Privacy policy

This policy describes what personal data Guildforge handles, for what purpose, on what legal basis, for how long, who can access it, and what rights you have (under the EU General Data Protection Regulation, GDPR, and Hungarian law). The short version: we only store what the game, the protection of your account and fair play need. There are no ads, no analytics, no trackers, and we do not sell your data.

The controller

The controller is the operator of the game: Nemcsényi Gábor (private individual), postal address: 7696 Hidas, Szabadság utca 7., e-mail: support@gf.teamunity.hu. For data protection matters you can reach us via Support in the game or at this address. No data protection officer has been appointed.

What we store about you

  • User name — you choose it, and it is the same in every world. Other players see it on the map, in the ranking, in reports and on the public statistics.
  • Password — we do not store the password itself, only a check value derived from it with a salted, many-times repeated key derivation, from which the password cannot be recovered.
  • E-mail address — required when you sign up on the web. We send to it the address confirmation, the forgotten password reset link, the e-mail code of two-step sign-in, warnings about your account (for example before an inactive account is deleted), and — if you ask for them in the Settings — your account's notices (attack, lost village, mail, tribe invitation, sign-in from a new address; all off by default). Notices only go to a confirmed address.
  • Two-step verification — if you turn it on: the secret key of the authenticator app (on the server), salted check values of the backup codes, and the e-mail sign-in code, which only lives in memory for 10 minutes.
  • Your game state — your world accounts, villages, troops, resources, premium points, messages, chats, reports, tribe membership, quests, your notebook, your profile text, and if you pre-registered, the direction you chose. In the chat the last 300 messages per conversation are kept.
  • Your connections in the game — who is in your tribe, who your friends are, whom you blocked, with whom you reported a shared internet connection, and — if you came with an invitation — who invited you. The latter is kept because the invitation reward can only be paid once, and only to the right person, this way.
  • Sign-in tokens — a cookie in the browser, or a token for the phone app. With the phone token we save the device name and when it was last used, so that you can tell your signed-in devices apart and revoke one.
  • What you write to support — the subject and text of your tickets and our replies. The operator reads them: that is their purpose. Never put a password in them — we never ask for it.
  • The IP addresses you connect from — for fair play (one player, one account) we record per account which addresses you connected from (for IPv6 only the network part), with the first and last time and a count, for 30 days. If two accounts play from the same address, the game master may review the addresses of both, and if for days they only ever connected from that one address, the accounts may also be banned automatically (see: Automated decision). For the limit against guessing at sign-in and registration, the address is only kept in memory. In addition, actions taken in the game master panel are kept in a log, and that log includes the time of the action and the address of the request too. That is the OPERATOR's own trail, not yours — and it exists precisely so that it can be checked later who touched your account.
  • Your sign-in log — for every sign-in attempt we record the time, the method (browser or phone), whether it succeeded and the address, so that on the Devices page of the Settings you can see when and from where your account was entered. For wrong-password attempts we do not store the end of the address. At most fifty entries, for 30 days; your sitter cannot see it.
  • Cheat detector data — the timing of the last 160 actions only in memory, resource transfers between accounts for 30 days, sitter actions and the flags raised (at most 500). The detector only flags to the game master; it does not punish.
  • Purchases — if you buy points: order number, package, points, amount, currency, payment method, status, times, the log of the game master's approval, and the time of your statement about the right of withdrawal. We never see or store card details; for bank transfers the game does not store the bank statement data (the payer's name and account number), but the operator's bank has them.
  • Uploaded images (tribe logo, village picture, profile picture) — the server shrinks and re-encodes them on upload, so the hidden data of a photo (for example where it was taken) is not kept. A replaced or deleted image — and after account deletion your profile picture and your village pictures — also disappear from the disk within an hour.
  • The web server log — the web server in front of the game records the IP address, the time and the requested address of every request. This log is limited in size (at most five files of 20 MB each): the oldest entries are deleted automatically. No IP address goes into the game server's own log.
  • The app's crash reports — if the Android app runs into an error, it sends the error text, the stack trace, the version number, the device model and system, the screen and the language. We store neither your account name nor your IP address with the report (the address is only used for minutes, in memory, to limit too many reports). Identical errors are grouped; at most 500 groups are kept, the one seen longest ago drops out, and the game master can delete them at any time.
  • Push notification token — if you allow notifications on your phone, the app sends the token issued by Google (Firebase Cloud Messaging), and we link it to your account with the device name and the time of registration (at most five devices). This lets us tell you about incoming attacks, finished buildings, private messages and tribe news — you can turn each category off in the Settings. The token is deleted when you sign out of the app, when it is not refreshed for 60 days, when Google reports it invalid, and when you delete your account.
  • App and device check (Play Integrity) — if it is turned on, the app asks Google Play for an attestation that an unmodified app installed from Play is running on a real device. We only save the latest result with your account (the time of the check, the result and its reasons, the version number); we do not identify the device. A suspicious result makes the cheat detector flag it to the game master, but nothing is banned automatically.

Purposes and legal bases

  • The account and the game (registration, sign-in, game state, messages, chat, forum, tribe, support): performance of the contract — GDPR Article 6(1)(b).
  • Account security and fair play (sign-in log, devices, IP tracking, multi-account filter, cheat detector, bot protection, reports, the game master log, the web server log, backups, the app's crash reports and the Play Integrity check): the legitimate interest of the operator and the players — GDPR Article 6(1)(f). You can object to this (see: Your rights).
  • Notices you ask for (e-mail notices, the world launch list, browser notifications, push notifications on the phone) and Google or Facebook sign-in: your consent — GDPR Article 6(1)(a). You can withdraw it at any time (turn it off, unsubscribe, unlink).
  • Purchases: performance of the contract, and the legal obligation under accounting and tax rules — GDPR Article 6(1)(b) and (c).
  • The public ranking and statistics: part of the game (performance of the contract), and the community's legitimate interest in following the state of the world.

Sending e-mail

The game only sends mail in the cases described above, and if you subscribe to hear about a new world starting. The latter needs no account, and the address you give is kept on a separate list — we do not link it to player accounts. If a player sends an invitation to a friend's address with the invite feature, we only use that address to send the message.

  • No newsletter and no ads. At most one notice of each kind goes out per quarter of an hour, and at most thirty a day to one address.
  • Every world launch e-mail has an unsubscribe link, one click, no sign-in needed. Unsubscribing deletes the address from the list. You can turn off your account's notices in the Settings at any time.
  • The e-mail passes through a mail server, which sees the recipient's address, as with every e-mail. We encrypt the connection if the server offers it. If no mail sending is configured on the server, nothing goes out.

Recipients and processors

  • Hosting: the game server runs on a machine of Rackhost Zrt. (Tisza Lajos krt. 41, 6722 Szeged, Hungary, company registration number 06-10-000489), a Hungarian hosting provider; it stores the data as a processor and does not use it for any other purpose.
  • Mail sending: the configured mail (SMTP) provider — handles the recipient and content of an e-mail to deliver it.
  • Google and Meta (Facebook): only if you sign in with them; they are independent controllers, under their own privacy policies.
  • Google (Firebase Cloud Messaging, Play Integrity): only if they are turned on on the server. Google delivers push notifications to your phone (it sees the token and the text of the notification); the Play Integrity attestation is issued and decoded for us by Google. In these Google acts as a processor, under its own terms.
  • Stripe: only if you pay by card and card payment is turned on. Stripe handles card and payment data as an independent controller; we only pass on the order number and the amount.
  • Bank: for bank transfers, the operator's bank.
  • Authorities: only if the law requires it.

We do not sell your data and do not pass it to anyone for advertising.

Transfers outside the EU

We do not transfer your data outside the European Economic Area. If you use Google or Facebook sign-in, pay with Stripe, or use push notifications or the Play Integrity check, these providers may also process data in the United States under their own policies (based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses).

Signing in with a Google or Facebook account

If you choose this, signing in happens at Google or Facebook: you enter your password there, and we never see it. With your consent the provider sends an identifier, your name and your e-mail address. We link the identifier and the address to your account; we only use the name to suggest an account name. We do not ask for friend lists, posts or pictures. You can unlink it at any time under "External sign-ins" in the Settings (if another sign-in method remains); the identifier is then deleted.

What you make public

  • In the game and on the public statistics (/stats, also without signing in): your name, your points, the number, names, locations and points of your villages, your tribe, your conquests, the points of defeated opponents and your daily history (for 400 days). This is the basis of the genre: a map on which you cannot see your neighbours is not a map.
  • Your forum posts can be read by anyone at /forum.
  • Shared battle report. It gets an unguessable address; whoever knows it sees the report — with the names of both sides. Sharing can be revoked at any time. Spy reports deliberately cannot be shared. If you post the link in a public place, search engines may find it from then on.
  • Invitation link. Its address contains your code, not your name. Whoever registers with the code gets it recorded in their account that you invited them.

Reports and moderation

If you report a player or a message, we store a copy of the reported text with the report, because the reported player can rewrite their profile later, and the recipient can delete the message. The report records who reported whom, when and why. These entries remain after the account is deleted: a moderation trail that the reported player could erase by deleting their account would be worthless.

Automated decision

Only one automatic decision can affect you: the multi-account filter may temporarily ban accounts that for days connect only from the same internet address without both sides confirming the shared connection. You have the right to have the decision reviewed by a person: write to Support (or to the address given on the Support page), and the game master reviews it. The cheat detector does not decide; it only flags.

Sitter: when another player plays your account

The sitter (for up to 14 days) sees everything you see: your messages, your reports, your villages. So only appoint someone you trust. They cannot delete your account, cannot see your sign-in log, cannot change your password or e-mail address, and cannot sign you out of your own devices.

The operator's access

In plain words: the game master who runs the server has technical access to everything on the machine — your messages too — and can reset your password. They cannot see your password, though, because we do not store it. The game master panel is protected by mandatory two-step verification, an attempt limit and expiring sessions.

Cookies and local storage

  • Session cookie (twlocal_session): keeps you signed in, for 30 days; you cannot play without it.
  • Sitter cookie (twlocal_sitter_origin): lets you return to your own account after sitting, for 14 days.
  • Language cookie (twlocal_lang): the language you chose, for one year.
  • External sign-in cookies (gf_kulso_allapot, gf_kulso): during a Google or Facebook sign-in, for at most 15 minutes.
  • Local storage (localStorage) in your browser: convenience settings, for example which pop-up you closed, where you are in the tutorial, whether you asked for browser notifications. They stay on your device and never reach us.

We use no advertising, analytics or tracking cookies; every cookie is needed for the game to work, so we do not ask for consent to them.

What we do NOT collect

No analytics, no ads, no trackers, no advertising ID and no location. The Android app does not ask for access to contacts, photos, the camera or the microphone. The only permission it asks you for is notifications — to tell you about incoming attacks; you can refuse it. The permissions needed by the background attack watcher (internet, network state, keeping awake, starting after reboot) cannot be used to collect data.

How long

As long as your account exists. When you delete your account, your data is gone — deletion is immediate and cannot be undone. Deletion also removes your sign-in tokens, your market offers, your private chats, your support correspondence, the public addresses of your shared reports, your sign-in log, your password reset links and the log of the IP addresses you connected from, your push tokens and the Play Integrity result. Even without deletion, we forget an IP address after 30 days; a suspicious account pair (with the shared address) is kept for at most 90 days after it is closed. If the game master decided a pair is fine, that decision is kept with the two account names — without the address — until the accounts are deleted.

A closed support ticket is kept for one more month after closing, then disappears by itself. Even within that month only your last twenty tickets are kept; open tickets are never removed.

The data of orders (purchases) remain after account deletion as a financial trail, for the period required by accounting and tax law; the register holds at most 5000 orders, and the oldest closed ones drop out. An unpaid bank transfer order expires after 14 days. If the world's settings ask for it, a world account that has not been used for a longer time is deleted from the world (we warn you before).

About backups. The server makes regular backups and discards the old ones. Data of a deleted account therefore stays in the backups for at most one day, then leaves them too. Without backups a disk failure would take everyone's world — that is why we keep them this long.

If a daily backup also runs on the server machine, at most the last 30 of those are kept, so the data of a deleted account can remain in such a backup for at most 30 days. We only restore from a backup after a failure.

What remains after deletion, and why:

  • Your name in other players' reports and messages: those are the other player's own data, their conversation. The text of your tribe forum posts, your public forum posts, and your messages in a tribe or group chat also remains (the community's conversation), but "deleted player" stands under it instead of your name.
  • Your votes in the game master's polls, but without your name: the result of a closed poll must not change afterwards.
  • The reports you made or that are about you — for the reason described above.
  • Your orders — for the reason described above.
  • If you invited someone, the invitation key in their account: without it, their reward could be paid out twice.

Your rights

  • Access: you can ask what data we handle about you and request a copy of it (GDPR Article 15).
  • Rectification: you can correct inaccurate data in the Settings, or ask us to correct it (Article 16).
  • Erasure: you can delete your account at any time, or ask for your data to be erased (Article 17) — except what we must keep because of the law or the legitimate interest described above.
  • Restriction: in a dispute you can ask us to only store the data until it is resolved (Article 18).
  • Portability: you can ask for the data you provided and that we handle under the contract in a machine-readable format (JSON) (Article 20).
  • Objection: you can object to processing based on legitimate interest (Article 21); we then examine whether protecting fair play outweighs your interest.
  • Withdrawing consent: you can turn off notices, the world launch list and external sign-in at any time; this does not make the earlier processing unlawful.

Send your request via Support in the game, or to the address given on the Support page. We reply free of charge within one month at the latest (in justified cases this may be extended by two months; we will tell you). Before acting on a request, we make sure the account is yours.

Complaints and remedies

If you feel we have violated your data protection rights, please write to us first: we will try to settle it quickly. You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; Falk Miksa utca 9-11, 1055 Budapest; postal address: PO Box 9, 1363 Budapest; phone: +36 1 391 1400; e-mail: ugyfelszolgalat@naih.hu; naih.hu), or with the supervisory authority of your EU country of residence, or go to court.

Security and breaches

The connection is encrypted (HTTPS); we only store a check value instead of the password; two-step verification is available (and mandatory for the game master); the interface runs with a strict content security policy; only the operator can access the server, and regular backups are made. If a personal data breach still happens, we report it to the NAIH within 72 hours, and if it poses a high risk to you, we notify you without delay as well.

Children

You can sign up from the age of 16; under 16 only with the consent of a parent (legal guardian). If it turns out that a child under 16 created an account without consent, we delete the account at the parent's request.

If this policy changes

This page is generated from the game's code, so it changes together with server updates. If we ever start collecting something new, you will read it here — and if it requires consent, we will ask first. We also announce important changes in the game.

Effective from 30 October 2026.