1. Who we are
GamezMaster is operated by its owner. When this policy says "we", "us", or "our", it refers to GamezMaster. For questions about this policy or your personal data, contact us at privacy@gamezmaster.com.
2. What data we collect
- Account data — username, email address, hashed password, country, registration date.
- Profile data — display name, avatar configuration (stored as a JSON style config; no uploaded images).
- Gameplay data — land names and positions, unit counts, battle reports, resource levels, clan membership, rankings, messages between players.
- Session data — JWT tokens stored in httpOnly cookies; last-seen timestamp updated on each authenticated request.
- Technical data — IP address (logged by the web server for security purposes), browser push notification endpoint (if enabled).
- Google Sign-In — if you register or log in via Google, we receive your Google email address and profile name. We do not receive your Google password.
3. How we use your data
- To provide and operate the game (account management, gameplay, messaging).
- To calculate rankings and display them to other players.
- To send transactional emails (email verification, password reset).
- To send browser push notifications about in-game events (if you opt in).
- To detect and prevent abuse, cheating, and unauthorised access.
- To improve the game based on aggregated usage patterns.
We do not sell your data to third parties. We do not use your data for advertising profiling.
4. Legal basis (GDPR)
- Contract performance — processing necessary to provide the game service you signed up for.
- Legitimate interests — security logging, abuse prevention, service improvement.
- Consent — push notifications (you can withdraw at any time in your browser settings).
5. Data retention
Your account data is retained as long as your account is active. When you request account deletion, your data enters a 7-day grace period during which you can cancel the request. After 7 days, your account, lands, and personal data are permanently deleted. Battle reports and combat log entries that reference deleted accounts are anonymised rather than deleted (the game history record is preserved without identifying the player).
6. Cookies and local storage
We use httpOnly cookies to store your authentication tokens (access token and refresh token). These are strictly necessary for the game to function — you cannot opt out of them while using the service. We do not use advertising or analytics cookies.
7. Third-party services
- Google OAuth — if you use Google Sign-In, your authentication is handled by Google. See Google's Privacy Policy.
- Browser push notifications — if enabled, your browser's push service (e.g. Apple, Google, Mozilla) receives notification payloads. Payloads contain only game event summaries and no sensitive personal data.
8. Your rights (GDPR)
As a person in the EU/EEA you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data erased (account deletion); receive a copy of your data in a portable format; object to processing based on legitimate interests; lodge a complaint with your national data protection authority (in the Netherlands: the Autoriteit Persoonsgegevens).
To exercise these rights, contact us at privacy@gamezmaster.com.
9. Security
Passwords are hashed with bcrypt before storage. Authentication tokens are short-lived JWT tokens. We use HTTPS for all connections in production. Access to the database is restricted to the application server. Despite these measures, no system is perfectly secure — please use a strong, unique password and do not share your account.
10. Changes to this policy
We may update this policy from time to time. When we make significant changes we will update the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance.