessions) for more than 24 months, we may delete your data after notifying you via Steam Notification (where possible) |
| Account-deletion requests | Account and personal data permanently deleted within 30 days |
| Backup copies | Backups may retain copies of deleted data for up to 30 days before being overwritten |
| Discord operational logs | Retained in the Discord channel for up to 90 days, then rotated out |
Note: $CD and unlocked content separately expire after 12 months of inactivity as set out in the EULA (§ 3). This is a contractual rule, not a data-retention rule.
8. International Data Transfers
Your data is stored and processed within the European Union (Frankfurt, Germany).
The single exception is logging data sent to Discord (a US-based service) as described in section 5.3. This transfer is protected by Discord's certification under the EU-U.S. Data Privacy Framework.
9. Your Rights Under GDPR
You have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Right of access (Art. 15) | Request a copy of all personal data we hold about you |
| Right to rectification (Art. 16) | Request correction of inaccurate data |
| Right to erasure (Art. 17) | Request permanent deletion of your data |
| Right to restrict processing (Art. 18) | Request that we limit how we use your data |
| Right to data portability (Art. 20) | Request your data in a structured, machine-readable format |
| Right to object (Art. 21) | Object to processing based on legitimate interest |
| Right to withdraw consent (Art. 7(3)) | Withdraw consent at any time (for consent-based processing, e.g., the Avaturn link) |
How to exercise your rights: Send your request to privacy@district.berlin. Please include your Steam ID so we can identify your account. We will respond within 30 days as required by GDPR (extendable by two further months in case of complex requests, of which we will inform you).
If you believe we have not handled your request appropriately, you have the right to lodge a complaint with the supervisory authority in your country of residence. For Germany, this is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61, 10555 Berlin, Germany
www.datenschutz-berlin.de
10. Children's Privacy
The Application is not designed for children under 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected data from a child under 13 without parental consent, we will delete that data promptly.
For users between 13 and 17, we recommend the supervision or consent of a legal guardian. See also our EULA, § 18 (5).
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be communicated to you in advance via Steam Notification, Steam News, or via an in-Application banner, and will be posted at https://district.berlin/privacy-policy/game with an updated effective date.
For material changes, we will provide you with a reasonable period to review the changes before they take effect. If you do not agree with the changes, you may request deletion of your account.
12. Contact
For any questions about this Privacy Policy or your personal data:
Proof of Taste GmbH
Brunnenstr. 28
10119 Berlin, Germany
Email: privacy@district.berlin
Effective: May 13, 2026