Privacy

We keep the minimum: your login, a check derived from your password, your empire's data, the messages sent in the game, and posts in your alliance's council. We don't ask for an email, real name, or ID, and your password never reaches the server. If you turn on two-step verification, we keep its key encrypted.

We only use the cookies needed to keep your session and protect forms. There are no ads or trackers. Your IP address is used briefly to limit abuse, and we don't save it in the database or in the game's logs. Cloudflare, which hosts the game, handles connections and keeps its own security records.

To find one person playing with several accounts, each login stores a code derived from your network, for 14 days. It can't be turned back into your address, and one week's code can't be compared with another's. Only the administrators see which accounts shared a network, and nothing happens to an account automatically, because households and mobile carriers share addresses too.

If someone reports a message or post of yours, the administrators receive a copy of it. Private messages aren't read in any other way.

When you create or change your password, your browser asks the Pwned Passwords service whether it has appeared in breaches. The password doesn't leave your device: only the first 5 characters of a hash of it are sent. The service sees your IP address, like any site you visit.

You can delete your account at any time under "My account". Messages are removed after 30 days, the battle log after 14 days, and closed reports after 30 days. Council posts go with the alliance at the end of the round.