Privacy Policy

1. Controller

The controller responsible for processing personal data through Ashfall Dominion is:

2. Scope and principles

This policy explains how personal data is processed when you visit, register for, or play Ashfall Dominion, contact us, use communications or alliances, enable notifications, or use a referral link. We process only data required to operate, secure, and improve the game and to provide features requested by players.

We do not use advertising networks, behavioural tracking, analytics services, social-media pixels, external fonts, or third-party content-delivery networks. Game assets are delivered from our own domain.

3. Data processed when the website is accessed

Our web server may process the IP address, date and time, requested address, HTTP method, response status, transferred volume, referrer, user-agent information, and technical error information. The application also records IP addresses and action context for security-relevant audit events and uses temporary rate-limit records to prevent abuse.

The purposes are delivery of the website, service stability, troubleshooting, prevention of fraud and attacks, and protection of player accounts and game integrity. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure and reliable operation of the service and the investigation of misuse.

Technical and security records are retained only for as long as they remain necessary for operations, abuse prevention, incident investigation, or the establishment, exercise, or defence of legal claims. Rate-limit records are routinely removed after their operational window.

4. Account, profile, and game data

When you create or use an account, we process information including:

• email address, ruler name, password hash, verification status, privacy-policy acknowledgement (version, timestamp and IP address), account role and status, registration and last-login timestamps;
• language, time zone, avatar, notification and accessibility preferences;
• world profiles, cities, map positions, resources, buildings, research, armies, fleets, movements, reports, rankings, quests, inventory, cosmetics, heroes, regents, dynasty and progression data;
• alliances, diplomacy, shared reports, forum and chat contributions, private messages, invitations and referral relationships;
• security events, moderation actions, bans, account changes and deletion requests.

Processing is necessary to create and perform your game account and provide the persistent game world you request (Article 6(1)(b) GDPR). Security and moderation processing is additionally based on Article 6(1)(f) GDPR.

Your ruler name, avatar, selected cosmetics, cities, alliance, score, ranking, achievements, public hero or regent information, and game actions visible under the rules of the world may be shown to other players. Private messages are shown to their participants; alliance content is shown to eligible alliance members. Authorised administrators may access records where necessary to operate, moderate, secure, or support the service.

5. Email, support, and notifications

We use your email address for account verification, password recovery, security and account notices, and notification categories you enable. Transactional messages are sent from our own mail infrastructure. Your destination email provider necessarily receives the message and related delivery data.

If you contact us by email, we process your address, message, attachments, and related communication to answer the request. The legal basis is Article 6(1)(b) GDPR where the request concerns your account or service, and otherwise Article 6(1)(f) GDPR based on our interest in handling enquiries.

Browser notifications are optional. Permission is requested only when you activate browser notifications. You can change game notification preferences in Settings and revoke browser permission in your browser at any time. Ashfall Dominion does not subscribe you to an external push-notification provider.

6. Cookies and storage on your device

These technologies are not used for advertising or cross-site tracking. Access to information on your device is governed by section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The session cookie is required to provide the logged-in service. Preference storage supports settings expressly selected by the player.

7. Hosting and recipients

The service is hosted in Germany by:

Hetzner processes hosting and infrastructure data on our behalf where applicable. Other recipients are limited to providers necessary for email delivery, authorised personnel, other players where a feature is intentionally public or shared, and public authorities where disclosure is legally required.

We do not intentionally transfer personal data to recipients outside the European Economic Area. Following an external link is a separate visit to the destination provider.

8. Retention and account deletion

Account and game data is retained while your account remains active and as needed to provide the persistent world. You may schedule account deletion from Settings. A 24-hour grace period applies; signing in again during that period cancels the request. After the grace period, the account and its relations are removed through the server-side deletion process.

Individual records may be retained for a longer period only where required by law or necessary to document security incidents, enforce claims, defend against claims, or protect the rights of other players. Verification and password-reset tokens expire after their technical validity period.

9. Automated game calculations

Economy, combat, movement, missions, rewards, matchmaking of procedural content, and progression are calculated automatically by server-authoritative game rules. These calculations determine game outcomes only. They do not produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.

10. Your rights

Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction of processing, data portability, and objection. Where processing is based on consent, you may withdraw that consent at any time without affecting earlier lawful processing. To exercise a right, contact contact@ashfall-dominion.com.

You also have the right to lodge a complaint with a data-protection supervisory authority. The authority responsible for non-public bodies established in Saxony is:

11. Security and changes to this policy

We use access controls, password hashing, prepared database statements, CSRF protection, transport security, session protections, rate limiting, audit records, and restrictive browser security headers. No internet service can guarantee absolute security.

We may update this policy when the service, legal requirements, or processing activities change. The current version and effective date are published on this page.