Privacy Policy

1. Controller

The controller responsible for processing personal data through Ashfall Dominion is:

2. Scope and principles

This policy explains how personal data is processed when you visit, register for, or play Ashfall Dominion, contact us, use communications or alliances, enable notifications, use a referral link, or deliberately start a purchase. We process only data required to operate, secure, and improve the game and to provide features requested by players.

We do not use advertising networks, behavioural tracking, analytics services, social-media pixels, external fonts, embedded social-media widgets, or third-party content-delivery networks. Game assets and the filtered community-status display are delivered from our own domain.

3. Data processed when the website is accessed

Our web server may process the IP address, date and time, requested address, HTTP method, response status, transferred volume, referrer, user-agent information, and technical error information. The application also records IP addresses and action context for security-relevant audit events and uses temporary rate-limit records to prevent abuse.

The purposes are delivery of the website, service stability, troubleshooting, prevention of fraud and attacks, and protection of player accounts and game integrity. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure and reliable operation of the service and the investigation of misuse.

Technical and security records are retained only for as long as they remain necessary for operations, abuse prevention, incident investigation, or the establishment, exercise, or defence of legal claims. Rate-limit records are routinely removed after their operational window.

4. Account, profile, and game data

When you create or use an account, we process information including:

• email address, ruler name, password hash, verification status, privacy-policy acknowledgement (version, timestamp and IP address), account role and status, registration and last-login timestamps;
• language, time zone, avatar, notification and accessibility preferences;
• world profiles, cities, map positions, resources, buildings, research, armies, fleets, movements, reports, rankings, quests, inventory, cosmetics, heroes, regents, dynasty and progression data;
• alliances, diplomacy, shared reports, forum and chat contributions, private messages, invitations and referral relationships;
• security events, moderation actions, bans, account changes and deletion requests.

Processing is necessary to create and perform your game account and provide the persistent game world you request (Article 6(1)(b) GDPR). Security and moderation processing is additionally based on Article 6(1)(f) GDPR.

Your ruler name, avatar, selected cosmetics, cities, alliance, score, ranking, achievements, public hero or regent information, and game actions visible under the rules of the world may be shown to other players. Private messages are shown to their participants; alliance content is shown to eligible alliance members. Authorised administrators may access records where necessary to operate, moderate, secure, or support the service.

5. Email, support, and notifications

We use your email address for account verification, password recovery, security and account notices, and notification categories you enable. Transactional messages are sent from our own mail infrastructure. Your destination email provider necessarily receives the message and related delivery data.

If you contact us by email, we process your address, message, attachments, and related communication to answer the request. The legal basis is Article 6(1)(b) GDPR where the request concerns your account or service, and otherwise Article 6(1)(f) GDPR based on our interest in handling enquiries.

Browser notifications are optional. Permission is requested only when you activate browser notifications. You can change game notification preferences in Settings and revoke browser permission in your browser at any time. Ashfall Dominion does not subscribe you to an external push-notification provider.

6. Cookies and storage on your device

These technologies are not used for advertising or cross-site tracking. Access to information on your device is governed by section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The session cookie is required to provide the logged-in service. Preference storage supports settings expressly selected by the player.

7. Discord community status and external link

The public landing page shows a custom Ashfall Dominion community card. It is not an embedded Discord widget. Our server retrieves Discord's public guild-widget response at intervals and immediately filters it. The browser receives only the community name, aggregate number of members currently online, availability state, and a validated invitation link. Member records, usernames, avatars, and channel records are neither sent to the browser nor stored in the Ashfall Dominion status cache.

Loading the landing page therefore does not establish a direct browser connection to Discord and does not transmit your IP address, browser details, Discord session, cookies, or gameplay input to Discord. Discord receives the technical connection data of our server when that server requests the public aggregate status.

You can play Ashfall Dominion without using Discord. Only when you deliberately follow the external community link does your browser visit Discord. That visit is governed independently by Discord's services and terms. For users in the EEA, Discord Netherlands BV identifies itself as the controller for Discord services and describes its processing and international-transfer safeguards in its Privacy Policy.

8. Purchases and Xsolla

Gems are optional digital purchases. Premium time is not sold by Xsolla; it is activated within Ashfall Dominion by spending Gems. No connection from your browser to Xsolla is made merely by opening or playing Ashfall Dominion, or by activating Premium with Gems. A connection is established only after you deliberately select a Gem package and open the secure checkout.

To create and fulfil a Gem order, Ashfall Dominion sends Xsolla a pseudonymous account identifier, ruler name, verified email address, language, IP address, selected Gem package and quantity, currency, and technical order references. Xsolla processes the checkout, payment method, payment and fraud-prevention information under its own responsibility. Ashfall Dominion does not receive or store complete card, bank-account, or other payment-instrument details.

We retain a commerce ledger containing the pseudonymous order reference, Xsolla order, invoice and transaction references, product and quantity, expected amount and currency, order status, and fulfilment or reversal timestamps. This is used to perform the purchase, deliver and reverse entitlements, prevent duplicate grants, handle refunds and chargebacks, provide support, prevent fraud, and meet accounting obligations. The legal bases are Article 6(1)(b), Article 6(1)(c), and, for abuse and fraud prevention, Article 6(1)(f) GDPR.

Depending on the transaction and region, Xsolla may act as merchant of record and as an independent or joint controller for parts of the Gem payment process. Xsolla may process data outside the European Economic Area subject to the safeguards described in the Xsolla Privacy Policy. Payment is optional; the game remains playable without Premium.

9. Hosting and recipients

The service is hosted in Germany by:

Hetzner processes hosting and infrastructure data on our behalf where applicable. Other recipients are limited to providers necessary for email delivery, authorised personnel, other players where a feature is intentionally public or shared, and public authorities where disclosure is legally required.

The same-origin Discord status display described in section 7 does not send visitor data to Discord. Apart from the deliberately initiated Xsolla checkout described in section 8, we do not otherwise intentionally transfer personal data to recipients outside the European Economic Area. Following any external link is a separate visit to the destination provider.

10. Retention and account deletion

Account and game data is retained while your account remains active and as needed to provide the persistent world. You may schedule account deletion from Settings. A 24-hour grace period applies; signing in again during that period cancels the request. After the grace period, the account and its relations are removed through the server-side deletion process.

Commerce and accounting records are retained separately for the applicable statutory retention period even after game-account deletion. Their direct game-account links are removed when the linked account is deleted. Individual records may also be retained where necessary to document security incidents, enforce claims, defend against claims, or protect the rights of other players. Verification and password-reset tokens expire after their technical validity period.

11. Automated game calculations

Economy, combat, movement, missions, rewards, matchmaking of procedural content, and progression are calculated automatically by server-authoritative game rules. These calculations determine game outcomes only. They do not produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.

12. Your rights

Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction of processing, data portability, and objection. Where processing is based on consent, you may withdraw that consent at any time without affecting earlier lawful processing. To exercise a right, contact contact@ashfall-dominion.com.

You also have the right to lodge a complaint with a data-protection supervisory authority. The authority responsible for non-public bodies established in Saxony is:

13. Security and changes to this policy

We use access controls, password hashing, prepared database statements, CSRF protection, transport security, session protections, rate limiting, audit records, and restrictive browser security headers. No internet service can guarantee absolute security.

We may update this policy when the service, legal requirements, or processing activities change. The current version and effective date are published on this page.