The short version
- This site sets no cookies and runs no analytics or ads.
- The game on your PC saves everything on your PC. Only the Online world sends anything to our server.
- An Online account is a name and a password. No email, no phone, no real name.
- The server keeps what the game needs to work: your base, your battles and their replays, your money and research, your friends, your inbox, and, for each signed-in device, the kind of program and the network it came from (not your full IP address).
- We never sell or share your data, and we do not profile you.
- You can see, correct, export or delete everything, from the game or by email.
1. Who we are
Cool Web Design SRL, a company registered in Romania, registered office and registration number to fill in, is the data controller for the game Troopstorm and for this site. Write to us at support@troopstorm.com. We have not appointed a data protection officer; the law does not require one at our size.
2. This site
The site is static pages. It has no accounts, no forms, no cookies, no analytics and no third-party trackers. It does two small things: two small functions of the site read the current version of the installer and the number of commanders online from our game server, and the page asks the site for them, with nothing about you in the request.
The company that hosts the site (Vercel Inc.) may keep technical logs of requests, including your IP address, for a short time, for security and to run the service, under its own privacy terms. We do not read those logs.
3. The game on your PC
Your worlds, your settings and your progress are saved on your PC, in the game's folder. Local worlds never leave your device: we cannot see them, and we cannot delete them. When the game starts it checks our server for an update; that request carries the game's version and, like any request on the internet, your IP address.
4. The Online world
The Online world is the one tied to an account. Everything below is kept on our server only for that world.
The account
- The name you sign in with and your password, stored only as a cryptographic hash (argon2id): we cannot read it, and we never ask for it.
- An optional nickname, shown to other players in place of your name, and when it was last changed.
- Your time zone offset, as your device reports it, so that your daily limits and rewards turn at your midnight.
- When the account was made, its role (player or admin) and whether it is banned.
The signed-in devices
- For each device signed in: a hash of its session token (never the token itself), when it signed in, when it was last seen, the version of the game that last used it, the user agent (what program and system the game runs on, cut short) and the network the sign-in came from: the first two numbers of an IPv4 address, or the prefix of an IPv6 one. We do not keep your full IP address in the account's data.
- The known devices of the account (the kind of program and its network) and security notices: a sign-in from a device not seen before, with its user agent and network, and your answer to it (“it was me” or “it wasn't me”). You see them in the game, under Settings → Account.
The game itself
- Your profile: dollars, gold, research, level, experience, missions and medals, and every change to your money with its reason (a battle, a mission, a purchase in the shop, a gift from the studio).
- Your base: its buildings and where they stand, in the versions other commanders saw when they attacked.
- Your battles: the kind, the opponent, when, the result and the stars, and the sealed record of commands that is the battle's replay. The server replays every battle that pays to check its result; both players can watch the replay.
- The defense log of attacks on your base, the Dominion's surprise attacks, your survival records, your trophies, leagues and season results.
- Your friends (requests and friendships), your duel invites and records, and your inbox: messages and gifts from the studio, and whether you read and claimed them. There is no chat between players.
- Flags: things the server found odd (a claimed result its replay disagreed with), for a look by hand.
Performance and crashes
While you play in the Online world, the game also sends two kinds of technical reports, tied to your account. Neither carries your address or your user agent.
- A short performance summary after every battle: frame rate and frame times, draw calls, soldiers and particles on screen, memory, the graphics chip's name, the screen and window size, the quality settings, the game's version and platform, and which battle it was.
- A crash report when the game hits an error: the error's text and where in the game's code it happened, the screens that were open, how long the game had been running, the graphics chip, the screen size and the quality level.
We use them to fix crashes and to tune the graphics levels, and delete them after 14 days.
On our side
- An audit log of what the studio's admins do (a gift, a ban, a password set anew), naming the account concerned. It is never changed once written.
- The server's technical log: each request's time, address, what was asked and how it went, for troubleshooting and security, kept 14 days [to confirm].
- Backups of the database, made daily and deleted in turn after 14 days [to confirm].
5. Who sees what
- Other players see your name or nickname, your level, rank, league and trophies, your base when they attack or scout it, the results and replays of the battles you fought with them, and, for your friends only, whether you are online.
- The studio's admins see the account's data, including its devices and networks, to run the game, catch cheating and answer support.
- Nobody else. We do not sell, rent or share your data, and we show no ads. We disclose data only when the law obliges us to.
6. Why, and on what legal basis
| What for | Legal basis (GDPR, article 6) |
|---|---|
| Running the Online world you asked for: the account, the base, the battles, the leaderboards, the friends, the inbox | Performance of a contract (6.1.b) |
| Keeping accounts safe and the game fair: sessions, known devices, security notices, replaying battles, flags, the audit log, the technical log | Our legitimate interest (6.1.f) in a service that is secure and fair for every player |
| Fixing crashes and tuning the graphics levels: performance summaries and crash reports | Our legitimate interest (6.1.f) in a game that runs well on every PC |
| Answering you when you write to us | Performance of a contract, or our legitimate interest in helping you |
| Keeping records the law requires | A legal obligation (6.1.c) |
We take no decisions about you by automated means that have legal or similar effects. The server's check of a battle's result is a check of the game's rules, not of you.
7. How long
| What | Kept |
|---|---|
| The account and its game data | Until you delete the account |
| A signed-in device's session | Until you sign it out, or 60 days after its last use |
| Security notices | 90 days |
| Known devices | One year after their last use |
| Performance summaries and crash reports | 14 days |
| Battles and replays | While the account exists [to confirm: whether old ones are pruned] |
| The admins' audit log | [to confirm]; after an account is deleted, its lines no longer name it |
| The technical log | 14 days [to confirm] |
| Backups | 14 days [to confirm] |
8. Where
The game server and its database run on a server rented from Hetzner Online GmbH, in Germany, in the European Union. This site is served by Vercel Inc. from servers around the world; the site and its two functions hold no data about you. We do not transfer account data outside the European Economic Area.
9. Who works for us
Our processors, under contracts that bind them to this policy: Hetzner Online GmbH (the server), Vercel Inc. (this site), the provider of our support mailbox [to fill in]. No one else processes your data on our behalf.
10. Children
The game is not aimed at children under 13. [To confirm with the lawyer and the stores' age ratings.] If you are under 16 and live in the European Union, ask a parent or guardian before making an Online account. If we learn that an account belongs to a child without that consent, we delete it.
11. Your rights
Under the GDPR you can ask us, at any time and for free:
- for access: a copy of everything we keep about your account, which we send as a readable file;
- for rectification: your nickname you change in the game; your password too, under Settings → Account;
- for erasure: see Delete your account;
- for restriction or to object to processing based on our legitimate interest;
- for portability: the same copy, in a machine-readable form.
Write to support@troopstorm.com with the name of your account. Because the account has no email, we confirm it is yours with a code sent to your inbox in the game. We answer within 30 days.
You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority of the country you live in.
12. How we protect it
- Passwords are hashed with argon2id; session tokens are kept only as hashes. A copy of the database cannot be used to sign in as anyone.
- Everything travels over HTTPS.
- A sign-in from a new device is announced in the game, and “it wasn't me” signs the account out everywhere else.
- Sign-ins and sign-ups are rate-limited, and every paid battle is verified by replaying it.
13. Changes
When this policy changes we publish the new version here, with its date. A change that matters to you is also announced in the game.
14. Contact
Cool Web Design SRL · address to fill in · support@troopstorm.com