Privacy Policy
Last updated: 15 October 2026
Arthropolis (“the game”, “we”) is a free browser strategy game at arthropolis.com. This page explains what we store about you, why, for how long, and how to get it removed. We keep as little as we can. There are no ads, no analytics or tracking scripts, no cookies, and nothing is sold or shared for marketing.
Questions or requests: support@arthropolis.com.
What we store
| Data | Why | How long |
|---|---|---|
| Account: username, password (stored only as a one-way bcrypt hash, never readable), date created | So you can log in and keep your progress | Until you delete the account |
| Email address (optional) | Only for password-reset emails. Never used for marketing | Until you delete the account |
| Game stats: wins, losses, rating, friends list | Profiles, leaderboard, friends | Until you delete the account |
| Match history: map, factions, teams, result, rating change and the usernames of the players | Match history and rankings for everyone who played | Kept; if you delete your account your name is replaced with “Deleted player” |
| Sign-in log: time, username, sign-in event, IP address, browser type and language | Security, preventing abuse and cheating, handling bans | 180 days, then deleted automatically |
| Bans (only if you are banned): username, IP address, reason and dates | Enforcing the ban and handling appeals | Until the ban ends, then kept as a record of past bans |
| Chat messages | Showing recent chat to other players | Only the latest 50 messages per chat channel are kept; older ones are discarded |
| “Remember me” keys: a random sign-in key (we store only a hash of it) | Keeping you logged in on your device | 30 days after last use, or until you log out |
| Password-reset links | Resetting a forgotten password | 30 minutes |
Guests (playing without an account) are only recorded in the sign-in log and in chat/match history under the name they chose.
Stored on your device
The game uses your browser’s storage (local and session storage, not cookies) for your settings (volume, preferences), your “remember me” key, and the current game session so a page refresh can reconnect you. You can clear it at any time in your browser settings; logging out removes the sign-in key.
Who else handles your data
- Hosting provider: our server, which stores the data above, runs on a rented server.
- Resend (resend.com): sends password-reset emails, so it receives your email address and the email content when you ask for a reset.
We do not use any other third-party services. Your username, rating and match results are visible to other players in the game.
Your rights
- Delete your account: log in, then press Delete account in the lobby (under My Stats). This immediately and permanently deletes your account, email, stats, friends, sign-in keys and sign-in log entries, and replaces your name in past matches with “Deleted player”.
- Access, correction or a copy of your data, or any other privacy request: email support@arthropolis.com from the address on your account, or tell us your username. We reply within 30 days.
- If you are in the EU/UK you may also complain to your local data protection authority.
Legal bases (GDPR): providing the game you asked for (account, stats, matches, chat); our legitimate interest in security and preventing abuse (sign-in log); your choice to add an email (password reset).
Security
Connections are encrypted (HTTPS). Passwords and sign-in keys are only stored as hashes. Access to the server is limited to the game’s administrator.
Children
The game is not intended for children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.
Changes
If this policy changes we will update the date above and, for significant changes, mention it in the game’s “What’s new” notes.