Privacy Policy

This is not legal advice. The operator of NETWAR is a private individual in Bulgaria running a small hobby game in open beta, not a law firm and not a registered company. If you need legal advice, talk to a lawyer.

This policy describes what NETWAR collects, why, where it lives, and what you can ask us to do.

NETWAR is at https://www.play-netwar.com and https://play-netwar.com.

1. Who is responsible

Operator: The operator of NETWAR (private individual in Bulgaria, not a registered company). No personal legal name is published on this site.
Email: [email protected]

That operator decides why and how personal data for NETWAR is processed (the “controller” in GDPR language).

2. What we collect

We collect only what we need to run accounts and the Game.

You give us

• Display name
• Email address
• Join token / API key (we issue it; you use it to restore access)
• Anything you type into the Game (for example inbox messages, names, in-game text)
• Feedback notes you send with the FEEDBACK button, signed with your operator name and the email on your account

The server creates or stores

• A sign-in cookie (HttpOnly, one random session id) that keeps you signed in on that browser for up to a year, renewed when you come back
• A record of where your in-game credits came from and went (the LEDGER), kept 30 days
• Daily usage counts for the whole server (how many duels, captures, which cards are played) — totals, not tied to you
• Game save in SQLite: sectors, cards, inbox, HEAT, and other play state
• Coarse GeoIP country only (no GPS, no street address, no precise location)
• Technical logs: IP address, time, requested URL, user agent — from the app, Nginx, and Cloudflare
• Game event logs for debugging (for example the last duel played, important server events), which can include operator names

We do not collect (today)

• Payment card data (there are no in-game purchases)
• Advertising IDs
• Precise geolocation
• Government ID

Optional, only if you use it when it exists

• Discord login: if you choose it, Discord sends us the identifiers needed to sign you in. Discord’s own privacy policy applies to Discord.
• Email: we send sign-in codes, access keys and recovery mail through an email provider (Resend or SMTP). Nothing else — no newsletters.

We do not use Google Analytics. We do not run ads. We do not sell your data.

3. Why we collect it

Legal bases, in plain language:

• Contract / requested service: you asked for an account and a game.
• Legitimate interest: keep the server up, stop cheating and attacks, understand crude country-level usage.
• Consent: only where we actually ask for it (for example, if you choose Discord login).

4. Where it is stored

• Game database and application: Hetzner VPS in the EU, SQLite on that server.
• Domain and traffic: Cloudflare sits in front of the site. Cloudflare sees request metadata (including IP) as any reverse proxy does.
• Mail: sent through an email provider (Resend or SMTP).
• Discord: only if you use Discord login.
• Backups: a daily copy of the game database, kept on the server for 14 days.

We do not operate a separate analytics warehouse.

5. How long we keep it

• Account + game save: until you ask us to delete the account, or we delete it because of a ban, a world reset, or the project shutting down.
• Backups: daily database copies are kept for 14 days, so a deleted account can remain in a backup for up to 14 days before it is gone for good.
• Local-storage login: on your device until you log out or clear the site's data.
• Feedback notes: until they are dealt with, or until you ask us to delete them.
• Logs and IPs: only as long as needed to operate and secure the server, then rotated or overwritten in normal operations. We have not set a public “delete logs after N days” clock yet; when we do, this policy will say so.
• Mail copies: only as needed to deliver or debug delivery.

A world reset is not the same as an account deletion. Reset can drop sectors, cards, inbox, HEAT, and similar play state.

6. Who we share it with

We do not sell lists. We do not share data with advertisers.

We use processors / infrastructure that necessarily see some data:

Law enforcement or a court can compel disclosure. We will not pretend otherwise.

Ko-fi or any external “SUPPORT” page is a third-party site. If you pay them, that is between you and them. We do not receive your payment card details through the Game.

7. Cookies and local storage

One sign-in cookie keeps you signed in on a browser (HttpOnly, up to a year, renewed when you come back; signing out or Sign out everywhere ends it). If you use Discord login, a short-lived cookie (10 minutes) protects that sign-in. A few display preferences (language, sound, view) are kept in your browser's local storage. That is all — no tracking or advertising cookies.

Cloudflare may set its own technical cookies as part of proxying the site.

You can clear the site's data in your browser at any time; you will then need your key to log in again.

8. Your rights (GDPR, plain English)

If you are in the EEA / UK (and in similar systems), you can ask us to:

• Access — tell you what we hold about you
• Correct — fix a wrong name or email
• Delete — erase your account and associated personal data
• Export — give you a copy of the personal data we have in a common format, where that is reasonable for a small SQLite project
• Object / restrict — in the situations the law actually provides

Deletion today: Use Neural Link → OPERATOR → Delete account, and type DELETE to confirm. That does not cancel the right. Email [email protected] from the address on the account (or prove you control the account) and ask us to delete it. We will delete the account and associated personal data from the live database, except data we must keep for security or legal reasons (for example a short log that an abuse ban existed).

You can also complain to the Bulgarian Commission for Personal Data Protection (КЗЛД) or your local EU data-protection authority. We would rather you email us first so we can fix it.

9. Children

NETWAR is a hobby MMO, not a service built for young children. You need to be at least 14 to make an account (the age of digital consent in Bulgaria; if your country sets a higher age, that age applies). We do not knowingly collect data from younger children. If you believe we have an account that should not exist, email us and we will delete it.

10. Transfers outside the EU

The game server is in the EU (Hetzner).

Cloudflare is a global network. Traffic and logs may be processed outside the EU as part of how a CDN/proxy works. Discord and some email providers are also often outside the EU.

If that happens, it is because those tools are how the Site is delivered, not because we sold a marketing list.

11. Changes

If our practices change (we add purchases, analytics, or form a company), we will update this page and the date at the top.

12. Contact

Privacy requests: [email protected]