Privacy Policy

Exercise your rights

Three direct paths covering the privacy actions most users come here for. Each route preserves identity verification and statutory timelines as described in the policy below.

1. Scope and who is responsible

This Privacy Policy explains how Thronestead collects, uses, shares, retains, and protects personal information when you visit our websites, play the game, use the account and support systems, use the public API, receive our emails or notifications, or take part in official community spaces such as the official Discord community.

Thronestead is operated independently by its developer, an individual established in New Hampshire, United States, who is the data controller for the personal data described here. You can reach the controller at ops@thronestead.com or through Contact Support. Discord, Google, and Stripe are independent controllers for what happens on their own platforms; see §7.

2. What we collect

Account and identity. Your email address, a hashed password (never the password itself), account status, for accounts created with email, the version and time of the Terms you accepted (accounts created with Google are asked in Settings, under Privacy and age), your kingdom name, ruler title, motto, region, and heraldry choices, and, if you sign in with Google, the email address, name, and stable account identifier Google sends us. We do not receive your Google password.

Public by design. Your kingdom name, ruler title, motto, heraldry, alliance and region memberships, public standings and leaderboard positions, public profile text, and the realm's public history (wars, treaties, foundings, falls, public judgements, press articles, and Crier addresses) are visible to every player and to visitors of public pages, and may be shared by other players. Choose them accordingly. Your email address, sign-in method, and payment details are never public.

Gameplay. Everything your kingdom does: buildings, queues, resources, trades, contracts, research, policies, armies, battles, espionage, diplomacy, alliance and region actions, votes, and the timing of those actions. This is the game state itself.

Communications. Chat messages, in-game mail, board and embassy posts, press articles, reports you file, appeals, and support tickets, together with the time and the sender and recipient, and your Who may send you letters setting (anyone, people you know, or nobody) with the turn you last chose it. A ruler your setting turns away is told only that you are not accepting letters right now. Communications are visible to their intended audience and to moderators and staff for safety and enforcement.

Purchases. If you subscribe to VIP: your Stripe customer identifier, subscription status and period, the product bought, amounts, currency, and refund or dispute events. Stripe collects and holds your card or bank details on its own systems; we never see or store them.

Device and security. IP address, browser and device type, language, the pages you request, session cookie values, bot-check results from Cloudflare Turnstile, and security logs (sign-ins, password changes, failed attempts, rate-limit events). Repeated sign-in signals are stored as one-way keyed hashes rather than raw values wherever the security purpose allows. Account-security audit records (sign-up, sign-in, password and account-state changes, deletion requests) store only the network part of the request's IP address (the last part is dropped) and a keyed one-way hash of the browser user-agent string, never the raw values; see §9 for how long.

Device recognition for anti-abuse. When you sign in, your browser computes a one-way fingerprint from technical characteristics (user-agent, languages, platform, number of CPU cores, device memory, touch points, time zone, screen size and pixel ratio, and the output of a canvas, WebGL, and audio test) and combines it with a random device token that we store in your browser's local storage under the name ts_device_token. The server keeps only keyed one-way hashes of the fingerprint, the token, the IP address, and the user-agent, and uses them to detect multiple accounts, ban evasion, and referral fraud, and to show staff when two accounts share signals. This is processed on the basis of our legitimate interest in keeping the game fair and secure. The token has no expiry; you can remove it by clearing this site's data in your browser (a new one is created the next time you sign in). Global Privacy Control and Do Not Track do not switch this off, because it is a security measure and not optional analytics; if you object to it, contact us as described in §11. If we enable a third-party IP-reputation lookup service, the sign-in IP address is sent to that provider; we will name the provider in §7 before enabling it.

Landing-page analytics. On the public landing page only, and only after you accept the consent banner, our first-party measurement records a random anonymous identifier stored on your device, campaign parameters in the arrival link, and landing sections and buttons used; it is not joined to an account. Google Analytics 4 is disabled for launch and its script is not loaded. See §6 and §7.

Custom images. If you set a custom portrait, sigil, flag, gallery image, or alliance image by pasting a Flickr image link, you give us a link to a third-party server. Our servers fetch that image from Flickr to check it. Portraits, sigils, flags, and gallery images are then served to other players through our own domain, so Flickr sees our server's address and the link, not the address of the players who view your page. Alliance images (flag, crest, background) are not yet served that way: where our content-security policy allows the request, the viewer's browser may load an alliance image directly from Flickr, and Flickr then sees that viewer's address.

Optional notification channels. If you turn them on: a web push subscription for this browser, a Discord webhook address or your Discord user identifier, and the email preference for reminder digests. Each is off by default and can be removed from the Notifications page at any time.

Moderation records. Reports about you or filed by you, the reported content, moderator notes and decisions, restrictions, appeals, and the content-filter outcome for public text.

3. Where it comes from

Directly from you when you register, play, post, buy, or write to us; automatically from your device and browser as you use the Services; from Google when you choose Google sign-in; from Stripe about the status of a payment; from Discord when you link your account; and from other players when they report, mention, or interact with you.

4. Why we use it

• To create and secure your account, sign you in, and keep your session working.
• To run the game: simulate the realm, deliver your actions to other players, keep public history, and show you your own kingdom.
• To provide VIP: start, renew, cancel, and refund subscriptions, and grant the cosmetic entitlements you paid for.
• To keep the realm fair and safe: detect cheating, multi-accounting, fraud, and abuse; run the content filter; investigate reports; enforce the Code of Conduct; and handle appeals.
• To help you: answer support tickets, privacy requests, and billing questions.
• To send account-security emails (password changed, account status changed, deletion confirmation) and the optional reminders and notifications you turn on.
• To keep the service healthy: monitor availability and performance, fix defects, and understand in aggregate how the landing page performs.
• To meet legal obligations, including tax and accounting rules for payments, and to respond to lawful requests.

5. Legal bases

Where the EU or UK data protection law applies, we rely on: performance of our contract with you (running the game, your account, and VIP); legitimate interests in securing the Services, preventing abuse and fraud, moderating the community, and improving the game, balanced against your interests; legal obligation for payment records and lawful requests; and consent for anything optional (landing analytics, Discord linking, web push, and email reminders) which you can withdraw at any time without affecting your ability to play. Where processing is needed to protect someone's safety, we may rely on vital interests.

6. Cookies, local storage, and consent

We use a small, first-party set:

• Session cookie (strictly necessary): keeps you signed in and protects against forged requests. It is secure, sent only to our own domains, and cleared when you sign out or it expires.
• Preferences in local storage (functional): your consent choice for landing analytics, the anonymous landing identifier if you accepted, tutorial and interface state, and similar conveniences. They stay in your browser and are not sent to advertisers.
• Device token in local storage (security): ts_device_token, a random value with no expiry that is sent when you sign in and feeds the anti-abuse signals described in §2. It is not a convenience setting.
• Sign-in hand-off cookies (strictly necessary): when you sign up or sign in with Google, short-lived first-party cookies (about 15 minutes) record that the sign-in has started and, if you typed a kingdom name before continuing to Google, that name, so the game can finish signing you in when Google sends you back. They are cleared when the sign-in finishes or expire on their own.
• Display settings in a cookie (functional): only if your browser blocks local storage, display settings such as text size, theme, and reduced motion are kept in a first-party cookie for up to a year instead, so they do not reset on every page. The cookie is removed the next time your browser lets the setting be saved to local storage.
• Google Analytics cookies: Google Analytics 4 is disabled for launch, so Thronestead does not load its tag or set its analytics cookies in the normal launch configuration.
• Cloudflare Turnstile (security): the bot check on sign-up, sign-in, and password recovery may set a Cloudflare cookie for the duration of the check (on sign-in the check is observed and recorded but does not by itself block you).

We do not use advertising cookies or cross-site advertising trackers. The only analytics enabled for launch are our own first-party measurements on the public landing page, and they start only after you choose Accept on the consent banner. Google Analytics 4 is disabled. If your browser sends a Global Privacy Control or Do Not Track signal, the landing page remains free of Google Analytics and our servers discard first-party analytics events, whether or not the banner was shown; those signals do not affect the security measures in §2. Your consent choice is stored in your browser only; to withdraw it, clear this site's data in your browser. The "Forget my anonymous landing analytics" control on the landing page erases the marker on your device and the first-party visit records tied to it. It deletes the matching first-party records; Google Analytics receives no launch traffic under the repository default.

7. Who we share it with

We share personal data only with the services below, for the stated purpose. Most process it on our behalf under the provider's standard terms and data-processing terms; we are still collecting a signed or accepted copy of those terms for each provider, and we do not claim a particular contract for any of them here. Locations are shown where we have confirmed them:

• Supabase (United States): account authentication and the game's data storage, including email delivery of sign-up confirmation, password reset, and email-change messages through our email provider.
• Railway (United States): hosting for the game servers that run the realm.
• Cloudflare (global network): serves the website, protects it from attacks, and runs the Turnstile bot check.
• Resend (United States): delivers the account email we send you: account-security notices and deletion confirmation, and the optional reminder email if you turn it on.
• Stripe (United States, with regional entities): VIP checkout, subscription billing, receipts, refunds, and fraud screening. Stripe is an independent controller for the payment itself under its own privacy policy.
• Google — if you choose Google sign-in, Google is an independent controller for your Google account. Google Analytics 4 is disabled for launch and receives no analytics traffic under the normal launch configuration. Google's own privacy policy applies to Google sign-in.
• Discord — (a) only if you link your Discord account or use in-game Discord commands: your Discord identifier and the game events you selected are sent to Discord so they can reach you as direct messages. Unlinking stops delivery immediately. (b) Staff notifications: when something reaches our staff (a support ticket, a report, an appeal, a payment, refund or chargeback, content our filter flagged, or an event on an admin account) our staff are notified in a private Discord channel with the type of item, its reference number, its category, and the kingdom name of the player it came from. The text you wrote, your email address, and your account identifier are never included, and privacy requests and age-related cases are sent without a name. We read and answer the item itself in our own systems, not on Discord. Discord's own terms and privacy policy govern what happens on Discord, including in the official community.
• Flickr — only if you paste a Flickr image link as a custom image: our servers request that image from Flickr (see §2). Flickr receives our server's address, not yours or other players'.
• Your browser vendor's push service — only if you enable web push; the text of the reminders and war alerts you turned on passes through the push service your browser uses.

We may also disclose data when the law requires it, to respond to a valid legal request, to protect the rights, safety, or property of players, the public, or Thronestead (including reporting content involving child safety or credible threats to the appropriate authorities), or to a successor operator if the game changes hands: in which case this policy continues to apply and we will announce the change.

8. Where it is stored and international transfers

Our servers and the services in §7 are located primarily in the United States, so if you live elsewhere your data is transferred there. For players in the EEA, the United Kingdom, and Switzerland, transfers rely on the mechanism available for each provider (for example the European Commission's Standard Contractual Clauses and the UK addendum, or a provider's certification under an approved data-transfer framework) together with technical and organisational safeguards. We have not yet completed a provider-by-provider confirmation of which mechanism applies to each service, so we do not state one here; you can ask us for the current status for any provider.

9. How long we keep it

We keep personal data only as long as the purpose requires, then delete or anonymise it. The current schedule follows. Where an automatic clean-up job exists we say so; where a record has no fixed expiry yet, we say that instead:

• Account and kingdom data: for as long as your account exists. When you delete your account, gameplay locks at once; after the cooldown of about a week (or sooner if you confirm), the account is purged and your kingdom, name, resources, buildings, troops, queues, memberships, heraldry, and profile are removed; free-text exit feedback is removed with the account and is never copied into permanent records. The deletion confirmation code itself expires after 48 hours.
• End-of-beta reset archives: the end-of-beta reset moves the open beta's game records out of the live game into archive tables. We keep them for 90 days after the reset completes so that a problem with the reset can be investigated and put right, then delete them; that deletion is run by our operators, not yet by an automatic job. Deleting your account reaches these archives as it reaches the live game.
• Public history after deletion: battles, treaties, and other world-record entries that involved your kingdom may be kept in anonymised form so that other players' histories remain intact.
• Chat: visible chat is removed after 30 days; messages that were reported or moderated are kept for 90 days so that appeals can be reviewed.
• In-game direct messages: not yet on an automatic expiry. When an account is deleted, the text of the messages it sent is replaced by a removal notice and the sender is detached, except messages that moderators are holding as evidence, which are kept with no fixed end date for now (the retention period for moderation evidence has not been set). Messages you received stay with the sender's own account.
• Notifications: removed 30 days after you read them.
• Espionage and intelligence reports: about 30 days after they expire.
• Anonymous landing analytics (first-party): visit events are deleted after 90 days and anonymous session records after 180 days by a daily automatic job, or immediately when you use the forget control. Google Analytics is disabled for launch and receives no analytics events under the repository default.
• Support tickets, privacy requests, and appeals: for as long as needed to resolve them and to show we handled them properly.
• Moderation records: for as long as an enforcement action, its appeal, or a repeat-offence history needs them; serious-safety records may be kept longer to protect other players.
• Payment records: for as long as tax, accounting, and anti-fraud law requires after the transaction.
• Security and access logs: the network part of the IP address and the user-agent hash on account-security audit records, and the same data on staff-action records, are cleared automatically after 180 days (the record of what happened, without that data, is kept without a fixed end date); when an account is deleted, the account identifier in them is replaced by a random token, the remaining IP and user-agent data is cleared, and free text is removed. Hosting-provider request logs are kept for the period set by the provider. Sign-in anti-abuse signals (keyed hashes) are kept for as long as the account exists.
• Backups: deleted data can persist in backups held by our data-storage provider until those backups expire. We have not yet published the backup retention period; ask us if you need it.

Retention may be extended for a legal hold, an active investigation, or an open appeal.

10. Security

We use layered safeguards: encrypted (HTTPS) connections to the website and API, hashed passwords, secure session cookies, role-based access to the staff tools, audit logging of administrative actions, rate limiting on account endpoints and bot checks on sign-up and recovery, and internal incident-handling steps that are still being formalised. Staff see only what their role requires. No system is perfectly secure, so please use a strong, unique password, keep it private, and report anything suspicious promptly. We email you whenever your password is changed so you can react fast.

11. Your rights and how to use them

Depending on where you live, you can ask us to access the personal data we hold about you, correct it, delete it, give you a copy in a portable format, restrict or object to certain processing, and withdraw consent for anything optional. We will never treat you differently for exercising a right. Where a request would reveal other players' data, conflict with a legal obligation, or undermine an active fraud or safety investigation, we may limit it and will tell you why.

• Delete your account yourself from Settings (also reachable from Support): a two-step flow with a cooldown, described in §9.
• Correct your kingdom name, title, motto, heraldry, and profile yourself in-game; for your email address or anything you cannot change yourself, contact support.
• Turn off Discord linking, web push, and email reminders yourself on the Notifications page; change your landing-analytics choice on the landing page.
• Everything else — access, export, restriction, objection: goes through Contact Support under Privacy request, or to ops@thronestead.com. Exports are prepared by a person from a standard account-export tool and delivered to your account's email address. You can also ask us to restrict optional processing (optional analytics events, reminder and other optional notifications); security, fraud prevention, and account-integrity processing continue.

12. Email and notifications

We send account-security email — sign-up confirmation, password reset, email-change confirmation, "your password was changed", "your account status changed", and deletion confirmation: only when you or our staff take an action on your account. These cannot be unsubscribed from because they protect you. We do not currently send marketing email; if we ever do, it will be opt-in with an unsubscribe link in every message. Reminder digests, web push, and Discord notifications are optional, off by default, and controlled from the Notifications page.

13. Children

Thronestead is adult-only for launch: you must be at least 18 to create or use an account. We ask for an affirmative 18-or-older confirmation and record that age band and its time, but do not collect a date of birth. Email registration cannot proceed without it, and Google sign-up requires the same confirmation before redirecting. Existing accounts without the current acknowledgement are prompted to accept it. Accounts already known to belong to people under 18 are restricted and reviewed through the existing underage workflow rather than grandfathered; confirmed cases are deleted through the normal deletion process. We do not provide parental-consent registration. To report an underage account, use Contact Support (Underage account) or ops@thronestead.com.

14. Automated moderation and decisions

An automated content filter screens public text (chat, mail, boards, press, profiles, names) for slurs, threats, personal information, scams, and similar categories; it can star out words, hold a post for review, block it, or trigger a short protective restriction for the most severe categories. Automated signals also flag suspected cheating, multi-accounting, and fraud. These tools narrow attention; a person makes every enforcement decision that affects your account, with one exception: the content filter and the moderation service can apply a short automatic restriction (about an hour) for the most severe content and a temporary chat mute after repeated serious violations, which a person then reviews, and every such decision can be appealed once through the Appeal page. We do not use automated profiling to make decisions with legal or similarly significant effects without human review.

15. Regional privacy rights

European Economic Area, United Kingdom, and Switzerland. You have the rights in §11 under the GDPR, the UK GDPR, or Swiss law, the right to withdraw consent at any time, and the right to lodge a complaint with your national supervisory authority (in the UK, the Information Commissioner's Office). We have not appointed a representative in the EU or UK; contact the controller directly.

California and other US states. In the last twelve months we have collected the categories described in §2 — identifiers, account and commercial information, internet activity, communications, and inferences drawn for anti-abuse purposes: from the sources in §3, for the purposes in §4, and disclosed them only to the service providers in §7. We do not sell personal information, do not share it for cross-context behavioural advertising, and do not knowingly sell or share the personal information of anyone under 16. We do not collect sensitive personal information beyond account credentials. You have the right to know, delete, correct, and to not be discriminated against, exercisable as described in §11; an authorised agent may act for you with your written permission. Browser Global Privacy Control signals are honoured as an opt-out as described in §6.

Elsewhere. Where your local law grants additional rights, we honour them through the same request channels.

16. Data breaches

We follow internal steps, still being formalised, to triage, contain, investigate, and remediate incidents. If a breach is likely to put your rights at risk, we notify you and the relevant regulators within the timelines the law sets, telling you what happened, what data was involved, and what you can do.

17. Policy updates

This policy may be updated for legal, technical, or product reasons. The effective date, revision date, and version at the top identify the version in force, and the "what changed" note in the summary describes each revision. Material changes are announced in-game or on Patch Notes before they take effect, and by email where the law requires it.

18. Contact and complaints

Submit privacy requests through Contact Support under Privacy request, or email the controller at ops@thronestead.com. If you are unhappy with our answer, you may complain to your local data protection authority where your law provides that right. All policies are listed in the Legal Hub.

19. Related policies

This Privacy Policy works alongside the Terms of Service, the Code of Conduct, and the Rules of the Political Stage. Where obligations overlap, the stricter privacy, safety, or legal standard applies. If a translated version conflicts with this English version, this version controls unless local law requires otherwise.