This is a translation. The German version is legally binding.
In short: Aurora only stores what it needs for playing. No ads, no tracking, no analytics, no social media buttons, no fonts or scripts from other servers. Nothing is sold or passed on. Aurora needs the shared account of all games; its name and password are kept on the selection page. Below is every single piece of data that comes up here.
Müller & Wulff GmbH
Hans-Fallada-Str. 20
D – 17489 Greifswald
E-Mail: info@mueller-wulff.de
This is the complete list. Anything not listed here is not stored.
A random string, only while you are signed in. It is set by the selection page for all games at once – that’s why you are signed in everywhere.
“de” or “en” – only if you switch the language at the bottom of the page.
Only from older versions: in localStorage under aurora:ton the volumes of music and sounds. Nothing new is stored there; if the game finds this entry and you have no settings yet, it takes the volumes over into your settings once (see below) and reads it no more.
At most one per hero: which hero, which rift level, the random number the rift is made from, the map, when it was entered, when the guardian fell, and the latest report your browser sends every 10 seconds and when you leave the page (monsters defeated by kind, charge, points, playing time; plus the rift's state, so it goes on after a reload: the hero's life, mana, potions, cooldowns and position, the living monsters, open rifts, the guardian, bowls, sparks, crystals, lanterns and gates) with the result of the check whether the numbers add up; after the guardian, what is in the light bag (the items rolled and the gold). Also the dungeon modifiers; when you look at a level at the Aurora flame, the server keeps the modifiers rolled for it until your next run there.
Your account name, when you first opened Aurora and when the account was created. The name and password hash themselves belong to the shared account on the selection page.
For each hero (6 at most): the name you give it, its look (figure and light colour), whether it plays in Ironman mode, when it was created, its level and experience, the deepest rift cleared, the gear it wears and its inventory (the items with their rolled values), the stars set in the Firmament, what lies on the ability bar, its Northern Light levels and points, and the merchant's wares for this hero. For each item also its durability and how often it was reforged.
Once you set something in the menu (Esc): key bindings, which mouse button walks, zoom range, screen shake, damage numbers, life bars, interface size, graphics (quality, particles, resolution, shadows, frame rate), colour-blind mode, larger text and the volumes. The language stays in the lang cookie. Also which hero you played last, so the start page shows them.
One stash per account (and a separate one for Ironman heroes): the items stored in it, the number of tabs bought, your gold and the smith's material.
When an Ironman hero dies it is taken from your list of heroes; remembered are its name, look, level, Northern Light level, the rift it fell in, its deepest rift, the cause of death and the date. Only you see this list.
When a hero reaches the Aurora after the guardian and it is their best run so far, they are entered into the list of the running season and into the all-time list: their name, look, level, Northern Light level, whether Ironman, the rift level, the run's points and duration, the date, and a snapshot of their gear, stars and ability bar at that moment. Internally the entry notes which account it belongs to, so it can be deleted with the hero or account. All signed-in players see the hero's name, look, level, rift, points, duration, date, abilities, keystones and the gear of that run. Your account name appears nowhere. When an Ironman hero dies, their entry stays with a cross.
No email address, no real name (unless you choose it as your account name), no IP addresses – neither by the app nor by the web server –, no device fingerprint, no clicks, no referrer, no statistics about your behaviour. There is no profiling and no automated decision-making about you (Art. 22 GDPR).
A cookie banner is only required when a site stores things on your device that it doesn’t need for the service itself – for ads, tracking or statistics, say. This site doesn’t. The cookies and the sound setting are strictly necessary for the game you opened, or keep the language you explicitly chose (§ 25 (2) no. 2 TDDDG). No consent is needed for that – only this notice.
The site is hosted by: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland (eigener Root-Server im Rechenzentrum Nürnberg).
To deliver a web page at all, the server briefly has to process your IP address. Neither the app nor the web server writes access logs. On technical errors they log an error message with the address requested, but without IP address and without details of your browser; these messages are kept in limited amounts only and then overwritten automatically. The legal basis is our legitimate interest in secure and working operation (Art. 6 (1) (f) GDPR).
Data goes to no one. The hoster only runs the data centre and hardware the server runs on; it may technically come into contact with connection data, e.g. to fend off attacks. All data stays in Germany; nothing is transferred to countries outside the EU.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can do most of it yourself:
Right to object (Art. 21 GDPR): Where we rely on legitimate interests (delivering pages, server error messages), you can object at any time on grounds relating to your particular situation – an email is enough.
You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example: Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern, Werderstraße 74a, 19055 Schwerin.
Last updated: Oktober 2026