01Who is responsible for your data
The data controller is [Operator name], who runs the WARHEAD game server. For any question about your data: [contact email].
02What data we keep
| Data | Why | Legal basis |
|---|---|---|
| Commander name, email address | Creating the account, signing in, contacting you about your account | Contract (Art. 6(1)(b)) |
| Password — only as a scrypt hash (never in plain text) | Verifying sign-ins | Contract |
| IP address of the last sign-in; the IP and browser (user agent) of each session | Security: active sessions, abuse limiting, detecting stolen accounts | Legitimate interest (Art. 6(1)(f)) |
| Country derived from your IP address (the IP is not stored for this purpose) | Choosing the site’s language automatically | Legitimate interest |
| Matches played: settings, commands (the replay), result, duration, faction | Match verification, history, replays | Contract |
| Statistics: XP, level, rating, wins, units destroyed, campaign progress | Profile, leaderboard, achievements | Contract |
| Technical server logs (requests, errors) and automatic reports of errors in the game or on the site (the error message, page and browser — no IP, cookies or account data, kept 30 days) | Operation and debugging | Legitimate interest |
Your commander name, level, rank, statistics and match history are public (profile and leaderboard). Your email, IP addresses and sessions are not shown to anyone except you and the administrator.
Game saves, settings and editor maps are stored in your browser (localStorage). When you play signed in, at the end of the match the server receives its record (the settings and the commands given) in order to verify it.
03Automatic language selection
On your first visit, the site picks its language based on the country your IP address belongs to. The lookup happens on our own server, in a local geolocation table (IP → country only), without any external service; your IP address is not stored for this purpose. The chosen language is remembered in the lang cookie. You can change it at any time from the language picker.
IP geolocation by DB-IP (db-ip.com), licensed under CC BY 4.0.
04How long we keep it
- Sessions: between 1 and 30 days (30 with “Remember me”), then they expire; signing out deletes them immediately.
- Server logs: rotated and deleted periodically.
- Backups: kept for 7 days.
- Account, matches and statistics: for as long as you keep your account. When you delete your account, we delete the account, email, password, sessions and rating history; matches remain in your opponents’ history, under the name you had at the time, but are no longer linked to any account.
05Cookies and external services
Cookies necessary for the site to work:
of_sid— the session cookie that keeps you signed in. It isHttpOnly(scripts can’t read it),SameSite=Strictand strictly necessary; it expires with your session.lang— a functional cookie that remembers the site’s language (just the language code, e.g.en); it is kept for 1 year and does not identify you.
Because they are necessary, the cookies above don’t require consent. Only if you agree (cookie banner), we use Google Analytics 4 to measure visits: the _ga and _ga_* cookies (2 years), set by Google, which processes the data and may transfer it outside the EU (USA). Without consent no analytics cookie is set. Your choice is kept in the consent cookie (6 months) and you can change it any time from “Cookie settings” in the site footer. We have no ads.
The site’s fonts are loaded from Google Fonts. When the page loads, your browser connects to Google’s servers, which see your IP address and browser. See Google’s privacy policy.
We don’t sell, rent or give your data to anyone else, except where required by law.
06Your rights
Under the GDPR, you have the right:
- of access and portability — the Account settings page lets you export your account data;
- to rectification — you can change your account data in Account settings or write to us;
- to erasure — the delete account button in Account settings erases your personal data;
- to object and to restriction of processing based on legitimate interest;
- to lodge a complaint with ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing) or the data protection authority of your country.
For any request, write to [contact email]; we reply within 30 days at most.
07Security and minors
Passwords are stored only as scrypt hashes, the connection is encrypted (HTTPS) and repeated sign-in attempts are rate-limited. No system is perfect: use a unique password.
The game is not intended for children under 16 without parental consent.
We may update this policy; the date at the top shows the latest version. In case of any discrepancy between translations, the Romanian version prevails.