Privacy Policy

1. Information we handle

• Account and sign-in: email address when you request email sign-in; a generated account ID; guest-account credentials; login-code hashes; and session records. The server stores login-code hashes rather than the codes themselves. Account emails are shown in masked form in the game.
• Device and session: the device ID supplied by the game client, access and refresh token hashes, session creation/expiry and revocation times, and account security events. Raw access/refresh tokens are used to authenticate you but are not stored as plaintext in the database.
• Network and security: IP address and request metadata. IP addresses support abuse prevention and request-rate limits, including login-code request and verification limits. A keyed hash of the IP is stored with a login-code record. Server request logs may include the request IP; the web server or hosting provider may also keep connection logs.
• Gameplay: faction, settlement, resources, units, expeditions, map discoveries, battle reports, and other game actions needed to operate the persistent world and prevent cheating.
• Purchases: if a purchase is made, the platform transaction identifier, product, purchase state, granted items, and a cryptographic hash of the receipt may be stored to verify and prevent duplicate grants. The full receipt is not stored by the game database. Real app-store verification is not yet configured.
• Supporter badge: if you support Cedarfall on Ko-fi, Ko-fi sends us a notification containing the email on the payment, the tier and a transaction ID. We match that email to a game account to show a golden supporter star beside your keep and outposts. Until a matching account exists we keep only a keyed hash of the email, never the readable address. The badge is cosmetic and gives no gameplay advantage.
• Support messages: information you choose to include when you email us.

2. How we use information

We use this information to create and restore accounts, send one-time login codes, maintain sessions, run the shared game world, save progress, deliver and protect purchases, prevent cheating and fraud, secure the service, respond to support requests, and meet legal obligations. The server is authoritative for game state and validates actions to protect fair play.

3. Cookies and local storage

The static marketing pages do not use advertising trackers or analytics cookies. The browser game stores session or display data in browser-local storage so it can keep you signed in and restore your game view. Clearing browser data can remove that local session and may sign you out.

4. Sharing and service providers

We use infrastructure providers to host the website, game server, and database, and an email delivery provider to send sign-in codes when configured. If in-app purchases are enabled, Apple or Google handles payment through its store and provides transaction information needed for verification. These providers process information to provide their services to us. We do not sell personal information or use it for third-party advertising.

5. Retention and deletion

Account, session, gameplay, and purchase records are kept while needed to operate the game, secure accounts, maintain the game ledger, resolve disputes, and meet legal obligations. Login-code records and operational logs are subject to system and hosting retention settings. The current codebase does not define a single retention period for these records. You may request account deletion by emailing [email protected] from your account email where possible. We will verify the request and explain any records we must retain.

6. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information, or object to certain processing. Email [email protected] to make a request. We may need to verify your identity before acting.

7. Children

Cedarfall is not designed to collect information from children who are not permitted to use online services under applicable law. If you believe a child provided us personal information, contact us and we will review the request.

8. Security and international processing

We use safeguards such as hashed credentials, limited session lifetimes, rate limits, and access controls. No internet service can promise absolute security. Our providers or servers may process information in countries other than yours, subject to applicable transfer protections.

9. Updates and contact

We may revise this policy as the game changes. The current version and effective date will be posted here. Privacy questions or requests: [email protected].