PRIVACY POLICY

When you register an account, we collect:

• Player name (chosen by you)

• Email address (for account activation and password recovery)

• Password (stored as a one-way cryptographic hash - we cannot see your password)

• Language preference

Each time you log in, we record:

• IP address

• Browser type (user agent)

• Date and time of login

This data is kept for up to 90 days and is used exclusively for security purposes (detecting unauthorized access, investigating abuse).

To maintain fair gameplay and detect multi-accounting or bot usage, we collect technical browser identifiers upon login. These include a hashed combination of:

• Canvas and WebGL rendering signatures

• Screen resolution and browser properties

• Timezone and language settings

• A locally-generated device identifier

All fingerprint data is cryptographically hashed before storage - we do not store the raw values. This data is collected under the legal basis of legitimate interest (protecting game integrity and the experience of all players).

If you choose to make a voluntary donation to support the server, the payment is processed entirely by PayPal. We never see, receive, or store your credit card number, bank details, or PayPal password.

What we do store:

• PayPal transaction/order ID (for reference and dispute resolution)

• Donation amount and currency

• Date and time of the transaction

• In-game gold credited as a thank-you bonus

As part of normal gameplay, we store your game actions (villages, troops, battles, trades, chat messages, etc.). Chat messages are automatically pruned to the most recent 200 per channel.

• Session cookie (PHPSESSID) - strictly necessary for keeping you logged in. Expires when you close the browser.

• Language preference (lng) - remembers your selected language. Expires after 30 days.

• Cookie consent (cookie_consent) - remembers that you accepted this cookie policy. Expires after 365 days.

We do not use any third-party analytics, advertising, or tracking cookies. No data is shared with advertising networks.

• Contract performance - account data is necessary to provide the game service you registered for.

• Legitimate interest - security logs, anti-cheat fingerprinting, and abuse detection protect the integrity of the game for all players.

• Consent - non-essential cookies are only set after you accept the cookie banner.

• Legal obligation - donation/payment records are retained as required by applicable tax and financial regulations.

• PayPal - processes voluntary donations. PayPal has its own privacy policy at paypal.com/privacy.

• Cloudflare - provides DDoS protection and content delivery. Cloudflare may process your IP address and request headers as part of its security service. See cloudflare.com/privacypolicy.

• Hetzner - our server hosting provider, located in the EU (Germany/Finland).

We do not sell, rent, or share your personal data with any other third parties.

• Account data - retained for the duration of the game round. Deleted upon account deletion or when the server resets.

• Login logs - automatically deleted after 90 days.

• Anti-cheat data - retained for the duration of the game round.

• Chat messages - automatically pruned to the latest 200 messages per channel.

• Donation records - retained for up to 7 years as required by tax/financial regulations.

• Access - request a copy of your personal data.

• Rectification - correct inaccurate data (you can update your email and name in-game).

• Erasure - request deletion of your account and associated data.

• Portability - receive your data in a machine-readable format.

• Objection - object to processing based on legitimate interest.

• Withdraw consent - where processing is based on consent, you can withdraw it at any time.

We will respond to your request within 30 days. You also have the right to lodge a complaint with your local data protection authority.

• HTTPS/TLS encryption for all connections

• Passwords hashed with bcrypt (industry standard)

• CSRF protection on all forms

• Rate limiting on login and API endpoints

• Server hosted in the EU with firewall and automated backups