Privacy Policy
This policy explains what personal data Twenty-Sided Tactics (“the game”) collects when you visit our websites or play the game, why, how long we keep it, and what rights you have. The short version: we collect only what the game needs to work and to stay secure. We do not sell your data, show ads, or use tracking or analytics cookies.
1. Who is responsible
The controller responsible for your personal data is:
Tomorrow Tree EOOD
zh.k. Mladost 2, 1799 Sofia, Bulgaria
Email: privacy@twentysidedtactics.com
Write to that address for any question about this policy or to exercise your rights (section 7).
2. What we collect and why
Your account. When you start playing, we create an account for you. A guest account is only a random identifier. If you sign up, we also store your email address, a hashed password (Argon2id; we never store the password itself), whether you have verified your email, and a display name if you choose one. We use this data to sign you in and keep your progress.
Your game data. We store your teams and team names, units, battle results, rating, cosmetic items and matchmaking history. That is the game itself. Other players see your team name and your team when they are matched against it, and your saved teams can be used as opponents for other players.
Your devices. To keep you signed in on a device, the game generates a cryptographic key pair on that device. We store the public key along with basic device information: device name and type, operating system version, game version, an installation identifier, and when it was last used. We also record when you last signed in and were last active, and which game version and platform you used. We use this to keep you signed in securely, let you recognise and revoke your devices, and find problems that affect particular versions or platforms.
Server logs. Like any website, our web server logs each request: your IP address, the time, the page or resource requested, the response, the referring page, and your browser's user-agent string. The game server also logs each request it handles: the time, the address requested, the response and how long it took, a random session identifier, your account identifier where the request concerns your account, and any error. We use these logs to run and secure the service, investigate errors and abuse, and count overall visits. Separately, sign-in, sign-up and password-reset attempts are counted per IP address and per email address, in memory, to block brute-force attacks.
Email. If you sign up with an email address, we may use it to verify the address and to send password-reset messages you request. We do not send marketing email.
Emails you send us. If you email us for help or to use your privacy rights, we keep your email address, your messages, our replies and anything you attach. We use them to answer you and, for privacy requests, to show that we handled your request.
3. Legal basis
- Performing our agreement with you (GDPR Art. 6(1)(b)): your account, game data, device sign-in, account emails, and answering your support emails. Without this data we cannot provide the game.
- Our legal obligations (GDPR Art. 6(1)(c)): handling your privacy requests and keeping a record that we did.
- Our legitimate interests (GDPR Art. 6(1)(f)): server logs, rate limiting and abuse prevention, error diagnosis, and overall visit statistics. Our interest is in keeping the service secure, working and fair. You can object to this processing (section 7).
4. Storage on your device (cookies)
The game does not set any cookies. It does store the following in your browser's storage (IndexedDB) or, in the desktop and mobile versions, on your device:
- your sign-in token, so you stay signed in;
- the device key pair described above;
- downloaded game content, translations and settings, so the game loads faster and remembers your choices.
All of this is strictly necessary to provide the game you asked to play, so no consent banner is shown. You can remove it at any time by clearing the site's data in your browser or uninstalling the game; you will then need to sign in again, and a guest account that has no email address may be lost.
5. Who else processes your data
Our servers are hosted by netcup GmbH in Germany, and email sent to us is handled by mailbox.org (Heinlein Hosting GmbH) in Germany. Both act as our processors under data processing agreements. We do not share your personal data with anyone else, except where the law requires it. Your data is stored in the European Union and we do not transfer it outside the EU/EEA.
6. How long we keep it
| Data | Kept for |
|---|---|
| Account, game and device data | Until you ask us to delete your account. Revoked devices are kept with the account until then. |
| Server logs | Up to 14 days, then deleted automatically |
| Rate-limit counters | In memory only, for at most one hour |
| Password-reset links | Stored only as a hash; they expire and stop working after a short time |
| Database backups | Up to 30 days, then deleted automatically. A backup can still hold a deleted account's data until then. |
| Privacy requests you email us | 2 years after we close your request: the period in which a complaint about how we handled it can be made |
| Other emails to us | 1 year after your question is resolved |
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct data that is wrong;
- delete your account and its data;
- receive your data in a portable, machine-readable format;
- restrict our use of your data, or object to processing based on our legitimate interests.
To use any of these rights, email us at the address in section 1. To delete a registered account, write from the email address on the account. For a guest account, include the name of one of your teams. We will reply within one month.
You also have the right to complain to a data protection authority, either in the EU country where you live or in Bulgaria, where ours is the Commission for Personal Data Protection.
8. Children
The game is not directed at children under 14. If you are under 14, please ask a parent or guardian before creating an account. If you believe a child has given us personal data, contact us and we will delete it.
9. Security
All connections to the game use HTTPS. Passwords are stored only as salted hashes, and access to our servers is limited to the operator.
10. Changes
If we change how we handle personal data, for example by adding a payment or email provider, we will update this page and its date. For significant changes we will also tell you in the game.