Privacy Policy

The Data Controller responsible for processing your personal data under the European General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR) is:

In accordance with the principle of data minimization (GDPR Art. 5(1)(c)), we collect and process only data strictly necessary to deliver persistent MMORTS gameplay and safeguard shard integrity:

• Account Data: Commander callsign/username, verified email address, cryptographically derived scrypt password hash, account creation timestamp, and assigned player identifier.
• Game Telemetry & State: Toroidal settlement coordinates (X/Y), resource production balances, building tier levels, military unit training queues, movement dispatches, combat battle reports, and timestamped actions resolved on discrete 1.000s boundaries.
• Technical & Network Telemetry: Public IP address (IPv4/IPv6), browser user-agent header, WebGL rendering canvas parameters (utilized strictly for anti-bot heuristics and hardware cluster detection), and session authentication tokens.
• Transaction & Billing Data: External payment reference identifiers (e.g., Stripe transaction tokens, PayPal charge IDs), virtual currency ledger records, and timestamped Gold invoices. Notice: We NEVER store, process, or transmit raw credit card numbers or banking credentials on our infrastructure.

We process your personal data strictly under valid statutory legal bases:

• Contract Performance (GDPR Art. 6(1)(b)): Processing account data, tactical commands, and virtual currency entitlements is indispensable to execute our service contract and provide active MMORTS gameplay.
• Legitimate Interests (GDPR Art. 6(1)(f)): Processing network telemetry, click cadence entropy, and device signatures is necessary for fraud prevention, multi-accounting detection, service stability, and defending the platform against botting and DDoS attacks.
• Legal Compliance (GDPR Art. 6(1)(c)): Retaining transaction invoices and billing ledgers is required to satisfy German commercial and tax accounting obligations (§147 AO, §257 HGB).

Gray Doom operates an uncompromising zero-tracking architecture. We do NOT deploy third-party advertising cookies, cross-site trackers, or commercial profiling scripts.

• Essential Session Cookies: We utilize strictly necessary, cryptographically generated session cookies (flags: HttpOnly, SameSite=Strict, Secure) solely to authenticate your browser session against our application servers.
• Client LocalStorage: Used exclusively on your local workstation to store non-identifying UI preferences: sound effects toggles (SFX on/off), tactical radar zoom levels, and preferred language selection.

Every commander retains full sovereign rights over their personal information:

• Right to Access & Portability (Art. 15 & 20): You may request an automated machine-readable export of all data associated with your commander callsign (JSON format) directly via the Account Security portal.
• Right to Rectification (Art. 16): You may correct outdated email addresses, communication preferences, or security credentials within account settings.
• Right to Erasure ("Right to be Forgotten" - Art. 17): You may execute a complete account deletion request at any time. To prevent accidental or malicious destruction, deletion enters a mandatory 72-hour grace period during which you may abort the process. Upon expiration, all personal identifiers, email references, and salted hashes are permanently scrubbed from production databases.
• Right to Lodge a Complaint: You have the right to lodge a formal complaint with the competent data protection supervisory authority (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

We implement state-of-the-art defense-in-depth security controls (GDPR Art. 32):

• Transport Encryption: All traffic between your browser and our servers is strictly encrypted using TLS 1.3 with modern AEAD ciphers (ChaCha20-Poly1305 / AES-256-GCM) and enforced via HTTP Strict Transport Security (HSTS).
• Cryptographic Key Derivation: Commander credentials are protected using scrypt with high work factors (N=16384, r=8, p=1) and cryptographically random per-user salts, rendering brute-force attacks computationally infeasible.
• Access Segregation: Internal production access is governed by strict Role-Based Access Control (RBAC), multi-factor hardware keys, and tamper-evident audit logs.

Gray Doom primary servers and database nodes are hosted within European Union data centers (Frankfurt, Germany). Where edge routing or global content delivery networks are utilized, transfers outside the European Economic Area are safeguarded via Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to GDPR Art. 46.