Privacy policy
The data controller is DELIATTI S.R.L., Toplita, Harghita, 52734921. For any question or request about your data write to info@deliatti.ro.
1. What we process
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Username, e-mail address, password (stored only as an Argon2id/bcrypt hash), language, age confirmation, accepted terms version | Creating and running your account; account e-mails (confirmation, password reset, deletion) | Contract — Art. 6(1)(b) |
| Game data: character, settlements, resources, armies, journal, era history; Hall of Fame name and titles | Running the game; the Hall of Fame is public and stays after an era ends | Contract |
| Keyed hashes (HMAC) of your IP address and browser — we do not store your IP in clear; session tokens (also hashed) | Security, fraud prevention, the one-player-per-connection rule, limiting login attempts | Legitimate interest — Art. 6(1)(f) |
| Security log (logins, password changes, staff actions) | Investigating abuse and incidents | Legitimate interest |
We do not use your data for advertising, do no commercial profiling and do not sell data.
2. How long we keep it
- Account: while it exists. After a deletion request, 14 more days (so you can change your mind), then erased. Your Hall of Fame name may remain as era history without other data about you — you can ask us to anonymise it.
- Connection hashes: 90 days. Security log: 180 days. Sessions: at most 30 days.
- An era's game data is deleted when the world resets.
3. Who receives it
Data is stored by our hosting provider (RO), who processes it only on our behalf. E-mails are sent through the domain's mail server. We do not transfer data outside the European Economic Area. We disclose data only when the law requires it.
4. Cookies and local storage
We use one strictly necessary cookie: the login session (HttpOnly, secure). Your browser stores your language and notification choice locally. We use no advertising cookies. Analytics cookies are used only if "Visitor statistics" below says so.
Visitor statistics: we use Google Analytics 4 (Google Ireland Ltd.) to understand how the game is used (pages visited, country, device; IP addresses are anonymised). Google Analytics sets cookies, so we ask for your consent in a small notice on your first visit; you may decline, and the choice is kept in your browser. We honour the browser's "Do Not Track" / Global Privacy Control signal. Details: Google's policy.
5. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection. Password, language and deletion are in Account settings; for anything else write to info@deliatti.ro — we answer within one month. You may complain to the Romanian supervisory authority ANSPDCP (www.dataprotection.ro) or the authority of your country.
6. Security and minors
Passwords are stored only as hashes, connections are encrypted (HTTPS), staff access is limited and logged. The game is not meant for people under 16; if we learn an account belongs to someone younger, we delete it.