Privacy Policy
Last updated 15 September 2026
This policy explains what Game of Crowns (gameofcrowns.lol) collects, why, and what control you have. We collect as little as the game needs to work and to stay honest.
We do not sell your data, and we run no advertising trackers.
1. What we collect
From your Google account, when you sign in: your email address, name, profile picture, and Google account identifier. We request nothing else — no contacts, no Drive, no calendar.
What you give us: your handle, display name, biography, and an optional link.
Collected automatically: a one-way cryptographic hash of your IP address and browser user-agent; the country your connection appears to come from; and basic usage events such as pages viewed and actions taken.
We store a hash of your IP address, never the address itself. The hash lets us detect networks of fake accounts without us holding a record of where you connect from.
2. Why we use it
- To run the game — accounts, profiles, claims, backings, crowns
- To keep counts honest — detecting fake and duplicate accounts. This is the reason for the hashed IP and user-agent, and for the derived country.
- To email you about things that happen to you in the game: your country opening, being crowned, being dethroned
- To understand and improve the product, using aggregate analytics
- To comply with law and respond to valid legal requests
Where the GDPR applies, our legal bases are performance of a contract (running the Service), legitimate interests (preventing fraud, keeping the game fair, product improvement), and consent where required. Where India’s Digital Personal Data Protection Act applies, we process on the basis of your consent and for the legitimate uses it permits.
3. Duplicate-account detection
Because Google treats name@gmail.com and n.a.m.e+tag@gmail.com as the same mailbox, we store a normalised form of your email address to ensure one person holds one account. It is used only for that purpose.
4. How long we keep it
- Account and profile data — until you delete your account
- Hashed IP and user-agent — 90 days, then automatically purged
- Game history (reigns, results) — retained, but anonymised if you delete your account
- Analytics — aggregate only, not linked to you after account deletion
5. Who we share it with
We share data only with service providers who process it on our behalf, under contract, and only as needed to run the Service:
- Supabase — database and authentication
- Vercel — hosting and delivery
- Google — sign-in
- Resend — email delivery
- Cloudflare — bot protection
- PostHog — product analytics
We may disclose data where legally required. We do not sell it, rent it, or share it with advertisers.
6. What is public
Your handle, display name, avatar, biography, link, claims, crowns, and backer counts are public — that is the point of the game, and they may appear in share images that others post elsewhere.
Your email address is never shown publicly. Neither is your IP-derived country, nor any internal scoring we use to detect fraud.
7. Your rights
You can access, correct, export, or delete your data. Most of it you can edit directly in your profile. To delete your account, use the delete option in your profile settings, or email us.
When you delete your account, your profile and email are erased, backings you cast are anonymised, and past reigns remain in the game’s history attributed to “a former ruler”.
Depending on where you live you may also have the right to object to or restrict processing, to withdraw consent, and to complain to a data protection authority.
8. International transfers
We operate globally, and our providers may process data outside your country, including in the United States and the European Union. Where required, transfers rely on appropriate safeguards such as the European Commission’s standard contractual clauses.
9. Cookies
We use cookies that are strictly necessary to keep you signed in, and privacy-respecting analytics to understand how the Service is used. We do not use advertising or cross-site tracking cookies.
10. Children
The Service is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.
11. Security
Data is encrypted in transit and at rest, access is limited to what is necessary to operate the Service, and IP addresses are hashed rather than stored. No system is perfectly secure, but we take this seriously and will notify affected users of a breach where required by law.
12. Changes and contact
We will announce material changes to this policy on the Service. For any privacy question or request, including deletion: support@gameofcrowns.lol. We aim to respond within 48 hours.