Privacy Policy

Last updated: July 2026 — alpha version

Who we are

Cloudforge is a free browser game in alpha, developed independently. Data controller: the game's developer, reachable at the address at the bottom of this page.

What data we collect

• Email — used to create your account and to log in via a one-time code (OTP). We do not share it with anyone and we do not send newsletters.
• Game data — captain name, progress, in-game messages, reports sent through the feedback form.
• Minimal technical data — IP address in the server logs (security and anti-abuse) and browser type if you send a report.
• Push notifications — only if you enable them: we store your browser's push subscription to alert you (e.g. incoming attacks). You can disable them at any time from Settings.
• Anti-fraud fingerprints — to prevent one person from playing with several accounts (an unfair advantage over other captains) we store, linked to your account: a hashed fingerprint of your IP address and a hashed fingerprint of a random identifier the game keeps in your browser, together with technical characteristics of the device: system, screen size and pixel density, number of processors, memory (already rounded by the browser), touch support, graphics card model, time zone and language. These are the same details every browser exposes to any website in order to draw the page correctly — we do not store them, we store only their fingerprint. These are one-way fingerprints (HMAC-SHA256 with a key that never leaves our server): we do not keep your IP address in the game database, and a fingerprint cannot be turned back into the original data. They serve one purpose only — comparing two accounts with each other — and are never used to profile you, for advertising, or to recognise you on other sites.

Your game session is kept with a token stored in your browser (necessary technical storage), not a profiling cookie.

The anti-fraud random identifier is also stored in your browser. You can delete it at any time by clearing the site data: the game keeps working and a new one is generated.

Cookies and marketing (Meta Pixel)

We use the technical storage necessary to keep you signed in. Only with your consent, collected through the cookie banner on your first visit, do we activate the Meta Pixel (Meta Platforms Ireland Ltd.) to measure and optimise our advertising campaigns. Until you give consent the pixel is not loaded and no data is sent to Meta. The legal basis is your consent (art. 6.1.a GDPR), which you can withdraw at any time via the "Cookie preferences" link at the bottom of the page. The Meta Pixel may involve a transfer of data to the United States (Meta Platforms, Inc.): this takes place under the EU Commission's Standard Contractual Clauses and/or Meta's adherence to the EU-US Data Privacy Framework. We do not sell your data and we use no other third-party analytics.

Sign in with Google (optional)

If you choose to sign in with Google we receive only your verified email. No other data from your Google account is read or stored.

Where the data is and for how long

Data resides on a server within the European Union. Login emails (OTP) are sent through a transactional mail provider. Data is kept for the duration of the alpha; at a version change your game progress may be reset. You can request complete deletion of your account at any time.

Legal bases

We process your data on these bases (art. 6 GDPR): performance of the service for account, email and game data (6.1.b); legitimate interest for technical security and anti-abuse logs (6.1.f); consent for push notifications and marketing cookies (6.1.a).

The anti-fraud fingerprints described above rely on legitimate interest (6.1.f) in keeping the game fair between captains and preventing abuse: without them a single player could use several accounts to gain an advantage at everyone else's expense. They are kept to the minimum needed for that purpose — one-way fingerprints instead of the original data, no advertising use, no tracking outside Cloudforge — and you may object to this processing by writing to the address at the bottom of this page. Fingerprints are deleted together with your account, and in any case once they are no longer needed for this check.

Your rights (GDPR)

You can request access, rectification, erasure, restriction, objection and export of your data, and withdraw consent at any time, by writing to the address below. We will respond within 30 days. If you believe the processing infringes the GDPR, you have the right to lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali (garanteprivacy.it).

Contact

For any privacy request: privacy@playcloudforge.com