Privacy policy

1. Controller and contact

Tim Geithner, sole proprietorship, c/o IP-Management #9778, Ludwig-Erhard-Str. 18, 20459 Hamburg, Germany.

Privacy requests: tgecom@email.de. Phone: +49 151 58120466. More details are in the legal notice.

2. Account and gameplay

For your account we process your email address, sign-in information, player ID and the commander name you choose. In addition we process your game state, base, resources, troops, research, orders, battles, rewards and purchases. These data enable sign-in, game progress, multiplayer features and the delivery of purchased content (Art. 6(1)(b) GDPR). Without the required account data you cannot use a permanent game account; the public game information remains accessible.

Your commander name, rank and selected game values are visible in rankings and player views. The world map shows your base to other players. Search engines can also find the public leaderboard. Use a game name if you do not want to publish your real name. Your email address is not part of the public leaderboard.

If you choose to sign in with Google, the sign-in service transmits the account data you release for sign-in. Its privacy notice also applies.

Field Reports by email are optional. If you turn them on in the game, we send status messages about your own base to your account's email address, for example when your last order is finished or when you have not played for a while. If you sign in with a password, we first send a link to confirm the address. For this we store that and when you consented, and which message we sent when. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future: through the unsubscribe link in every message or in the game settings. The mails are sent through the email service of Lovable Cloud. You receive sign-in and security emails regardless.

The Frontline Dispatch is optional. It is our newsletter about the game: news, events and occasional offers, about twice a month. If you join it in the game, we first send a link to your account's email address; you receive the Dispatch only after you confirm with that link. For this we store that and when you consented, which wording you agreed to, when you confirmed, and a check value of the confirmed address, so that a changed address has to be confirmed again. From HQ 4, a confirmed address earns 30 War Bonds once; they stay yours if you unsubscribe later. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future: through the unsubscribe link in every Dispatch or in the game settings. The confirmation email is sent through the email service of Lovable Cloud. Before a Dispatch is sent through another newsletter service, we name that service here.

For every email we send (sign-in and security emails, Field Reports, Dispatch confirmations, answers to support requests) we keep a send record for 90 days: the kind of message, subject, time, a shortened address such as "t•••@example.com", and whether the email service accepted or returned it. We use it only to find and fix delivery problems. The legal basis is our legitimate interest in working email delivery (Art. 6(1)(f) GDPR).

3. Hosting, security and operational logs

The game runs on Lovable Cloud, with Supabase for sign-in and the database. When you visit the game, the infrastructure providers process connection data such as IP address, time, browser and requested page to deliver content and detect attacks. Technical cookies and local browser storage keep your sign-in and your chosen game settings.

We keep error and security logs as well as internal game events, such as sign-in, construction progress and completed purchases. They may contain a player ID, time, browser details and technical error details. This information serves troubleshooting, fraud prevention and the improvement of game flows, based on our legitimate interest in a secure, working game (Art. 6(1)(f) GDPR). Player IDs are pseudonymous data and not automatically anonymous.

To recognise banned players who return with new accounts, we store a keyed, shortened hash of the network address you play from together with your player ID for 30 days. The address itself is not stored; moderators only see which accounts shared a network. This is based on our legitimate interest in fair play and in protecting other players (Art. 6(1)(f) GDPR).

When you change a password, it may be checked against known password leaks. The check in your browser sends only a short prefix of the locally computed password hash to Pwned Passwords; the full password is not sent to this service.

Information on service providers, subprocessors and international transfers: Lovable, Lovable data processing agreement and Supabase. Depending on the service, processing may take place outside the European Economic Area; the providers describe their transfer mechanisms and safeguards in these notices.

4. Payments

When you buy something, Stripe processes the payment data and, where applicable, billing data in the checkout. The game receives order references, items, amounts, payment status and receipt information to match and deliver the purchase. Full card data is not stored in our game database. The checkout and the receipt show the seller. The processing serves the purchase and, where required, legal obligations (Art. 6(1)(b) and (c) GDPR).

Stripe also processes certain data for its own payment, security and legal purposes. Details and contact options are in Stripe's privacy notice. For problems with a purchase, see our support page.

6. Retention and deletion

Account data and game state are stored for as long as your account exists. In your account settings you can request a data export and delete your account. Deleting the account removes the active account and the game states linked to it. Security and payment records may remain separately where they are needed to resolve incidents, legal claims or statutory retention duties. Stripe's own retention rules also apply to receipts held by Stripe.

After an account is deleted, we remove the link between the game profile and payment orders as well as the stored game credits and receipt links. Limited payment references, items, amounts, statuses and a pseudonymous buyer reference remain for accounting and later refunds. Under our retention rule, paid orders are kept for eight years from the end of the year of the last event relevant for billing. Completed unpaid checkouts are removed after 90 days, but no earlier than 30 days after the account was deleted. Open refunds and payment disputes are excluded from automatic deletion until they are resolved.

For messages sent through the contact form we process the email address, topic and message you enter and, when you are signed in, your player ID and commander name, to answer your request (Art. 6(1)(b) and (f) GDPR). Support messages are kept to handle your request and for as long as further clarification or existing legal duties require. You can also ask us specifically for information about, or deletion of, remaining log and support data. Sign-in information and game settings in your browser can be removed by signing out or by deleting the website data.

7. Your rights

Under the statutory conditions you can request access, rectification, erasure, restriction of processing and data portability. Where processing is based on legitimate interests, you can object on grounds relating to your particular situation. Contact tgecom@email.de for this. We may ask for suitable proof of identity to match your request; never send us passwords.

You can lodge a complaint with a data protection supervisory authority, in particular the authority where you live or the Hamburg Commissioner for Data Protection and Freedom of Information. The European Commission explains your data protection rights.