Privacy and cookies | TYRIANS.ONLINE

3.1 Data we use

3.1.1 Accounts and gameplay use a player name, secure password hash, selected language and world, game actions, progress and interactions. A required email address is used for account confirmation, password recovery and security notifications. Unconfirmed registration requests are retained for 24 hours; the player account is created only after email confirmation. Date of birth, gender, location, profile description and image may be provided optionally.
3.1.2 Sign-in and security use the IP address, technical information provided by the browser, session and security records. Some IP addresses and other identifiers are stored as keyed hashes. This reduces disclosure risks but does not in itself make the data anonymous. Messages and chat content are processed to provide communication features.
3.1.3 We also record visit sources: an external referring website address without query parameters and a keyed IP hash. An invitation link may associate a visit with the referring player.
3.1.4 During registration, we record the accepted document version, language, text digest and acceptance time determined by the server. No additional IP address or browser data is collected for this record.

3.2 Purposes and legal bases

3.2.1 Account, sign-in, gameplay and player-requested communication data are processed to perform the contract insofar as objectively necessary for the service. Security and abuse prevention data are processed in the legitimate interest of protecting the game and players; necessity and impact on players’ rights, particularly children’s rights, are considered. Rights requests and mandatory records are processed to fulfil legal obligations.
3.2.2 Optional profile information may be provided for game communication. This is not consent to unrelated uses. Where a feature relies on separate consent, that consent may be withdrawn; refusal alone should not remove access to the main game.
3.2.3 Where consent is the legal basis for data processing in a service offered directly to a child, parental or guardian consent and reasonable verification are required in Lithuania for children under 14. This is not a general minimum age for playing. Other countries may apply a different threshold.

3.3 What others can see

3.3.1 Player names, rankings, settlements, chosen public profile content and other game data that is public by function may be visible to other players or visitors to public pages. A message posted in general chat is visible to its participants. Private messages are not public profile content. Sharing a report grants access to its content. Publishing sensitive data or other people’s private information is prohibited. Administration access is used for the purpose of the particular feature, support or security.

3.4 Service providers

3.4.1 Hosting, email and security services may be used to operate the game. Data may be provided to competent authorities where lawfully required.
3.4.2 When Cloudflare Turnstile is enabled, browser and request technical data are used to protect against automated abuse. When DeepL is enabled and message translation is selected, the relevant message text is sent to an external translation provider; this includes private messages. Text that should not be sent to that provider should not be translated. Links to their privacy information appear below.
3.4.3 Information about recipients relevant to a player’s data, their roles and safeguards for transfers outside the European Economic Area may be requested through the contact email on this page.

Cloudflare Turnstile · DeepL

3.5 Retention and deletion

3.5.1 Account and progress data are used while the account is active and needed for the service. Account deletion includes a seven-day cancellation period. Inactive accounts are subject to cleanup after 300 days. The game’s cleanup rules provide for general chat records after 90 days, reports after 365 days, visit source records after 180 days and sign-in security events after 90 days.
3.5.2 Retention of private messages, world history, hall of fame records and backups depends on their purpose and deletion procedures. Account deletion does not mean every copy and historical record is erased at the same moment. A player name retained in a historical result is not automatically anonymous. Contact the email on this page about the retention or deletion of a particular record. Data required by law may be retained for a justified additional period.
3.5.3 The terms acceptance record (time, language, document version and digest) is retained with the account and removed when that account is deleted. Copies of document texts without player data remain in the version archive. Expired and revoked sign-in sessions are removed during daily cleanup; security events after 90 days and inactive rate-limit records after 48 hours. These periods are enforced by the scheduled process, so actual deletion depends on its successful execution.

3.6 Data subject rights

3.6.1 Subject to applicable conditions, a data subject may request access to personal data, a copy, correction, deletion, restriction of processing, object to processing based on legitimate interests and exercise the right to data portability. Where consent is relied on, it may be withdrawn. Withdrawal does not affect processing lawfully carried out beforehand.
3.6.2 Requests must be submitted to the contact email on this page. Where needed, identity is verified proportionately. A response is normally provided within one month; a lawful extension includes its reason and deadline. Exercising rights must not disclose other people’s private data. A complaint concerning data protection may be submitted to the Lithuanian State Data Protection Inspectorate or another competent supervisory authority.

Lithuanian State Data Protection Inspectorate

3.7 Cookies and browser storage

3.7.1 The browser storage used by the game is listed below. The session cookie supports sign-in and security; map storage retains area and grid preferences. These preferences are not used for advertising. Accepting the rules is not consent to non-essential cookies.
3.7.2 Cookies and localStorage entries may be removed in browser settings. Removing the session may require signing in again; removing map records restores the default preferences. External service storage is assessed against the actual enabled configuration.

Optional Google Analytics statistics start only with your consent. They measure public page groups and successful registration; we do not send player names, email addresses, messages or one-time link tokens. Google receives technical browser and network data, including the request IP address. Your choice is stored in the tyrians_analytics_consent_v1 localStorage entry for up to 180 days; Google _ga and _ga_* analytics cookies last up to 180 days. You can change your choice at the bottom of a public page. Withdrawing consent reloads the page, disables statistics and removes these cookies. Declining does not prevent playing. Google privacy policy

game_session: Session identifier cookie with a browser lifetime of up to 365 days. The session supports sign-in, security, language and world selection and may contain a referring player's identifier. The cookie lifetime is distinct from authentication expiry and server-side data retention. Signing out removes the cookie and revokes authentication.
tyrians_map_radius: Map area preference in a cookie for up to 365 days. Written when opening the map and changing its area to retain the selected view.
tyrians-map-radius: A copy of the map area in localStorage. There is no automatic expiry; you can remove the record in browser settings.
tyrians-map-grid: Map grid preference in localStorage. Retained across browsing sessions until changed or removed in browser settings; there is no automatic expiry.