Privacy Policy

Last updated: March 2026

1. What we collect

When you create an account, we store:

• Username and email address - for login and game notifications
• Password - stored as a secure bcrypt hash (we cannot read it)
• Game data - moves, chat messages, and statistics from games you play
• IP address - temporarily, in server logs for security purposes

We do not collect, store, or share any data beyond what is listed above. We do not use analytics trackers, advertising networks, or third-party cookies.

2. Cookies

We use a single session cookie to keep you logged in. This is a strictly necessary cookie required for the site to function. No consent banner is needed for essential cookies under GDPR.

We do not use any tracking cookies, analytics cookies, or third-party cookies.

3. How we use your data

• Email - to send turn notifications and account recovery (only if you opt in)
• Username - displayed to other players in games, chat, and leaderboards
• Game data - to run the game, display statistics, and provide replay functionality

We do not sell, share, or transfer your personal data to any third parties.

4. Data retention

• Account data is kept as long as your account is active
• Game data for finished games is deleted after 72 hours
• Replay data is deleted after 7 days (AI games) or 180 days (other games)
• Chat messages are deleted after 3 months
• Private messages are deleted after 4 months

5. Your rights

Under GDPR, you have the right to:

• Access your data - use the "Export My Data" button in your profile settings
• Delete your data - use the "Delete Account" button in your profile settings
• Correct your data - edit your profile at any time
• Object to processing - you can disable all email notifications in settings

Account deletion anonymizes your username and removes all personal data (email, password, messages, chat history). Game statistics are retained in anonymized form to preserve leaderboard integrity.

6. Data security

Passwords are hashed with bcrypt. All connections use HTTPS encryption. Access to the database is restricted to the application server.

7. Children

Warbarons is not directed at children under 13. We do not knowingly collect data from children under 13.

8. Contact

For privacy-related questions, contact us at the email address listed on the main site.