Privacy Policy

1. Who this applies to

This Policy applies to human players with accounts, and to anyone who uses a bot API key tied to an account. Neutral or AI-controlled factions in the world are not personal data subjects. If you do not agree with this Policy, do not use the Service.

2. Information we collect

2.1 Account & identity

• Authentication is handled by Clerk. Depending on how you sign in, Clerk may process email address, OAuth provider identifiers, name, and session metadata.
• We store a link from your Clerk user id to your in-game player record (display name, chosen race, timestamps, gold balance, and related flags).

2.2 Gameplay data

• Cities, resources, buildings, armies, units, formations, scripts, battle participation, alliances/pacts, and similar strategy state needed to run a multiplayer RTS.
• In-game mail you send or receive (subject, body, timestamps, read state).
• Gold transfers and other economy events associated with your player id.
• Pending actions you submit through the UI or API (intents processed by the game engine).

2.3 API keys (bots)

If you generate a bot API key, we store a one-way hash of the key and a short non-secret prefix for lookup. The full key is shown once at creation and is not recoverable from our database. Keys are scoped to your player and can be revoked by you.

2.4 Technical & security data

• Request metadata (IP address, user agent) in infrastructure and application logs.
• Rate-limit counters and short-lived cache entries in Redis (for abuse prevention and game-state polling performance).
• Health and operational metrics for Service reliability.

2.5 What we do not collect (v1)

We do not operate a real-money script marketplace in v1 and do not collect payment card data for UGC sales. If payment features are added later, this Policy will be updated before those features go live.

3. How we use information

• Provide, host, and secure the multiplayer Game and API.
• Authenticate sessions and bot keys; enforce ownership (tenant isolation).
• Process ticks, battles, economy, mail, and diplomacy.
• Prevent abuse (rate limits, fraud, cheating investigations).
• Respond to support and legal data subject requests.
• Improve balance, reliability, and features using aggregated or operational signals.

4. Legal bases (where applicable)

If GDPR or similar law applies, we typically rely on: contract (providing the Game you requested), legitimate interests (security, multiplayer integrity, anti-abuse), and legal obligation when we must retain or disclose information. Where consent is required, we will request it.

5. Sharing & processors

We share data with service providers that process it on our instructions, including:

• Clerk — authentication and session management.
• Neon — hosted Postgres for durable game and account state.
• Upstash (or equivalent Redis) — caching, rate limiting, job queues.
• Hosting (e.g. Fly.io or similar) — application compute and logs.

We do not sell your personal information. We may disclose information if required by law, to protect rights and safety, or in connection with a merger or transfer of the Service (with notice where required).

6. Multiplayer visibility

Some information is intentionally visible to other players as part of gameplay: public world map presence, leaderboard-style rankings, alliance membership, and content you send them (mail, diplomacy). Private city inventories, unrevealed armies, API keys, and your inbox are not meant to be readable by other players; we enforce account-scoped access in the application layer. No security measure is perfect—report suspected cross-account access immediately.

7. Retention

Account and game data are retained while your account is active and as needed to operate the world (including interactions with other players' history). Redis entries expire by design. Logs are retained for a limited operational period. After account deletion is completed, we remove or anonymize personal data except where we must retain limited records for security, dispute, or legal compliance.

8. Security

We use industry-standard practices appropriate to a multiplayer game API: encrypted transport (HTTPS), passwordless session verification via our auth provider, hashed bot API keys, per-player authorization checks, and rate limiting. No method of transmission or storage is 100% secure.

9. Your rights & requests

Depending on your location, you may have rights to access, correct, export, or delete personal data, or to object to certain processing. For v1:

• Export / deletion: contact us through the support channel published with the Game. We verify that you control the account (e.g. matching Clerk email), then operators export or delete data from Clerk and the game database according to our internal runbook. We will not claim success until the work is done.
• API keys: you may revoke keys in account settings at any time.
• Mail & profile: in-game tools may allow limited self-service; otherwise request help via support.

We may refuse or limit requests that are unfounded, excessive, or that would break multiplayer integrity for other players without a lawful basis (for example, wholesale deletion of battle history affecting others may be anonymized rather than fully erased).

10. Children

The Service is not directed to children under 13 (or the minimum age required in your country). If you believe a child has provided personal data, contact us and we will take appropriate steps to delete it.

11. International transfers

Processors may store data in the United States or other countries. Where required, we rely on appropriate transfer mechanisms provided by those vendors.

12. Changes

We may update this Policy by posting a new version on this page with a revised "Last updated" date. Material changes will be highlighted when practical.

13. Contact

Privacy and data requests: use the operator/support contact published with the Game or project repository. Include your account email and, if known, in-game player name. Related terms are in our Terms of Service.