Privacy Policy

Last updated: 2026-08-25.

Controller

Alexander Kasimir, Kahlenbergerstrasse 84/8, 1190 Wien, Austria — alexander@kasimir.at. See also the Impressum.

What is collected, and why

Account data — email address and an Argon2 password hash, created when you register. Used to authenticate you, to confirm the address, and to send a password-reset email when you ask for one (GDPR Art. 6(1)(b), necessary to provide the game you signed up for).
Gameplay data — everything your account does in the game: colonies, fleets, research, designs, trade orders, alliance and diplomacy actions, and chat/private messages. This is the game itself and is processed to run it (Art. 6(1)(b)).
Session cookie (lattice.sid) — keeps you logged in. Strictly necessary for the service to function, so no cookie-consent banner is shown for it.
IP address — used transiently, in memory, for rate-limiting and abuse prevention (login attempts, API calls). Not written to the database. Legitimate interest in keeping the service available and secure (Art. 6(1)(f)).
Push notification subscription — if you opt in under Settings, your browser's or OS's push endpoint and encryption keys are stored so the server can deliver notifications. Opt-in, based on your consent (Art. 6(1)(a)), and removable at any time from Settings.
Agent API token — if you generate one, a token is stored so an external program you authorize can act on your account through the API (Art. 6(1)(b)).

Third parties

No data is sold or shared with advertisers, and this site runs no analytics or tracking scripts. All fonts, icons, and libraries are self-hosted — your browser never loads anything from a third-party server (such as Google Fonts) when you use this site.

Hosting — the application and database run on a server I operate; whoever provides that underlying infrastructure can, as with any host, technically access the machine, but is not a separate recipient of your data for any purpose beyond running the server.
Email delivery (Sequenzy) — if you register or request a password reset, your email address and player name are sent to Sequenzy so they can deliver that one-time message. Sequenzy is not given your password, and we do not use the service for marketing mail.

Retention and deletion

Your data is kept for as long as your account exists. Deleting your account (Settings → Delete account) overwrites your email and password beyond recovery, replaces your display name with a generic one, removes your API token and push subscriptions, and converts the account into a non-human, AI-controlled expedition. This keeps the shared game world (battles, trades, and alliances already recorded by other players) consistent, while nothing that remains can be traced back to you.

Your rights

Under the GDPR you can request access to, correction of, or erasure of your data (see above for how deletion works here), and can object to or ask to restrict processing. Contact the address above to exercise any of these. You can also complain to the Austrian data protection authority:

Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Wien, Austria
www.dsb.gv.at

Security

Passwords are hashed with Argon2 and never stored or logged in plain text. Standard HTTP security headers are enforced (via Helmet), and the production deployment is served over HTTPS.

Age

Registration does not currently verify age. Austria's digital age of consent is 14 — if you are younger than that, please only register with a parent or guardian's involvement.

Changes

This policy may be updated as the game changes; the date above reflects the last revision.