Privacy Notice

Summary

Personal data are processed to the extent necessary to operate accounts and to keep the Service fair and secure. Data are not sold, no advertising is displayed, and no analytics or tracking tools are used. The real name and email address of a User are not displayed to other Users; other Users see only the player name chosen by the User. The Service offers a download of personal data and deletion of the account in the account settings.

1. Controller

The controller of personal data is [OPERATOR], [OPERATOR ADDRESS], email: [CONTACT EMAIL].

2. Categories of data, purposes and legal bases

• Account data: player name, email address (optional where only Telegram or Discord is used), password (stored only as a hash), region, language, activity within the game. Purpose: provision of the Service. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Sign-in through Google, Telegram or Discord: provider, the User's identifier with the provider and, in the case of Google, the email address where verified by Google. Provider tokens and profile data are not stored. Purpose: authentication. Legal basis: performance of a contract.
• Age confirmation: the User states a month and year of birth; only the confirmation that the User is at least 16 years of age and its date are retained, and the date of birth is discarded. Purpose: compliance with the age requirement. Legal basis: legitimate interest (Article 6(1)(f)) and, as regards Article 8 GDPR, legal obligation.
• Acceptance records: the version of the Terms accepted and the time of acceptance. Legal basis: performance of a contract.
• Session data: hash of the session token, device label, method and time of sign-in. Purpose: maintaining the signed-in state. Legal basis: performance of a contract.
• Two-factor authentication data: encrypted secret and hashed recovery codes. Legal basis: performance of a contract; for staff, legitimate interest.
• Security events: sign-ins and failed attempts, changes of password or email address, new devices, with time and request identifier; passwords and codes are never recorded. Purpose: protection of accounts and information to the User about the User's own activity. Legal basis: legitimate interest (Article 6(1)(f)).
• Network evidence: a keyed hash of the network prefix and of the network operator number derived from the User's address is stored; the address itself is not. The hash is used by administrators to review whether accounts share a network connection. Purpose: prevention of breaches of the rule on multiple accounts. Legal basis: legitimate interest.
• Start region suggestion: on registration, the address is looked up once in a locally held database (DB-IP Lite) to suggest a start region. The address is not stored or disclosed. Legal basis: legitimate interest.
• Server logs: the address with its final part removed, the resource requested and the result. Purpose: operation and security of the Service. Legal basis: legitimate interest.
• Moderation data: reports, decisions, facts relied upon and the rule applied; the email address of a reporting person, where given. Legal basis: legitimate interest and, as regards obligations under Regulation (EU) 2022/2065, legal obligation (Article 6(1)(c)).
• Chat messages: the text a User writes in the language chat rooms, the room, the time and the author's player name. Messages are visible to every signed-in User. Purpose: communication between Users within the game. Legal basis: performance of a contract. Where a User reports a message, a copy of it and of the messages before it in the room is kept with the report.
• Press: articles the User publishes (every version, kept in the Service's object storage), comments, newspapers the User founds or writes for, pictures the User uploads (re-encoded, with their embedded metadata such as location removed), votes on articles and subscriptions to newspapers. Articles, comments, newspapers and pictures are visible to every signed-in User; votes and subscriptions are shown only as totals. A draft of an article is kept only in the User's browser until it is published. Purpose: publishing within the game. Legal basis: performance of a contract. Where a User reports an article, comment or newspaper, a copy of it is kept with the report.
• Ban list: where an account is banned, a keyed hash of its email address and provider identifiers. Purpose: prevention of immediate circumvention of the ban. Legal basis: legitimate interest.
• Email correspondence: address verification, password reset, security notices and replies to complaints and requests. No marketing messages are sent.

Provision of data is voluntary, but necessary to create and use an account. Special categories of personal data are not processed.

3. Legitimate interest

Where processing is based on legitimate interest, the controller has assessed in writing that the interest is legitimate, that the processing is necessary and that it does not override the interests, rights and freedoms of the data subject. The data subject has the right to object (section 9).

4. Recipients

• processors acting under data processing agreements: hosting [HOST] (including the object storage that holds articles and pictures), email delivery [MAIL PROVIDER] and backup storage [BACKUP PROVIDER], all located in the European Union;
• Google, Telegram or Discord, solely where the User chooses to sign in through that provider, each of which acts as an independent controller in respect of its own services;
• public authorities, where required by law, including notification of suspected criminal offences under Article 18 of Regulation (EU) 2022/2065;
• other Users, who see the player name, region and public activity of the User, the messages the User writes in the chat rooms, the articles, comments, newspapers and pictures the User publishes, and the public log of staff acts, which does not identify any person. Other Users never see an email address or hash.

Personal data are not sold.

5. Transfers to third countries

Hosting, email delivery and backup storage are located in the European Union. Personal data are not transferred to third countries, except that a User who chooses to sign in through Google, Telegram or Discord communicates with that provider on the User's own initiative.

6. Retention periods

• account data: for the duration of the account;
• sessions: until expiry (30 days without use, 90 days at most);
• security events: 180 days;
• network evidence: 90 days, and longer only while a moderation review concerning the account is open;
• server logs: at most 14 days;
• outgoing email queue: 24 hours after sending;
• chat messages: 30 days after they are written; a copy kept with a report, for as long as the report;
• moderation decisions: 3 years after the decision ceases to have effect; where staff remove a chat message, an article or a comment, its text (for an article, its title) is kept with the decision for that period;
• articles, comments and newspapers: for as long as the author keeps them published; once deleted by the author or removed by staff, 3 years, hidden, for reports and appeals, and then deleted with every version;
• uploaded pictures: deleted after 24 hours if no article or logo uses them; otherwise for as long as they are used; a picture removed by staff is kept 3 years, after which only a fingerprint remains so that it cannot be uploaded again;
• ban list entries: for the duration of the ban and not longer than 3 years, with renewal only by a written, reasoned decision;
• reports and complaints: 3 years after they are closed;
• game history (ledger, elections, laws): without limit, in a form that does not identify the User after deletion of the account;
• backup copies: up to 35 days. Data deleted by the User are deleted again whenever a backup is restored.

7. Deletion of the account

After a grace period of 7 days, during which the User may cancel the request, the player name is replaced by "Former citizen" with a number, and the email address, password hash, linked sign-in identities, two-factor data, sessions, security events, network evidence, chat messages, votes on articles, subscriptions to newspapers and age and acceptance records are deleted. Articles, comments and newspapers remain, shown under that name; a newspaper the User owns passes to its longest-serving journalist. Where the account is deleted because its owner is under 16, the User's articles, comments and uploaded pictures are deleted too. Records of the game, such as the ledger and elections, are retained because they form the shared history of the game; they no longer identify the User. The ban list entry of a banned account is retained until the end of the ban. Deletion is held while a moderation review concerning the account is open.

8. Minors

The Service is intended for persons aged 16 and over. Accounts of younger children are not knowingly maintained and are deleted when identified. In relation to Users aged 16 and 17, no real names are displayed, location is not shared beyond a game region, no profiling for advertising takes place, no advertising is displayed, and communication between Users is limited to public chat rooms by language and public articles and comments, without private messages. Any User can report a message, article or comment; staff remove content that breaches the Terms and can mute its author; chat messages are deleted after 30 days.

9. Rights of the data subject

The data subject has the right to:

• access personal data and obtain a copy (the download in the account settings serves this purpose);
• rectification and erasure of personal data (deletion of the account);
• restriction of processing;
• object, on grounds relating to the data subject's particular situation, to processing based on legitimate interest;
• data portability;
• not to be subject to a decision based solely on automated processing; no such decisions are taken.

Requests may be sent to [CONTACT EMAIL]. The controller responds within one month. The data subject has the right to lodge a complaint with the supervisory authority, in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the supervisory authority of the Member State of the data subject's habitual residence, place of work or the alleged infringement.

10. Automated decision-making

The controller does not carry out profiling and does not take decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject. Systems may indicate accounts for review by a person, who takes every decision.

11. Security

Passwords are stored as Argon2id hashes. Communication is encrypted using HTTPS. Staff access requires two-factor authentication and is recorded. In the event of a personal data breach likely to result in a high risk to the rights and freedoms of data subjects, the controller shall notify the supervisory authority within 72 hours where required and shall notify the data subjects without undue delay, by email or, where no email address is held, by a notice displayed within the Service.

12. Attributions

Map data: Natural Earth (public domain) and geoBoundaries (CC BY). Country lookup: DB-IP Lite (CC BY 4.0, https://db-ip.com). Fonts are served from the Service's own domain.

13. Amendments

Amendments to this Privacy Notice are announced within the Service and by email. The version and date at the top of the notice indicate the current version.