Privacy at L2Pilot

Version of 29 September 2026.

In short: we collect only what L2Pilot needs to work and to protect against abuse. We do not see the game picture, your clicks or your passwords.

This note covers the L2Pilot PC program, the app.l2pilot.com app, the L2Pilot server and this website. The rules for using L2Pilot are set out in the Terms of Service.

Who is responsible for your data

The controller is IMBA Wojciech Perzyński, a sole proprietorship in Poland. For anything about your data, write to contact@l2pilot.com. We have not appointed a data protection officer, so you write to us directly.

What we collect, why and for how long

Data	Why	How long
Account nickname, usually your in-game nick, and whether the account was self-registered or created with an invite code. You choose the nickname when you create the account, or we set it together with the invite code.	So that people in your group know who is who and can check that nobody is impersonating someone else (Terms § 18).	While you have an account
Your devices: public key, device name and type, which device added it, app version, and the dates it was added, last connected and revoked.	Signing in without a password and checking that a device is yours.	While you have an account; the record of a revoked device, without its name, also after the account is deleted, for as long as L2Pilot runs (see “Your other rights”)
Groups, group memberships, thumbs-up and licences.	So that groups, connection permissions and PC licences work.	While you have an account
The version of the Terms accepted on your account in the app (when creating the account, when entering a recovery code or in the notice of a change) and the time of acceptance, and the newest version whose notice of a change the app showed on a device of your account, with the time it first showed it.	Proof of which version of the Terms applies to you (Terms § 7(2) and § 26(3)), and so that the app does not ask you to accept on every device separately.	While you have an account; after the account is deleted, as long as the copy of our decision about your account in the service database, if there is one (the row on the copy of a decision)
Device revocation notifications: which device was revoked and which PCs (yours and those of people in your groups) must learn about it.	Security: a PC that was switched off rejects the revoked device once it is back on, even when you no longer share a group or the account was deleted.	30 days after delivery to the PC; if never delivered, at most 180 days
Record of which PCs must withdraw their thumbs-up for an account recovered with a recovery code.	Security: a PC that was switched off withdraws the thumbs-up for the recovered account once it is back on, before anyone connects to it.	Until those PCs confirm it and 30 days after; without confirmation until that PC is revoked or the recovered account is deleted
Invites to L2Pilot and to groups: who issued them, who used them and a label, e.g. the invited person's nick.	Creating accounts and joining groups.	30 days after use or expiry
Session history: who connected to which PC, when, for how long, whether directly or through the relay, and why the session ended.	Security and troubleshooting connection problems.	90 days
IP address on every connection to the server, sign-in, account creation, adding a device and exceeded attempt limit.	Protection against abuse, e.g. code guessing.	30 days
Content reports, our decisions about content and accounts (with the statement of reasons and, when we change a name, the name before the change; when we terminate the agreement, also the nickname, licences and groups the account ran), and appeals and complaints about these matters.	Handling the report, the appeal and the complaint, giving reasons for the decision, carrying out an upheld appeal or complaint, defending legal claims.	7 months from the decision; longer if an appeal, complaint or dispute is still going on (until it ends) or if we upheld an appeal or complaint that has not yet been carried out (until it is, at most 30 days after our reply); a decision under which an account is blocked is also kept until the account is unblocked or deleted
A copy of our decision about your account in the service database: its identifier, kind (termination of the agreement, also together with a block of the account, another measure under Terms § 22(1) or a request to stop a breach), the statement of reasons we wrote, the date of the decision, the appeal deadline, for a termination the account deletion date, and when and on which device of your account the app first showed the decision.	So that the app can show you the decision with its reasons, even when we do not know your e-mail address, and so that it is known when the decision reached you (Terms § 22(5) and § 25(8)).	7 months from the decision; longer in the same cases as the record of the decision in the row above (including while the account is blocked under this decision). When the account is deleted, we delete the statement of reasons from the copy
Nickname of an account deleted after our decision, reserved in the service database.	So that nobody takes it before an appeal is decided.	As long as the record of that decision (reports and decisions row)
Nicknames of people to whom we issue invite codes, reserved for them (e.g. before registration opens).	So that nobody takes the nickname of a person to whom we issue an invite code.	Until that person creates an account; if they do not, 30 days after the invite code expires, and if we do not issue them a code, 30 days after the reservation
Log of changes to accounts and licences.	Accountability: who changed what, and when.	180 days
Technical commands: commands from your device to your PC (e.g. end the session) and our administrative commands concerning your account or device (identifiers, no nickname; a name in a rename command only until it is carried out).	Carrying out the command and accountability.	Commands to a PC up to 24 hours; administrative commands 30 days after they are carried out
One-time credentials for the connection relay.	Connecting when devices cannot reach each other directly.	1 day after expiry
Backups of the database and of the whole server.	Restoring the service after a failure.	30 days
Your e-mail address, if we know it, the licence codes we issued to you (the code's id, not the code itself, and the date it was issued), and the dates of notices of changes to the Terms sent to you by e-mail and the version accepted on your account, if your acceptance reached us by e-mail (proof of which version of the Terms applies to you). An acceptance in the app is recorded on the account (the row on the Terms version); we enter it here only exceptionally: an acceptance ticked when entering a recovery code we issued, if it was not recorded on the account.	Issuing the invite code and the licence code, and the notices the Terms provide for: statements of reasons for our decisions, notice of termination and requests to stop a breach (Terms § 25(6)(a)), changes to the Terms.	While you have an account; if you do not create an account after we issue the code, 30 days after that code expires; the entry of a licence code nobody used, 30 days after that code expires or is voided
If you write to us or we write to you (by e-mail or by letter): your e-mail address or postal address and the message.	Replying, handling your matter and the notices under the Terms.	Until the matter is handled; data protection requests for 12 more months as proof we handled them; complaints that do not concern our decisions for 12 more months after our reply, as proof that we handled them; correspondence about a decision for as long as we keep the record of that decision (given above).

Backups are snapshots of the whole database, and the daily backups of the whole L2Pilot server at Hetzner Online GmbH also include the encrypted documents described below. So data from the table can survive in them for up to 30 days longer than the period given, e.g. an IP address for up to 60 days in total. We use backups only to restore the service after a failure.

Server process logs contain no IP addresses, codes, tokens or signatures and are deleted after 30 days.

We also use the IP address logged when an account is created for the limits on new accounts per network, under Art. 6(1)(f) GDPR, and we store recovery codes and licence codes only as an irreversible hash (SHA-256).

What we do not collect

The game picture, or what you click and type. Picture and control travel over an encrypted connection between the devices; the L2Pilot server does not see them.
We read nothing from the game: no window titles, no character names. We do not know your game passwords.
Cookies, analytics or ads. There is no tracking on l2pilot.com or app.l2pilot.com.

The browser app creates your device key as non-exportable: the app itself cannot read or send it, so it never reaches us.

Who else sees your data

Anyone you give a thumbs-up can see the public IP address of your computer. Likewise, the PC you connect to can see the public IP address of your phone or laptop. This happens in every session, even when the picture goes through the relay.

A person with your thumbs-up also sees everything in the game window, including your private messages.

Members of your group see your nickname, role and join date, whether the account was self-registered or created with an invite code, and the date it was created, as well as the list of your devices (names, type, public key, which device added it, dates added and revoked). For each of your PCs they see: whether it is offline, online, ready, needs attention, busy, unlicensed or needs an update; the state of the game window (in front, in the background, minimised, hidden, closed, screen locked) and since when; the program version and, when the PC's licence has expired, the date it expired; and, when the PC is busy, also who is controlling it.

If someone reports content related to your account (Terms § 21), we give them our decision about that content (e.g. that we changed a name or found no breach) and information on how to appeal, because Article 16(5) of the Digital Services Act requires it. We also tell them briefly why we decided so; we do this in our legitimate interest in handling the report and the appeal properly. We do not tell them what other measures we applied to your account, and we do not give them the statement of reasons we send to you. If we give you back the founder role of a group after upholding your appeal or complaint (Terms § 9(4) and § 22(6)), its current founder will learn from us that we are giving it back to you because we upheld your appeal or complaint.

These companies process data on our behalf under data processing agreements:

Hetzner Online GmbH (Germany): the L2Pilot server and database, in the Falkenstein data centre, and on that server, outside the database, also the encrypted messages and documents we keep (described below), and daily backups of the whole server.
Cloudflare, Inc. (USA): sits between you and the server (it sees your IP address and the traffic to the server), serves l2pilot.com and app.l2pilot.com and the installer and update files on dl.l2pilot.com, forwards e-mails sent to contact@l2pilot.com and runs the connection relay. The relay sees the IP addresses of both sides, but picture and control pass through it encrypted.
UW-TEAM.ORG Jakub Mrugalski (Poland, the Mikrus service): stores database backups on a server in Finland.

Cloudflare forwards e-mails sent to contact@l2pilot.com to our Gmail mailbox. Its provider is Google Ireland Limited (Ireland). We use Gmail on Google's standard terms, without a separate data processing agreement, so Google stores these messages under its own rules (Google Privacy Policy) and may transfer them to Google LLC in the USA under the European Commission's decision on the EU–US Data Privacy Framework. We also reply to messages and send the notices under the Terms from this mailbox, so Google also processes the recipient's address and the content of these e-mails; the sender is then our gmail.com address. The records of our decisions, reports, appeals, complaints and data protection requests, together with the correspondence that belongs to them, and the list that links nicknames to e-mail addresses and records the licence codes issued (their ids and issue dates), the dates of notices of changes to the Terms sent by e-mail and the versions accepted that way (exceptionally also the version accepted at a recovery code we issued, see the table), are kept encrypted on the L2Pilot server (Hetzner Online GmbH), outside the database. The exception is the text and the dates of our decisions about accounts: we also keep a copy of them in the service database, so that the app can show them (see the table). We delete them from the Gmail mailbox, including sent mail and the bin, as soon as we have moved them to the server, and other e-mails as soon as the matter is handled. We delete them from the server by the end of the periods given in the table at the latest. We scan a paper letter, keep the scan in the same way as e-mails and destroy the paper.

Cloudflare is a US company and the relay runs in the data centre nearest to the device, so data may leave the European Economic Area. Transfers to Cloudflare in the USA rely on the European Commission's decision on the EU–US Data Privacy Framework, under which Cloudflare is certified. When data goes to another country outside the EEA, or if that decision stopped applying, it is protected by the standard contractual clauses in Cloudflare's data processing agreement.

We do not sell data and do not share it with advertisers.

Legal basis

Art. 6(1)(b) GDPR: what we need to provide the service you use (account, devices, groups, thumbs-up, licences and connections), and issuing the invite code and the licence code, recording which version of the Terms applies to you, sending the notices the Terms provide for and showing them in the app, and handling your appeals and complaints (Terms § 7, § 21, § 22, § 23, § 25 and § 26).
Art. 6(1)(f) GDPR: our legitimate interest in security and abuse prevention (IP addresses, session history, change log, administrative commands, device revocation notifications, records of thumbs-up withdrawn after an account recovery, reserved nicknames, records of revoked devices and deleted accounts), backups, replying to messages, handling appeals by people who reported content and have no account, telling people who reported content the reasons for our decisions, keeping records of our decisions about accounts (including when a decision reached you and which version of the Terms applied to a deleted account), and defending legal claims.
Art. 6(1)(c) GDPR: handling your requests for access, deletion and your other rights, because the GDPR requires it of us, and receiving and handling content reports and giving reasons for decisions we take because of content, because Articles 16 and 17 of the Digital Services Act (Regulation (EU) 2022/2065) require it.

We do not rely on consent. We do not profile you and make no decisions about you based solely on automated processing that have legal or similarly significant effects on you. Only technical safeguards are automatic, e.g. a one-hour block after 10 wrong codes from one IP address.

Right to object

You can object at any time, on grounds relating to your particular situation, to our processing of your data based on our legitimate interest (IP addresses, session history, change log, administrative commands, device revocation notifications, records of thumbs-up withdrawn after an account recovery, reserved nicknames, records of revoked devices and deleted accounts, backups, messages, appeals by people who reported content and have no account, telling people who reported content the reasons for decisions, records of decisions). We will then stop, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed to establish, exercise or defend legal claims. Write to contact@l2pilot.com.

Your other rights

You can ask for access to your data and a copy of it, for correction, deletion or restriction of processing, and for portability of the data we process to provide the service (account, devices, groups, thumbs-up, licences). Write to contact@l2pilot.com; we reply within one month at the latest.

After the agreement ends, we block the account and delete it within one month at the latest. If we terminated the agreement, we set the deletion date no earlier than 14 days after the day the notice of termination reached you, and give it in the statement of reasons. If, before that date, you appeal against the termination or the block or make a complaint about it, we do not delete the account before we have decided the appeal or complaint. If we do not find in your favour, we delete it within 14 days of our reply at the latest, but not before the date given; what happens to the account when we find in your favour is described in the Terms (§ 22(6) and § 25(8)). When we delete an account, we revoke its devices and delete their names, the memberships, thumbs-up, licences, licence seats and invites. The nickname is replaced with a deletion marker, and the identifiers in the session history and change log are replaced with their hash.

After the account is deleted, only these remain:

the records of the revoked devices without their names (identifier, public key, type, which device added it, that device's signature with its date, the dates it was added and revoked) and the record of the account they belong to, without the nickname (its identifier and the dates it was created, blocked and deleted), without a time limit, for as long as L2Pilot runs, so that other people's computers and our server keep refusing these devices;
for the period given in the table, the revocation notifications for the computers of people in your groups;
for the period given in the table, the IP addresses recorded when your devices connected;
for the periods given in the table, the session history and the change log, in which your identifiers are replaced with their hash (this is still personal data, only pseudonymised: the identifiers of your revoked devices and of your account remain, so the hash can be linked back to them);
for the periods given in the table, the reports, our decisions, the appeals and complaints concerning your account, and our correspondence with you;
for the period given in the table, the copy of our decision about your account in the service database, without the statement of reasons, and, while that copy exists, the Terms versions recorded on the account (the one accepted and the one whose notice of a change the app showed) with the time of acceptance and the time the notice was first shown;
if we deleted the account after our decision, for the period given in the table, your nickname reserved in the service database;
for the periods given in the table and in the paragraph on logs, the technical commands, the one-time relay credentials and the server process logs;
groups your account created, for the other members (we change a default name containing your nickname to “Grupa”).

Your nickname and device keys stored on the computers of people in your groups stay with them, out of our reach. Backups lose the data within 30 days at the latest.

You can lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, or electronically via ePUAP or biznes.gov.pl; uodo.gov.pl), or with the data protection authority in the EU or EEA country where you live, work or where the infringement took place.

Do you have to provide data

No, but L2Pilot does not work without it: without a device key you cannot sign in, and without an IP address no connection can be made.

You can create an account without giving us any contact details (Terms § 7(3)). If we do not know your e-mail address, the app shows you on a device of your account the statement of reasons for our decision, a notice of termination, a request to stop a breach and a notice of changes to the Terms (Terms § 22(5), § 25(8) and § 26(3)). If you no longer have any device of your account, you can ask for a statement of reasons by writing to contact@l2pilot.com (Terms § 22(5)), and we will pass on a notice of termination or a request to you as soon as you contact us (Terms § 25(8)).

Changes

When we change this note, we change the version date at the top of the page.