Privacy Policy

The operator named at the bottom of this page, with its registration number, address and contact email, is the controller of your personal data under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Romanian data protection law. The operator keeps those details up to date, so what you see there is current.

Send any privacy question or request to the contact email shown below. A data protection officer, if the operator has appointed one, is reached at the same address.

• To create and run your account and let you play (performance of the contract with you, Article 6(1)(b) GDPR).
• To show your name, avatar and progress to other players as the game needs, in the map, rankings, syndicates and chats (the same basis).
• To keep the service secure and fair: stop abuse, cheating and attacks, limit request rates, investigate incidents and enforce the Terms and the Rules (our legitimate interest, Article 6(1)(f): keeping the game safe, fair and working for every player). You can object to this; see Your rights.
• To keep cookies and browser storage that are strictly necessary, such as your sign-in session and game settings. These do not need consent; see Cookies below and Cookie settings in the footer.
• To answer your messages and requests and to send you the emails you ask for or that protect your account: reset, confirmation and notice emails, ticket replies, moderation notices and inactivity warnings (contract, Article 6(1)(b), or our legitimate interest, Article 6(1)(f)).
• To meet legal duties, such as answering a valid request from an authority or keeping records the law requires (legal obligation, Article 6(1)(c)).

We do not use your data for advertising, we do not sell it and we do not build marketing profiles. If we ever want to use it for something that needs your consent (Article 6(1)(a)), we will ask first, and you can say no without losing access to the game.

Other players see only what the game shows them: your username, avatar and join date on your public profile (which anyone can open, even without an account); your family name, crest, power, rank, alignment and syndicate on the map and in rankings; and the messages you post in chats and announcements. Your email address, password hash, active play time and IP address are never shown to other players.

Members of the team see the account, ticket and moderation data they need for their role, and every action they take on accounts is recorded in an audit log.

Two kinds of providers process data on our behalf, under our instructions: the hosting provider of the servers that run the website, the game and the database, and the email delivery service that sends our emails. Write to the contact email to learn who the current providers are. At the time of writing we use no external analytics, advertising, social media widgets, tag managers or content delivery networks: the fonts and images you see are served by us. If this changes, we will update this policy first.

One check involves a third party. When you choose a password, we check whether it appears in known data breaches with the Have I Been Pwned “Pwned Passwords” range service. Our server sends only the first five characters of a one-way hash of the password, never the password, your email or your username, and your own IP address is not part of the request, so the service cannot tell which password or whose it is.

We may disclose data when the law requires it, to answer a valid request from a public authority, or to protect our rights and the safety of others.

• Account and game data: as long as your account exists. When you delete your account, the account, your family and the game data tied to it are removed from our live database straight away. A family that has not entered the game for 365 days is deleted automatically after warning emails; the account itself stays, and your gold, your unlocked slots and the compound customisation you bought are kept for the next family you found.
• Messages: a syndicate chat keeps only its latest 500 messages and an in-game mailbox holds at most 50 mails per player, and the surplus is removed automatically. Messages you posted in a syndicate chat can remain for the other members after you delete your account, without a link to it, and battle reports already delivered to other players can keep your family name.
• Sign-in sessions: until you sign out, and at most 30 days.
• Abuse-protection counters: from seconds to a few hours. One-time email links: password reset links are valid for 60 minutes, email change links for 30 and 60 minutes and password change links for 30 minutes, and they are removed once used, replaced, cancelled or expired.
• Server logs: kept in rotating files, where the oldest entries are overwritten automatically as new ones arrive.
• Backups: if we keep backups, data you deleted can remain in them until they are overwritten by the normal rotation.
• Messages to us: tickets are not deleted automatically when they are closed. We keep them as long as needed to answer and to show that we handled your request, and we delete one on request unless we still need it for a dispute or a legal duty. When you delete your account, your tickets stay, no longer linked to your account but still with the email address, name and messages you wrote in them.
• Moderation records and the team audit log: kept after a sanction ends, for as long as needed to recognise repeated breaches, review appeals and protect our rights. When you delete your account, the sanction list of your account is removed with it, but the audit log entries about you (your username, the action, the reason and the date) are kept.
• Records we must keep by law: as long as the law requires.

We use measures that fit the risk: encrypted connections (HTTPS), passwords stored only as salted Argon2id hashes, HttpOnly session cookies, protection against cross-site requests, rate limiting and sign-in throttling, restricted administrator access, team permissions that give each role only the data it needs, an audit log of team actions and regular software updates.

No online service is completely secure. If a breach is likely to put you at risk, we will notify the authority within 72 hours where the law requires it, and we will tell you without undue delay when the risk to you is high (Articles 33 and 34 GDPR).

We use cookies and similar browser storage (localStorage and sessionStorage), which are covered by the same rules. Today we use only the Necessary category: the sign-in session cookie, the record of your cookie choices and the small settings the site and the game remember on your device. The Marketing category exists, but nothing is used for it, and we use no analytics and no third-party cookies: no other company can store or read anything on your device through this site or the game.

Legal basis: under Article 4(5) of Romanian Law 506/2004 (which implements the ePrivacy Directive), storing or reading information on your device needs your consent, given after clear and complete information about the purpose, the lifespan and any third-party access. Article 4(6)(b) makes an exception for storage that is strictly necessary to provide a service you expressly asked for, and everything we use today falls under it. The personal data it links to is processed under Article 6(1)(b) and (f) GDPR. Marketing storage would be used only with your consent (Article 6(1)(a) GDPR), which is off by default, is not required to use the site or the game, and is asked again after 12 months or when we change what we use.

Retention: each item, with its name, type, purpose and duration, is listed in the Cookie settings window. The sign-in cookie lasts up to 30 days or until you sign out, the record of your choices 12 months, and the rest stays on your device until you clear it or close the tab. We keep no server-side copy of your choices.

How to choose and withdraw: use the Accept all or Necessary only buttons in the banner, or open Cookie settings in the footer at any time to see the full list, change your choices and withdraw consent as easily as you gave it. You can also delete cookies and site data in your browser settings; you will then be signed out and the game forgets its local settings.

For privacy questions and requests, write to the operator using the contact details below.