WarPrivacy Policy
- You can play as a guest: no account, no email, nothing to fill in.
- No ads, no tracking, no analytics cookies, no data sold to anyone. That's why there is no cookie banner.
- If you create an account we keep your commander name, your progress and what you own, until you delete it (one click in the account menu).
- Reports, support messages and security logs are deleted automatically after a fixed time (table below).
1. Who we are
WarCapitals (warcapitals.io) is a free browser game made by an independent developer based in Italy, who is the data controller for the data described here. For anything about your data write to [email protected].
2. What we collect and why
Everyone (also guests)
- The name you type in the menu: other players see it during the war.
- Your IP address: kept in the server's memory while you play, to stop cheating, spam and abuse (limits per address, temporary bans). It is written to disk only if the anti-cheat disconnects you or a moderator bans you (see the retention table).
- Chat messages: they are delivered to the other players and kept in the server's memory (the last few thousand lines) so that moderators can check reports. They are not saved to disk unless someone reports a player: then the last 25 lines of that war are attached to the report.
- Technical data your browser sends to every website (browser type, screen size): used to show the game correctly. If you use "Report a bug", the message also contains your browser, screen size and the game's last errors, to help us fix the problem.
If you create an account
- How you log in: Google, Discord, or a commander name and password. From Google and Discord we receive only an ID, the name on that account (used as a suggestion: you pick your commander name) and the link to your profile picture. We do not receive your email. Passwords are stored only as a salted scrypt hash: nobody, not even us, can read them.
- Your progress: level, XP, statistics, achievements, items you own and equip, coins, the date you joined and your last login.
- Moderation: warnings, mutes and bans given to the account, with the reason.
Reports and support
- "🚩 Report": who reports, who is reported, the reason, your comment and the last 25 chat lines of that war (including private messages between the two players).
- "🐞 Report a bug": your message and, only if you write it, your email, used only to answer you. Emails sent to [email protected] arrive in our mailbox (Gmail).
- Moderators get a short notification of new reports in a private Discord channel.
Anonymous statistics
To know how many people play, your browser tells the server once a day "I've been here before, first visit N days ago", whether it's a phone or a computer, and the site or link that brought you (for example a TikTok video). No cookie, no ID, no IP address is saved: the server only adds numbers per day.
3. Legal bases
- Running the game and your account (Art. 6(1)(b) GDPR: the service you asked for).
- Security, anti-cheat, moderation and anonymous statistics (Art. 6(1)(f) GDPR: our legitimate interest in a fair and safe game).
- Your email in a support request: you choose to give it so that we can answer (Art. 6(1)(b) and (f)).
- Legal obligations (Art. 6(1)(c)), for example if an authority asks us for data or for tax records of purchases, when the shop opens.
4. How long we keep it
| Data | Kept for |
|---|---|
| Account, progress, items | Until you delete the account (account menu ⚙️ → Delete account) |
| Login session (cookie) | 90 days, or until you log out |
| Chat messages | Only in memory, lost when the server restarts |
| Player reports, with the attached chat | 180 days |
| "Report a bug" messages | 365 days; the email you leave is removed after 180 days |
| Anti-cheat log (contains IP addresses) | 90 days |
| Bans by IP address | At most 1 day; forgotten 30 days after they end |
| Moderator action log | 2 years |
| Web server logs (IP address, page requested) | 14 days |
| Backups of the database | Up to 30 days |
Deletion is automatic: the server cleans expired data every day.
5. Cookies and browser storage
We use only what the game needs to work. None of it is used for advertising or tracking, so no consent banner is needed.
wc_sess(cookie, 90 days): keeps you logged in to your account. Only for players with an account.wc_state(cookie, a few minutes): protects the login with Google or Discord.- Local storage in your browser: your name and game preferences (sound, chat, tips, tutorial, blocked players), and the two dates used by the anonymous statistics. They never leave your device except as described above. You can delete them by clearing your browser's site data.
- Our network provider Cloudflare may set a strictly necessary security cookie to tell people from bots.
The game's fonts are served from our own server: opening WarCapitals does not contact Google.
6. Who else handles your data
| Service | What for | Where |
|---|---|---|
| Hetzner Online GmbH | The server that runs the game and stores the database | Germany (EU) |
| Cloudflare, Inc. | Domain, network protection and email forwarding for support@ | Global network; EU-US Data Privacy Framework |
| Google LLC | "Log in with Google" (only if you choose it); our support mailbox (Gmail) | EU-US Data Privacy Framework |
| Discord Inc. | "Log in with Discord" (only if you choose it); report notifications to moderators | EU-US Data Privacy Framework |
| Ko-fi and PayPal | Donations, only if you choose to donate: you give your data to them, not to us, under their own privacy policies | UK / EU |
We don't sell or share your data with anyone else. We may disclose data only when required by law.
7. Age
Anyone can play as a guest. To create an account you must be 14 or older (the age of digital consent in Italy). If you are a parent and believe your child under 14 created an account, write to us and we will delete it.
8. Your rights
You can ask to access, correct, delete or receive a copy of your data, to restrict its use or to object to it. Most of it you can do yourself: change your name in the account menu, or delete your account with one click. For anything else write to [email protected]; we answer within 30 days. You can also complain to a data protection authority; in Italy it's the Garante per la protezione dei dati personali (garanteprivacy.it).
When you delete your account, your account, statistics, achievements, items and sessions are deleted immediately. Reports you sent or received stay until their normal expiry (180 days), because they are needed to keep the game safe.
9. Security
Everything travels encrypted (HTTPS). The server is in a locked-down data center, accessible only with a key, with a firewall and automatic security updates. Passwords are hashed, sessions are random tokens stored only as hashes.
10. Changes
If this policy changes we update the date at the top; important changes are announced in the game.