What personal data we hold, why we hold it, who else sees it, and your rights.
The controller of your personal data is the company named, with its company number, in the panel at the foot of this page.
Use the e-mail address in that panel for any request about your data.
Account: your e-mail address, your display name, an irreversible hash of your password, when the account was opened, whether the address is verified, and the language you play the game in, which is also the language we write to you in. We do not store the password itself. We also record when, on opening the account, you accepted the Terms of Use, and which version of them you accepted.
Session: a record of the session opened when you sign in: when it expires, and whether it was opened in a browser or in the iPhone or Android app. We also keep when you last signed in, when you last used the game, and on which days you used it. In a browser, the session key is held in a cookie. The mobile app uses no cookies; it keeps the key in your phone's secure storage (the Keychain on an iPhone, the Keystore on Android). Our server does not hold the key itself, only a digest calculated from it that cannot be turned back into it. Each time a session in the app is used, it runs for another ninety days from then; if it goes unused for ninety days, it closes by itself.
Linked accounts (only if you use them): if you sign in with your Apple, Google, Discord, Facebook or X account, the permanent ID that service knows you by, the date you linked it and, if the service shared it, your email address. The name the service reports is only offered as a suggestion for your game name while you open your account; we do not write it to your account. We never see your password, friend list or posts on that service. If you sign in with Apple, we also keep a key Apple issues; we use it only to withdraw your permission at Apple when you delete your account or remove the link, and we delete it once that is done.
Passkeys (only if you add them): if you add a passkey to your account, the public half of the key, the key's ID, the model number that says which password manager holds it (for example iCloud Keychain), whether the key is synced to your other devices, its counter that goes up with each sign-in, and the dates it was added and last used. The private half of the key never leaves the password manager on your device; your fingerprint or face scan never reaches us. These records stay for as long as your account does and are deleted when you remove the key or delete your account.
Sign-in and device records: when you register, when you sign in, while you use the game signed in (at most once an hour from the same place) and when you send a shipment of goods or place a market order, we record where you connected from: your IP address, the device cookie in your browser, what your browser says it is (browser and operating system) and the languages it asks for; at registration and sign-in we also record your time zone, your screen size, your device's platform and your list of languages. When you connect from the mobile app, the app's installation ID takes the place of the device cookie: the first time the app is opened on your phone, it generates a random ID and sends it to our server with every request. These records then also note which platform the app runs on (iPhone or Android) and its version. Everything from the same address and the same browser or the same app on the same day is kept as one record, with the first and last time it was seen and how many times. We do not keep the device cookie or the installation ID itself, only a digest calculated from it that cannot be turned back into it.
Game: your player name, cities, resources, armies, research, voyages and battle records. These are the game itself.
Languages you speak: the languages you choose on the account page so that others know which languages they can write to you in (at most four, in your order), and whether other players are shown them. Until you save a list of your own, it holds only the language you play the game in. Unless you turn the display off, the other players in the worlds you play in see these languages beside your name: on your player page, in your city’s window on the island, at the head of private conversations and in friend lists. When you turn it off, no player is shown them; you can change or empty the list at any time. When your account is deleted, the list is deleted too.
Within an alliance: when you join an alliance, the players who hold its offices see what falls within their field: the Strategos your armies, the Tamias your treasury and the goods in your cities, the Presbys your treaties, the Arkhon when you joined, how many cities you have, your population, your Embassy level and when you last played. When you last played is shown only as “today”, “this week” or “earlier”, never as a time. The alliance's leader sees all of it. The moment you leave the alliance, none of it is shown to them any more.
Messages: the private and chat messages you send, your reactions to messages, the players you have blocked, the reports you have made, the sanctions applied to you and the appeals you have made against them. When the automatic check refuses a message, or publishes it with some words hidden, we keep the text as it was written with the moderation record; only our authorised operators can see it.
Reports about you: if another player reports you, we keep who made the report, the reason they chose, the note they wrote (at most 500 characters) and how things stood at the moment of the report: your player name, the name of the city you were reported from, and your alliance's name and tag. When an operator answers the report, what they decided and when is recorded too. We keep the names as they were at that moment because a name is easily changed, and the operator must be able to read the name the reporter saw.
Purchases: your orders, what you bought, when you paid, the amount and currency, Stripe's own payment identifier, and whether you agreed to immediate delivery; for what you buy in the mobile app through the App Store or Google Play, also which store you used, the store's transaction identifier, and the renewal, cancellation and refund records of the subscription. We do not hold your card number. We also record which of your players, in which world, a purchase was made for. When you pay on the site, we keep the consent sentence you tick word for word, together with the moment you ticked it and the versions of the Terms of Use and of the Refunds and Withdrawal page in force at that moment. That record is the proof of what you agreed to.
Page measurement with cookies (only if you agree): which page you opened among the ones that need no account, and your browser's general details; Google Analytics collects these. Nothing you do inside the game is measured.
Technical: operating records such as the time, path and outcome of a request. These exist to find faults and to stop abuse. We also count how many times a day the pages that need no account are opened; nothing is written to your browser for this, and only daily totals are kept: the page, the country, the browser language and the site the visitor came from. Nothing in these totals identifies you, and your IP address is not stored.
Mobile app: on your phone, the app keeps the session key, the installation ID, the language you chose, and the world and city you last opened. It does not access your location, contacts, camera or microphone, and it does not read your advertising ID. Nor does it look through your photos: if you want to add a photo while having something drawn with Seals or writing to us from the BETA page, your phone's own picker opens and only the photo you choose reaches the app. The app shrinks and redraws that photo before sending it; the location, device and date details inside it never leave your phone. If an error happens in the app, the report goes to our error-tracking service through our server (Sentry, below). If you have agreed in your phone's settings to share diagnostic data with app developers, Apple or Google also pass the app's crash reports on to us. These reports contain neither your account nor your name, and we do not match them to an account.
We do not show you advertising, we do not track you across sites, and we do not build a profile of you for advertising or marketing.
Monument designs: the description you wrote, the full instruction it was combined with, which model drew it, what the attempt reported, and the picture itself. We keep these because a design is something you paid for: the record is how a purchase can be answered for months later. The picture is stored by us and served from here, so it does not depend on anybody else's link staying alive.
Pictures you upload: a picture you upload for a design is kept until the drawing is finished. It is drawn again the moment it arrives, and the location, device and date recorded inside a photograph are thrown away in doing so. When the drawing finishes — whether it succeeded or not — the picture is deleted; the design's record keeps only a short fingerprint calculated from it, from which the picture cannot be recovered.
Notifications (only if you turn them on): in a browser, for each device you turn them on for, the notification address your browser gives us and the keys used to encrypt notifications for that device; in the mobile app, for each phone you turn them on for, the notification token Firebase gives that phone, and the app's installation ID, platform (iPhone or Android), language and version; which topics you do not want to be told about; your "tell me when the goods are in" marks. A phone's record is tied to the session in which you turned notifications on. In this record the installation ID is kept as it is, not as a digest: that is how we find a phone's old record when it registers again.
Invitations: the code of your invitation link, and the link between you and an account that joined through your link or invitation. When you send a friend an invitation by e-mail, we use their address only to send that letter and do not keep it; we keep only an irreversible digest of the address (SHA-256), so that the same address is not sent a second invitation soon after and an address that asked not to be invited again is not written to again.
Where the account came from: if you opened your account after following a link in an advert or a post, we record with your account the source, medium, campaign, content and keyword that the link carried (the values in the link that begin with utm_), and whether you opened the account in a browser, on an iPhone or on Android. We read this from the address of the page you arrived at and keep it only in the page's memory until you open the account: we write no cookie or anything else to your browser for it. We do not read or keep the click identifiers that advertising companies add to links (for example gclid or fbclid).
Free Pro period: the free Pro period is given once per e-mail inbox in each world. To check this, we record an irreversible digest (SHA-256) of your address with any + tag and, for Gmail, any dots removed, together with the world the period was given in; the address itself is not in this record. We also compare addresses in this form when an account is opened, so that a second account cannot be opened on the same inbox. Both checks run automatically. Legal basis: legitimate interest — giving the free Pro period, and the Seals it brings, once per person.
Reminder e-mails: the record of the letters we write to you when you have not been in the game for a long time: which kind of letter it was (which day, the first-day letter, an attack warning or a private-message letter) and in which language it went, its subject, which state lines it carried (for example “full warehouse”; the numbers are not kept), when it was sent, how the sending went, whether you came back to the game afterwards, and whether you turned the reminders off with the link in the letter. Your permission history is kept on your account: whether you gave it at sign-up or in the settings, under which text and which version, from which surface (web, iOS, Android) and when; and, if you withdrew it, when and from where. Your IP address is not kept in this record. Accounts opened before the box existed carry a separate line, “member from before”: those accounts did not tick a box; the members of that day were treated as having agreed. Which army an attack warning and which message a private-message letter was written about is kept as a number, so that the same thing is not written about twice; the letter names the attacker or the sender as the game shows them, and never quotes the message. If a letter offered the return gift, whether and when it was given is kept too. The content of a letter is built from your state in the game at that moment.
What you write to us: the suggestions and bug reports you send from the BETA page in the game, and our operators' replies to them. Your message arrives with the information the page shows you before you send it: the world you play in and your player name there, the screen you were on before writing, the game's version, the language you play in, and a short description of your browser (browser, operating system, window size) — or, when you write from the mobile app, the app's version, your phone's operating system and its version, and the screen size. If you add pictures to your message (usually a screenshot), those pictures arrive too. We store each picture redrawn on our server; the location, device and date details inside a photo are discarded in the process. Only our authorised operators read and see them.
Why you left (only if you answer): if you pick why you are leaving when you delete your account, or leave a note, we record the reasons you picked, your note, the language you play in and the date. Only our operators read them, and only to make the game better. The question is optional; your account is deleted in the same way whether you answer or not. Legal basis: legitimate interest.
Toplist votes (only if you vote): when you vote on a toplist through the vote link in the Seals window or under today's gift, the site tells us once it has counted the vote, and a Seal is written to your purse in that world. The record sits with your other Seal movements: the day, the world, and that it was given for a vote.
To provide the game — opening your account, keeping your session, running your cities, showing other players the languages you speak when you choose to show them. Lawful basis: performance of our contract with you.
To take and record payments — orders, collection, refunds and accounting. Lawful basis: performance of our contract with you, and legal obligation.
For security, against abuse, and to enforce the game's rules — bot checks, rate limits, and detection of fraud and of the multiple accounts the Terms of Use forbid (using several accounts to move resources, troops or advantage between them). For this we use the sign-in and device records described above: only our authorised operators look at which accounts came from the same device, or from the same address around the same days. A decision about an account is made by an operator who has reviewed these records. Nothing is blocked automatically on the basis of these records. The records are not used for advertising and are not sold. Lawful basis: legitimate interests — keeping the game fair for every player and protecting accounts. You have the right to object to this processing.
To protect the community — moderating chat, reviewing reports, including reports other players make about you, and keeping records of sanctions and appeals. Only our authorised operators see reports about you. You are not told that you have been reported, and you are never shown who reported you; if an operator acts, you see the result — for example a changed name or a mute. The number of reports sets nothing off by itself; the decision is made by an operator who has reviewed the report. Lawful basis: legitimate interests.
To pass on your invitation to a friend — sending your friend an invitation e-mail at your request, and limiting its misuse. Legal basis: legitimate interest. An invitation goes only when you ask for it, is not sent to the same address again soon after, and every letter says how not to be invited again.
To measure where our players come from — to see which advert or link really brings players to the game, and to manage what we spend on promotion accordingly. We use this only for our own measurement and share it with no one: we do not send it to Google, to advertising networks or to any other company, and we look at the results only as totals. Legal basis: legitimate interest.
To write to a player who has been away for a long time — sending you short e-mails when you have not been in the game for a while, and measuring whether those letters do any good. The letters are: the day after you sign up, if your first visit lasted no more than an hour, one letter about where you left off (once per account); one letter each when you have not been in the game for 3, 7 and 14 days, about how your city stands; one letter each on day 30 and day 60, about what came to the game in the meantime (after day 60 nothing more is written until you come back); a warning as soon as an enemy army sets out against one of your cities while you have not been seen for 12 hours (at most one in 12 hours); and a letter naming the sender when somebody writes you a private message while you have not been seen for 24 hours (at most one a day; the message itself is never in the letter). Apart from the attack warning, two letters are at least 12 hours apart. The 7- and 14-day letters may say that, if you have no Pro membership in that world, three days of Pro await you if you return within seven days; the gift is given by itself when you return, once per absence. Legal basis: your consent. You give it by ticking the box on the sign-up form, or later by turning on the “Reminder e-mails” switch in your account settings; the box is never ticked for you, and leaving it empty costs you nothing. For accounts opened before the box existed, the members of that day are treated as having agreed. You can withdraw at any time without giving a reason: by turning the switch off in your account settings, or with the one-click link in every letter, which needs no sign-in. Once you withdraw, nothing more is written; what was written before stays lawful. Letters are not sent at night.
To improve the game and to answer you — reading the suggestions and bug reports you send from the BETA page, together with any pictures you add, finding and fixing bugs, and replying to you. Legal basis: legitimate interest. You see our reply inside the game; we do not e-mail you about it.
To give a Seal for your vote on a toplist — writing the vote the site reports to the right player, and making sure nobody can take a Seal in someone else's name. Legal basis: performance of our contract. Voting is optional; if you do not vote, you play by the same rules.
To meet our legal obligations — legal claims made against us and properly made requests from authorities. Lawful basis: legal obligation.
We do not sell your data. We share it only with the service providers the game needs in order to run, and only as far as each one needs:
Resend — to send account e-mail (verification, password resets), the invitation e-mails you ask for, and the reminder e-mails we write when you have been away from the game for a long time. What reaches it: the recipient's e-mail address and the content of the message.
Stripe — to take payments. What reaches it: your e-mail address, the amount you paid and the name of what you bought. Your card details never reach us; the payment page is Stripe's and card data is processed only by Stripe.
RevenueCat (RevenueCat, Inc.) — to verify the purchases you make in the mobile app through the App Store or Google Play, and to tell us about them. What reaches it: your account's random identifier, the random identifier of your player that says which world a purchase is for, the product you bought, the amount and currency, the store's transaction records, your device's type and operating system, the app's version and your IP address. Your e-mail address and your name are not sent. The payment itself is taken by Apple or Google: for these purchases the store is the seller, and your payment details stay with the store.
OpenAI — to check chat messages automatically. What reaches it: the text of the message being checked. The game's own report links are not sent to this service.
Cloudflare (Cloudflare, Inc.) — to protect our site and our server from attacks. Every request that goes to the game from your browser or from the app passes through Cloudflare's network: the connection is decrypted at a Cloudflare server near you, and the request is encrypted again before it is passed on to our server. Cloudflare therefore processes your IP address and the content of the request with every request. The bot check on the registration form is Cloudflare's too; for that check, the token your browser produces for it is also sent.
Google Web Risk — to ask whether an external link shared in chat is malicious. What reaches it: the address of the link.
Google Analytics — to count how often the public pages are read, and only if you agree. What reaches it: the address of the page you are reading, your browser's general details and the measurement's own identifier. It does not run inside the game.
DigitalOcean (DigitalOcean, LLC) — to host our server and our database. Our server is in a data centre in the United Kingdom; the data of your account and your game is stored there.
OpenAI — to draw the pictures you commission with Seals, and to check them against the game's content rules. What reaches it: the description you wrote (combined with the game's own art direction), the picture you uploaded if there is one, and the picture that comes back. For a victory fresco the battle's record is added without names: where it was fought, which kinds of troops stood on each side and how it ended; no player's or city's name and no troop numbers are sent. For an object commissioned for the Mouseion, the kind of object and the names of the two cities it is made in and sent to are added; one of those cities belongs to another player. Your account, your name and your e-mail address are not sent; city names are sent only for a Mouseion object. Under its own policy OpenAI may keep this data for a limited time to monitor abuse; it does not use data received through its API to train its models.
OpenAI — when our operators ask for it, to write the referee's note that explains a battle you lost. What reaches it: an anonymous record of the battle (which units stood on each side and how many, the values they fought with, the level of the wall and of the Town Hall, the losses in each round, how morale moved and how the battle ended), the results of the options the game fought the battle again with, and the language the note is written in. No player or city names, and neither your account nor your e-mail address, are sent; the sides are named only by labels such as "attacker 1" and "defender 1".
Sentry (Functional Software, Inc.) — to see and fix errors that happen on the site and in the mobile app. The data is kept in the European Union (Germany). What reaches it: the error itself (its message and where in the game's code it happened); from the site, the type of your browser and operating system and the address of the page where the error happened; from the app, the app's version, the type of your phone (iPhone or Android) and the addresses of the requests the app made to our server just before the error. Any secret parts of links are removed from these addresses before they are sent. Error reports are passed to Sentry through our server rather than directly, so your IP address does not reach Sentry. Your account, your name, your e-mail address, your cookies and what you write in the game are not sent.
Your browser's notification service — to deliver the notifications you turn on in a browser to your device. We do not choose this service; the company that makes your browser does: Google for Chrome and Android, Mozilla for Firefox, Apple for Safari and iPhone, Microsoft for Edge. What reaches it: your device's notification address and the encrypted notification. The notification stays encrypted until it is opened on your device; the service cannot read what it says.
Firebase Cloud Messaging (Google LLC) and Apple Push Notification service (Apple Inc.) — to deliver the notifications you turn on in the mobile app to your phone. Our server hands the notification to Google's Firebase service. Firebase delivers it to an Android phone itself; a notification for an iPhone is passed on by Firebase to Apple's notification service. What reaches them: your phone's notification token and the notification itself, that is, its title, its text and the address of the game page that opens when you tap it. Unlike browser notifications, app notifications are not end-to-end encrypted: Google and Apple can read the text of a notification. That text may include the names of players, cities and islands and a short extract from an island announcement. The text of private messages and chat messages is never put in a notification; the notification only says who has written to you.
Apple, Google, Discord, Meta (Facebook) and X — only if you choose to sign in with one of these services, to confirm who you are. You sign in on that service's own page; it tells us only the ID it knows you by and, as far as you allow, your name and email address. We send it no data about you; that service does, however, know under its own privacy policy that you signed in to ENOMOTIA with it.
BrowserGamesTop — only if you press the vote link. This site is not our service provider: it is an independent toplist that counts votes by its own rules, and when you visit it, it processes your data under its own privacy policy; for example, it keeps your IP address itself to allow one vote a day. The link carries to the site only your player's random identifier and a signature showing that we issued it. Your e-mail address, your name and your player name are not sent. When the site counts the vote, it tells us with the same identifier.
Some of the providers above process data outside the United Kingdom and the European Economic Area, in particular in the United States.
Those transfers are made on the safeguards data protection law provides — adequacy decisions or standard contractual clauses.
Account data: for as long as the account exists. When you delete your account, it is irreversibly anonymised two days after your request; for an account closed any other way, that period is thirty days. Your email address and your name are removed from your account, from every record in the game and from the record of actions our administrators took on your account. Your address remains in only one place: in your payment record, if you paid on the website, for as long as purchase records are kept.
Linked accounts: until you remove the link on the account page or your account is deleted. The record of a sign-in left unfinished is deleted within an hour at the latest.
Passkeys: until you remove the key on the account page or your account is deleted. The record of a sign-in left halfway is deleted within a few minutes.
Game data: for as long as the world it belongs to is open. When a world closes, its game data is deleted. If one of our administrators removes your player from a world, your data in that world is not deleted: your player name and the names of your cities are replaced with names that identify nobody, and the records stay until the world closes. Your account stays open, and you can join that world again with a new player.
Chat and messages: for as long as the world they belong to is open. A message you delete is no longer shown to anyone, but its text is kept for that time, because if it was reported a moderator must be able to see what was written. Reactions to messages are kept for the same time.
Moderation records — reports, sanctions and appeals: for as long as the world they belong to is open. They are needed to see a behaviour repeat and to review an appeal fairly. If you delete your account the records stay, but they no longer name you. The text kept with the record of a message the automatic check refused, or published with some words hidden, is deleted after twelve months; if your account is deleted before then, the text goes with it.
Reports about you: for as long as the world they were made in is open. They are not deleted once an operator has answered them, so that a later report about the same person can be weighed together with the earlier ones. They are deleted when the world closes. If you delete your account the report stays, but your player name and your city's name are removed from it.
Purchase records: kept for as long as tax and accounting law requires, even after an account is closed. In the United Kingdom that period is six years from the end of the financial year in which the purchase was made.
Technical records: ninety days.
Sign-in and device records: twelve months from the last time a record was seen; a record whose time is up is deleted automatically. When you delete your account, the details of your browser and of the app (browser and operating system, languages, time zone, screen size, the platform the browser reported, the app's version) are deleted at once. The IP address, the digest of the device cookie or of the installation ID, whether you used an iPhone or Android if you connected from the app, and the dates stay until the twelve months are up. That is so that we can notice the same person evading a sanction or getting round the rules with a new account after deleting the old one.
Pictures you upload for a design: one day at most. Each is deleted the moment its drawing finishes, whatever the outcome.
Notification addresses and tokens: in a browser, until you turn notifications off on that device, your browser retires the address, or your account is deleted. In the mobile app, until you turn notifications off on that phone, your session on the phone ends (when you sign out, change your password or the session expires), Firebase treats the token as no longer valid, or your account is deleted. If notifications fail to reach a device several times in a row, that device's record is deleted too.
Invitation e-mails: the digest of the recipient's address and the link in the letter are kept for one year; the digest of an address that asked not to be invited again is kept permanently, so that the request can be honoured.
Where the account came from: for as long as your account is open. When you delete your account, the source, medium, campaign, content and keyword are deleted too; only the platform the account was opened on remains, and that does not identify you.
Free Pro period records: the digest of your address and the world the period was given in are kept for as long as that world is open. They remain if you delete your account, so that a new account opened with the same address does not receive a second free Pro period in the same world. They are deleted when the world closes.
Reminder e-mail records: kept for six months from the sending, then deleted. Your permission history stays with your account; after the account is deleted these lines still hold nothing that points to you (name, e-mail address, IP).
What you write to us: for as long as your account is open. Pictures you add to a message are kept for ninety days from the moment you send it and then deleted; the fact that the message came with pictures, and how many, remains. A picture you upload but never send with a message is deleted within a day. When you delete your account, your messages, your pictures and our replies to them are deleted too.
Why you left: kept with your account until it is deleted, and still with it if you change your mind about deleting. When your account is deleted, the link between your answer and your account is cut: the reasons, the note, the language and the date stay, but who wrote them is no longer known.
Where a legal claim or investigation is under way, the records it concerns are kept until it is finished.
You have the right to access the data we hold about you, to have what is wrong corrected, to ask for erasure, to restrict processing, to receive your data in a portable form, and to object to processing based on legitimate interests.
Send your request by e-mail. Writing from your account's own address makes you quicker to identify; we may ask for further confirmation if we need it.
We answer within one month. If a request is complex we may extend that, and we will tell you if we do.
You can delete your account yourself from the account page or from the mobile app's settings. Once we have your request the account is frozen and a link is sent to your email address; for two days that link and your password let you change your mind. When the time is up your progress in the game is removed from the world, and that cannot be undone. At that moment we also cancel the subscriptions you bought on the website; a subscription bought from the App Store or Google Play you need to stop yourself in the store's settings. Other players' battle reports and conversations stay as their record, but they no longer name you. The page below sets out the steps, what is deleted and what is kept, and what happens to subscriptions.
Account Deletion
If you are in Türkiye, you can also exercise your rights under Law No. 6698 on the Protection of Personal Data through the same e-mail address.
Those rights largely overlap with the ones above: to learn whether your data is processed, to ask for information, correction and erasure, and to object to processing.
If our answer does not satisfy you, you may complain to the Personal Data Protection Board.
The game is not directed at anybody under 13, and we do not knowingly collect data from anybody under 13.
If you believe your child has given us data, write to us; we will close the account and delete the data.
Please write to us first: most matters are settled in a single e-mail.
If our answer does not satisfy you, you keep the right to complain to the data protection authority of your country. The United Kingdom's authority is named at the foot of this page.
TRUETHINKS LTD · 128 City Road, London, EC1V 2NX · hello@enomotia.net
ENOMOTIA