Privacy Policy

Last updated: October 2026 — beta version

Who we are

Cloudforge is a free browser game in beta, developed independently. Data controller: the game's developer, reachable at the address at the bottom of this page.

What data we collect

• Email — used to create your account and to log in via a one-time code (OTP). We do not share it with anyone and we do not send newsletters.
• Game data — captain name, progress, in-game messages, reports sent through the feedback form.
• Minimal technical data — IP address in the server logs (security and anti-abuse) and browser type if you send a report.
• Push notifications — only if you enable them: we store your browser's push subscription to alert you (e.g. incoming attacks). You can disable them at any time from Settings.
• Anti-fraud fingerprints — to prevent one person from playing with several accounts (an unfair advantage over other captains) we store, linked to your account: a hashed fingerprint of your IP address and a hashed fingerprint of a random identifier the game keeps in your browser, together with technical characteristics of the device: system, screen size and pixel density, number of processors, memory (already rounded by the browser), touch support, graphics card model, time zone and language. These are the same details every browser exposes to any website in order to draw the page correctly — we do not store them, we store only their fingerprint. These are one-way fingerprints (HMAC-SHA256 with a key that never leaves our server): we do not keep your IP address in the game database, and a fingerprint cannot be turned back into the original data. They serve one purpose only — comparing two accounts with each other — and are never used to profile you, for advertising, or to recognise you on other sites.
• Anti-automation click signature: when you launch an expedition, the game attaches to the request a few numbers describing the click you just made (how long it lasted, whether and how the pointer moved beforehand, whether the click came from the browser or from a program). The mouse path never leaves your device: the browser keeps only the last moments in memory and overwrites them continuously. These numbers serve one purpose only, telling a captain apart from a program playing in their place, and are kept with the game action log.

Your game session is kept with a token stored in your browser (necessary technical storage), not a profiling cookie.

The anti-fraud random identifier is also stored in your browser. You can delete it at any time by clearing the site data: the game keeps working and a new one is generated.

Cookies and marketing (Meta Pixel)

We use the technical storage necessary to keep you signed in. Only with your consent, collected through the cookie banner on your first visit, do we activate the Meta Pixel (Meta Platforms Ireland Ltd.) to measure and optimise our advertising campaigns. Until you give consent the pixel is not loaded and no data is sent to Meta. The legal basis is your consent (art. 6.1.a GDPR), which you can withdraw at any time via the "Cookie preferences" link at the bottom of the page. The Meta Pixel may involve a transfer of data to the United States (Meta Platforms, Inc.): this takes place under the EU Commission's Standard Contractual Clauses and/or Meta's adherence to the EU-US Data Privacy Framework. We do not sell your data and we use no other third-party analytics.

Sign in with Google (optional)

If you choose to sign in with Google we receive only your verified email. No other data from your Google account is read or stored.

Messages and moderation

Private messages between captains are stored encrypted on our server, with a key that never leaves the server: if a copy of the database ended up elsewhere, the messages would remain unreadable. They are seen by the two captains in the conversation.

To enforce the rules (scams, threats, harassment, unlawful content) the game's management may review a message when it is reported or when there is a concrete suspicion of abuse, and for that purpose only. Guild and world chats are visible to their participants. This review relies on legitimate interest (art. 6.1.f GDPR) in keeping the game safe for everyone.

Where the data is and for how long

Data resides on a server within the European Union. Login emails (OTP) are sent through a transactional mail provider. Data is kept for the duration of the beta; at a version change your game progress may be reset. You can request complete deletion of your account at any time.

Legal bases

We process your data on these bases (art. 6 GDPR): performance of the service for account, email and game data (6.1.b); legitimate interest for technical security and anti-abuse logs (6.1.f); consent for push notifications and marketing cookies (6.1.a).

The anti-fraud fingerprints and the click signature described above rely on legitimate interest (6.1.f) in keeping the game fair between captains and preventing abuse: without them a single player could use several accounts to gain an advantage at everyone else's expense. They are kept to the minimum needed for that purpose — one-way fingerprints instead of the original data, no advertising use, no tracking outside Cloudforge — and you may object to this processing by writing to the address at the bottom of this page. Fingerprints are deleted together with your account, and in any case once they are no longer needed for this check.

Your rights (GDPR)

You can request access, rectification, erasure, restriction, objection and export of your data, and withdraw consent at any time, by writing to the address below. We will respond within 30 days. If you believe the processing infringes the GDPR, you have the right to lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali (garanteprivacy.it).

Contact

For any privacy request: privacy@playcloudforge.com