Privacy notice
IRON ATLAS (working title), a free browser strategy game in an open playtest. Last updated 21 October 2026.
In short. There are no accounts, no ads, no cookies and no third-party trackers, fonts or scripts. The game's server gives your browser a random player id so it can keep your seat, your name and your results. Play statistics are counted under that id only if you turn on Help improve the game: count my plays in the menu; it is off until you do. In the menu, Your data shows your id and lets you download what is kept about it and delete it (chat reports stay for their 90 days, as described below). If you ask for launch news, we keep your email address for that alone, apart from your id.
Who is responsible
The controller of your personal data is {{OPERATOR_NAME}}, {{ADDRESS}}. Contact for anything about your data: {{CONTACT_EMAIL}}. We answer in English or Greek.
Your player id
The first time you need one (you join an online match, choose a name, or play a match alone or the tutorial with play statistics on), the server hands your browser a random 16-character id with a signature that shows the server issued it, and the game stores both in your browser's local storage (ia-player, ia-player-sig). A browser that already had an id from before keeps it. It is how the server tells your browser apart from others; taking a seat, Quick Play and play statistics need the signature, so nobody can pass for another player by making up an id. The server keeps it with the name you choose and your results, as described below, but never with an email address or your IP address, and with your screen size and browser only in feedback you send with Include details ticked. Simply opening the menu does not create it. Anyone who holds your id can see and delete your data, change your name and play as you (the server gives the signature again to a browser that shows an id it knows), so the game never shows your id or its signature to other players, and you should not share them.
What stays in your browser
These are kept in your browser's storage and only leave it as described further down. They are needed for the parts of the game you use (the storage exception of the ePrivacy rules), except the statistics choice, which only records your answer.
| Key | What it holds | How long |
|---|---|---|
ia-player, ia-player-sig | your random player id, and the server's signature for it | until you delete it (Your data, or clearing the site's data) |
ia-name | the name you typed in the menu | same |
ia-seats | seat tokens that let you rejoin your online matches | a day (older ones go when the next one is stored) |
ia-last-match | the online match you were last seated in, for "Resume your match" | until that match ends (offered for 45 minutes) |
ia-vs-ai | your last 20 results alone against the AI (with play statistics on, each result also reaches the server with that match's play report) | until deleted |
ia-stats | your answer to "count my plays" | until deleted |
ironAtlas.sound, ironAtlas.tutorialDone | sound settings, whether you finished the tutorial | until deleted |
ia-waitlist | the email addresses you signed up for launch news from this browser (up to 5), each with the tokens (up to two) that take it off the list | until you leave the list from this browser, or delete it |
ia-mutes | the players you muted, by the short code their seats carry (see below) | 30 days after each mute, or until you unmute |
ia-ticket-…, ia-token-…, ia-stats-tab (session storage) | a Quick Play seat promise, an older seat token, your "count my plays" answer when the browser would not save it | until the tab closes |
What the server keeps, why, and for how long
The server never stores your IP address, and nothing it stores is your real name unless you type it yourself, as your player name, in chat, in feedback, or in the email address you give for launch news.
While you play an online match
The match keeps its seats (seat names, player ids, seat tokens), the game state and the last 40 chat lines, including private lines between two players, so it can run and so you can rejoin. The other players' browsers get your seat name and a short code made from your player id (8 characters; it cannot be turned back into the id), the same in every match, so that a player who muted you keeps you muted in later matches. Why: to provide the game you asked for (GDPR Art. 6(1)(b)). How long: everything is deleted 24 hours after the match ends.
Results, profile and leaderboard
When an online or Quick Play match ends, each human player's result is kept: match, player id, the seat name played under, mode, time, place, victory points, win and points. Results alone against the AI are kept too if you have turned on play statistics (they arrive with the play reports). Why: your profile in the menu and the public leaderboard (Art. 6(1)(b)). How long: 24 months. Who sees it: the leaderboard shows your chosen name (or your latest seat name), points, wins and matches to everyone, never your id.
Your chosen name
Once you have finished an online match (or one alone against the AI with play statistics on), the name you choose is reserved for your id so nobody else can use it: player id, name, when you chose it and when you were last seen. Before that, the name stays in your browser and is only used as your seat name. Why: unique names (Art. 6(1)(b)). How long: until you clear or change it, or 30 days after you were last seen in the game. Clearing or changing your name also removes the old name from your past results; a name freed after 30 days stays on the results you played under it (and can show on the leaderboard) until they expire or you delete them. Your name is shown to the other players of your matches and on the leaderboard: do not use your real name.
Play statistics ("count my plays")
With the box ticked: each visit to an online match (match, player id, seat, when you joined and left, mode), and each match alone against the AI or tutorial (a random play id, player id, mode, seats, tick length, start and end times, how far it got, how it ended, whether it was a rematch, the furthest tutorial step, when the first battle came). Why: to see whether the game works for people: how long matches are played, how many players come back the next day, where the tutorial loses them. Legal basis: your consent (Art. 6(1)(a)); untick the box at any time and nothing more is counted under your id (an online match you are already in when you change it is counted the way it was when you connected). How long: 13 months.
Without the box ticked: matches alone against the AI and the tutorial send nothing. A visit to an online match is still recorded, but without your player id (match, seat, join and leave times, mode), to count how long online matches are played. It is not fully anonymous: in a match where you were the only human, or the only one without the box ticked, it can be matched to your result through the match. Legal basis: our legitimate interest in knowing whether the game works (Art. 6(1)(f)); you can object by email. How long: 13 months. Each finished match is also kept as one row without any player data (end reason, length, seats, number of humans, mode, whether it was a rematch, when the first battle came), also for 13 months.
Feedback you send
The text you write and, if you leave Include details ticked, the match, minute, seat, screen size, browser (user agent), game build and your player id. With the box unticked only the text is stored. Please do not write personal details in it. Why: to fix problems and improve the game (Art. 6(1)(f)). How long: 12 months.
Chat reports
When a player uses Report next to another player's name in the chat panel, we keep: the match and the minute, both players' seat names and player ids, the note the reporter wrote (if any), and the server's own copy of the recent chat lines between the two that the reporter could read (up to 40, including private lines between them; reporting the same player again in that match adds the newer lines and note to the same report, up to 200 lines). The reported player is not told who reported them. Why: to keep the game safe and act on reports of abuse or illegal content (Art. 6(1)(f), and our duties under the EU Digital Services Act). How long: 90 days after the last report. Deleting your data removes your player id and seat name from the reports you made; your note and the chat lines stay, and reports other players made about you stay for their 90 days, so that they can still be acted on. Your data's download includes the reports you made (never the other player's id) and the reports made about you, with only the lines you wrote to everyone (never who reported you, their note, or private lines, which would show who it was).
Launch news (email list)
If you use Email me when the game launches (in the menu or after a match), we keep: your email address, where you signed up (menu or end of a match), when, and which version of the consent text you agreed to (if you sign up again after that text changes, the newer version and when you agreed to it). It is not linked to your player id, your name or your results. Why: to write to you when the game launches and about big updates, at most once a month. Nothing else is done with it: no ads, no sharing, no profile. Legal basis: your consent (Art. 6(1)(a)), given by ticking the box; the list is for ages 15 and over. How long: until you leave the list, or 24 months after you first signed up, whichever comes first. The form does not check that the address is yours: before the first email, we will ask every address on the list to confirm that it signed up, and delete the ones that do not. Leave at any time: in the browser you signed up with, open the same form and press Take me off the list (that browser keeps tokens that prove the address is yours to take off, ia-waitlist; the address alone is not enough, so nobody else can take you off); use the leave link in any email we send; or write to {{CONTACT_EMAIL}}. No email has been sent yet.
Network and hosting
The game runs on Cloudflare. Your IP address is used for a minute at a time to limit how many requests one address can send (Cloudflare rate limiting); the game does not store it. To limit how many online matches one network (an IPv4 address, or the /64 block of an IPv6 one) can start in a day, the server keeps a hash of that network with a count, mixed with a random value; both are replaced by new ones on the next day that a match is started, after which they cannot be tied to anyone. Until then, the network could be worked out from its hash by trying every IPv4 address. So that one person cannot fill several seats of a match, each match also counts its seats and connection attempts by network, in its memory only while it runs; that count is never stored. Cloudflare keeps technical logs of about one request in ten, which can include your IP address and the request address with your player id and, for match connections, its signature, the name you typed and your seat token or Quick Play ticket (and, for the leave link in our emails, your email address and its leave token), for {{CLOUDFLARE_LOG_RETENTION}}. Why: keeping the service secure and finding errors (Art. 6(1)(f)).
Who else receives it
Cloudflare, Inc. hosts the game and stores its data as our processor under its Data Processing Addendum. Cloudflare may process data in the United States; transfers rely on the EU-U.S. Data Privacy Framework and the standard contractual clauses in that addendum. Nobody else receives your data. Before we send any email to the launch-news list, this page will name the email service that sends it. We do not sell it or use it for advertising, and nothing is used for automated decisions about you.
Your rights
- See and copy your data: menu → Your data → Download my data (a JSON file of what is kept under your id, including chat reports about you without who made them, plus what is in your browser).
- Delete it: menu → Your data → Delete my data. It removes your profile, results, name, visits, plays and feedback from the server, and your id and name from the chat reports you made, and clears the game's storage in your browser. Reports other players made about you stay for 90 days. Online matches you are still seated in (the ones whose seat tokens this browser keeps), and the rematch lobbies opened from them, drop your id at once, so they end without a result under it. For two days afterwards the server keeps the deleted id on a list, only so that anything still arriving under it from a match or a play that was running is dropped or kept without it, and so that the id is never handed out again; then the list forgets it. The launch-news list is not linked to your id, so this does not touch it, and it deletes this browser's leave token: leave the list first, or later with the link in any email from us or by email.
- Correct or remove your name: change or clear it in the menu.
- Withdraw consent: untick "count my plays"; it applies at once to matches alone and from the next online match you join. If your browser will not let the game change the saved answer, the menu says so, and clearing this site's data in your browser settings turns it off. What was counted before stays until it expires or you delete it. To stop launch news, leave the list (see Launch news).
- You can also ask us by email for access, correction, deletion, restriction, a portable copy, or object to processing based on our legitimate interest: {{CONTACT_EMAIL}}. Include your player id (from Your data), since it is the only way we can find your data; for the launch-news list, give the email address instead (we may ask you to confirm that it is yours). We answer within one month.
- You may complain to a data protection authority, in Greece the Hellenic Data Protection Authority (www.dpa.gr, Kifisias 1-3, 115 23 Athens), or the one where you live.
Children
The game is meant for players aged 13 and over. Chat with other players, the play statistics option and the launch-news list are for ages 15 and over, the age at which Greek law lets you consent on your own (Law 4624/2019, Art. 21). If you are younger, keep "count my plays" off and ask a parent or guardian before you chat.
Changes
When what we keep changes, this page changes with it and shows a new date at the top. We will not use your email address for anything new without asking you again.