Privacy policy
1. Controller and contact
1.1. The controller of personal data is [OPERATOR NAME], company ID [IČO], registered office [ADDRESS] ("we").
1.2. Data-protection contact: [E-MAIL], [ADDRESS]. Data protection officer: [NAME AND CONTACT if appointed; otherwise "not appointed, no obligation"].
1.3. We process data under Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll.
2. What data, why and on what basis
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Beta pre-registration | e-mail, language, chosen faction, where on the site you signed up, time of consent, confirmation and unsubscribe, salted IP hash | confirming the e-mail, beta and launch news | consent (art. 6(1)(a)) | until you unsubscribe, at most [12 months] after launch |
| Game account | pilot name, e-mail, password (only as a secure hash), language, faction, avatar, name history | creating and running the account, performing the contract | contract (b) | while the account exists, then [3 years] for possible claims |
| Playing | progress, in-game currencies, items, ships, in-game position, statistics, achievements, game settings, clans, friends, activity log | providing the game | contract (b) | while the account exists; activity log keeps the last 1,000 entries |
| Chat and reports | chat messages, player reports with context (map, position, recent messages) | moderation, handling complaints, Digital Services Act | legitimate interest (f), legal obligation (c) | [90 days]; reports until resolved + [1 year] |
| Account security | IP address, login times, failed logins, password changes, game sessions (start, end, client version) | protecting accounts, detecting abuse | legitimate interest (f) | security events 180 days, sessions [12 months] |
| Anti-fraud (anti-cheat) | game behaviour (command regularity, reaction times, results), interaction with bot decoys, suspicion score | detecting bots, cheats and fraud, fair play | legitimate interest (f) in fair and secure play | [12 months], with a sanction until it expires |
| Technical records | client error reports (message, version, graphics card, operating system), server logs | fixing bugs, stability | legitimate interest (f) | 14 days, aggregated metrics 30 days |
| Purchases (once available) | order and payment data (no card number), currency history | performing the contract, accounting, taxes, complaints | contract (b), legal obligation (c) | 10 years (accounting and tax law) |
| Discord linking (optional) | Discord ID and name | roles on the Discord server (player, VIP) | contract (b) / consent | until unlinked |
| Cookies, measurement, advertising | see the Cookie policy | traffic measurement, advertising | consent (a), Czech Act No. 127/2005 Coll. s. 89(3) | per the Cookie policy |
| Contacting us | e-mail and message content | replying, support | legitimate interest (f) | [2 years] |
2.1. Legitimate interest for anti-fraud: without it the game would not be fair to other players and would be open to abuse. The automated assessment alone never leads to a permanent ban; a human decides on permanent sanctions. You may object to processing based on legitimate interest at any time.
2.2. Children: the Service may be used without a guardian's consent from the age of 15. If we learn that a younger child created an account without consent, we block the account and delete the data.
2.3. Providing account data is a contractual requirement; without it an account cannot be created. Consent for pre-registration and cookies is voluntary.
3. Who we share data with
3.1. Processors (acting only on our instructions):
- [SERVER / VPS PROVIDER, country]: running servers and the database,
- Cloudflare, Inc.: content delivery network, attack protection, Turnstile (bot check),
- Resend (Plus Five Five, Inc.): sending e-mails,
- [PAYMENT PROVIDER]: payments (once purchases launch),
- advertising and measurement partners (Google, Meta) only with consent, per the Cookie policy.
3.2. Independent controllers: Discord (if you link your account), banks and payment institutions, public authorities where the law requires it.
3.3. Transfers outside the EU/EEA: Some processors are based in the USA. Transfers rely on the adequacy decision (EU-U.S. Data Privacy Framework) for certified companies, otherwise on the European Commission's standard contractual clauses. [VERIFY for each processor]
3.4. We do not sell personal data.
4. Your rights
You have the right of access, rectification, erasure, restriction of processing, portability, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting the lawfulness of earlier processing. Send requests to [E-MAIL]; we reply within one month (extendable by two months for complex cases).
You may also lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or with the supervisory authority of your country.
5. Security
Passwords are stored only as a one-way hash (bcrypt), traffic is encrypted (HTTPS / WSS), only authorised team members can access data, and administrative actions are written to an immutable audit log. Data breaches are handled under GDPR articles 33 and 34.
6. Automated decision-making
We do not make automated decisions with legal effects within the meaning of GDPR article 22. The anti-fraud system may temporarily disconnect a player automatically; permanent sanctions are always reviewed by a human.
7. Changes
We may update this policy. Significant changes are announced on the website or by e-mail. The date of the last change is at the bottom of the page.
Updated: 7 October 2026