Privacy policy

This game runs on a self-hosted server. Your data stays on that machine: there is no cloud provider, no analytics, and no third party we would sell or hand it to. There is exactly one exception, sending e-mail — described in detail below.

What we store about you

• User name — you choose it. Other players see it on the map, in the rankings and in reports.
• Password — we do not store the password itself. Only a check value derived from it, from which the password cannot be recovered.
• E-mail address — giving one is optional. We send the forgotten password reset link to it and — if you ask for them in the settings — your account's notifications (an attack was launched against you, a village of yours was conquered, you got a message or a tribe invitation, a sign-in from a new address; all of them are off by default). Notifications only go to a confirmed address: to confirm it we send a link to the address, and you have to open it. The new-world notification is a separate list, not this — see the next section.
• The state of your game — your villages, armies, resources, messages, reports, tribe membership, your notebook and your profile text.
• Your relationships in the game — who you share a tribe with, who your friends are, whom you have blocked, and — if you came with an invitation — who invited you. The latter is kept because the invitation reward can only be paid out once, and only to the person entitled to it.
• Sign-in tokens — a cookie in the browser, and a token for the phone app. Next to the phone token we store the device name and when it was last used, so that you can tell your signed-in devices apart and revoke one.
• What you write to support — the subject and text of the cases you open, and our replies. The operator reads these: that is their purpose. Do not put a password in them — we never ask for it, and we do not need it.
• The IP addresses you connect from — for fair play (one player, one account) we record, per account, which addresses you connected from, with the time of the first and last connection and their count, for 30 days. If two accounts play from the same address, the game master may review the addresses of both, and if for days they only ever connected from that one address, the accounts may also be banned automatically. If you share your internet connection with others, you can mark this in the settings: then there is no automatic ban, only a review. For the limit against guessing at sign-in and registration we only keep the address in memory. Against bots, at registration (and at sign-in after several wrong passwords) your browser solves a short computing task; nothing is sent to a third party for this, and it uses no cookies. In addition, actions taken on the game master panel are kept in a log, which includes the time of the action and the address of the request. That is the OPERATOR'S own trail, not yours — and it exists precisely so that it can be checked afterwards who touched your account.
• Your sign-in history — we record the time, the way (browser or phone), the result and the address of every sign-in attempt, so that on the Devices page of the settings you can see when and from where your account was signed in to. For attempts with a wrong password we do not store the end of the address (it may belong to a stranger). At most fifty entries, for 30 days; your sitter cannot see it. If someone signs in from an address not seen before, you get a notification, and an e-mail if you asked for one — that one includes the address.
• Uploaded pictures (tribe logo, village picture, profile picture) — the server resizes and re-encodes them on upload, so the photo's hidden data (such as where it was taken) is not kept. A replaced or removed picture — and, after the account is deleted, your profile picture and the pictures of your villages — disappears from the disk within an hour.

Sending e-mail: the only third party

The game only sends e-mail when you ask for it: the forgotten password and address confirmation links, the notifications you switch on in the settings, and if you sign up to be told when a new world starts. The latter needs no account, and the address you give is on a separate list — we do not link it to player accounts.

What you should know about it:

• That is all. No newsletter, no win-back messages, no advertising. At most one notification of each kind goes out per quarter of an hour, and at most thirty a day to one address.
• Every new-world e-mail has an unsubscribe link, one click, no sign-in needed. Unsubscribing deletes the address from the list, it does not just mark it. You can switch your account's notifications off in the settings at any time.
• The e-mail passes through a mail server. That is the third party mentioned at the top of this page: that server sees the recipient's address, as with any e-mail. We encrypt the connection if that server offers it. If e-mail sending is not set up on the server, nothing goes out, and the list stays untouched.

What you make public

A few things can be opened without signing in — but only if you yourself decide so:

• Shared battle report. If you share a battle report, you get an unguessable address for it. Anyone who knows the address can see the report — including the names of both sides, not just yours. Sharing can be revoked at any time, after which the address no longer opens. Scouting reports deliberately cannot be shared: they show the other player's current state, not a battle that happened.
• If you post the link somewhere public — a chat, a social site —, that service fetches the page for its preview, and from then on search engines may find it too. That is the nature of sharing, not something we do: an address sent in a message to a friend goes nowhere.
• Invitation link. Your invitation address contains your code, not your name. Whoever enters the code has it recorded in their account that you invited them.
• Inside the game your name, the names and locations of your villages, your points and your profile text are visible to every player. That is the basis of the genre: a map on which you cannot see your neighbours is not a map.

Reports and moderation

If you report a player or a message, we store a copy of the reported text together with the report. This is needed because the reported person can rewrite their profile later, and the recipient can delete the message — without a copy the operator would be looking at an empty space.

The report records who reported whom, when and why. These entries remain after the account is deleted: a moderation trail that the reported person could make disappear by deleting their account would be worth nothing.

Account sitter: if another player runs your account

You can appoint another player as account sitter, who plays in your name while you are away. They then see everything you see: your messages, your reports, your villages. So only appoint someone you trust.

What a sitter cannot do: delete your account, or sign you out of your own phone. Sitting is for running the game, not for locking you out of your account.

The operator's access

To say it plainly: the game master running the server has technical access to everything on the machine — including your messages —, and can change your password. This is true of every game running on its own server; anyone claiming otherwise is not telling the truth.

What this does not mean: they cannot see your password, because we do not store it. The entrance to the panel is protected by an attempt limit and expiring sessions — not to protect you from the operator, but so that nobody else can get in in their place.

What we do NOT collect

No analytics, no advertising, no trackers, no advertising ID and no location. The app does not ask for access to your contacts, photos, camera or microphone.

We do not measure who saw what either. For the pop-up cards, your phone remembers which ones you have closed — that data stays on your device and never reaches us.

Permissions. The only permission the app asks you for is notifications — so that we can tell you about an incoming attack. You can refuse it, and the game still works. The permissions granted at install time without asking are: internet, network state, keeping the device awake, starting after a reboot and background work — these are needed so that the attack watcher can run in the background as well. None of them can be used to collect data about you.

Why we store it

So that the game works: to recognise your account, to keep the state of the world, and so that you can interact with other players. We do not use it for anything else, and we do not sell it.

For how long

As long as your account exists. Deleting the account ends your data — the deletion is immediate and cannot be undone. It also takes your sign-in tokens, your market offers, your support correspondence, the public addresses of your shared reports, your sign-in history, your password reset links and the log of the IP addresses you connected from. Even without deletion we forget an IP address after 30 days; a suspicious account pair (with the shared address) is kept for at most 90 days after it is closed. If the game master decided that a pair is fine, we keep that decision with the two account names — without any address — until the accounts are deleted, so that the pair is not suspected again.

A closed support case is kept for one more month after closing, then disappears by itself. Not because it has to be: because you need to be able to see our reply, and for a recurring question the history is half the answer. Even within that month only your last twenty cases are kept; older closed ones drop out, so that no single account can bloat the backups without limit. Open cases are never removed this way.

About backups. The server makes backups regularly and discards the old ones. The data of a deleted account can therefore remain in the backups for at most one day, after which it is gone from those too. Without backups a disk failure would take everyone's world — which is why we keep them for this long.

What remains after deletion, and why:

• Your name in other players' reports and messages: those are the other player's own data, their conversation. The text of your tribe forum posts also remains (it is the tribe's conversation), but it is shown as written by “deleted player” instead of your name.
• Your votes in the game master's polls, but without your name: the result of a closed poll must not change afterwards.
• The reports (complaints) you made or that are about you — for the reason described above.
• If you invited someone, the invitation key in their account: without it their reward could be paid out twice afterwards.

Your rights

You can view your data in the game at any time, correct it in the settings, and delete your account at any time. If you have a question, or cannot sign in, contact the operator of the server.

Children

The game is not made for children, and we do not knowingly collect data from anyone under 13.

If this policy changes

This page is generated from the game's code, so it changes together with server updates. If we ever start collecting something new, you will read about it here — and if that requires consent, we will ask first.