Privacy notice

Who is responsible

The data controller is Warlord March, the team that makes the game and runs warlordmarch.com. You can reach us about anything in this notice at [email protected].

What we collect and why

Wishlist. When you join the wishlist we store your email address, the language of the page you used, which form you used, the time you gave consent and a one-way hash of your IP address as a record of that consent. We use this only to email you news about Warlord March, such as beta waves and a release date. Legal basis: your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)).

Beta account. When you apply for the private beta we store your name, email address, password (only as a salted scrypt hash; we never see or store the password itself), your language, the optional note you write, the status of your application and when you created the account. We use this to review applications, let approved testers into the beta and contact you about your account. Legal basis: taking steps at your request and providing the beta to you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).

Signing in. When you sign in we set a session cookie. On our side we keep only a hash of the session token, linked to your account, so we can recognise you until you sign out or the session expires.

Security. To protect the forms from abuse we count requests per IP address for a short time and may use Cloudflare Turnstile, a check that tells people from bots without puzzles in most cases. Legal basis: our legitimate interest in keeping the service secure (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

Playing the beta. Your saved games are stored in your own browser (local storage and IndexedDB) and are not sent to us. When you play co-op, game messages pass through our server to the other players in your room and are not stored.

Cookies and local storage

wm_sess

Session cookie set when you sign in. Strictly necessary for the account and the beta. HttpOnly, Secure, expires after 30 days or when you sign out.

wm_lang

Remembers the language you chose (English or Turkish). Expires after one year.

Local storage

Your language choice and whether you closed the language suggestion. In the beta, your saved games.

We use no advertising, analytics or social media cookies, so we don’t ask for cookie consent. Cloudflare may set a strictly necessary security cookie when it checks traffic.

Who processes the data with us

• Hetzner Online GmbH (Germany) hosts our server in its data centre in Helsinki, Finland. Your data is stored there.
• Cloudflare, Inc. (USA) delivers the site, protects it from attacks and provides Turnstile. All traffic to warlordmarch.com passes through Cloudflare, which processes IP addresses and technical request data for this purpose.

Both act on our instructions under data processing terms. We don’t sell your data or share it with anyone for their own marketing. We don’t yet use an email delivery service; if we start using one to send wishlist news, we will name it here before the first email goes out.

Transfers outside your country

Our server is in the European Union. Cloudflare may process data in other countries, including the United States; such transfers rely on the EU–US Data Privacy Framework and standard contractual clauses. For users in Turkey, storing data on servers in the EU is a transfer abroad under Article 9 of KVKK, which we carry out on the basis of the safeguards provided for in that article and, where these are not available, your explicit consent given in our forms.

How long we keep it

• Wishlist: until you withdraw your consent or we stop sending news. We delete your address within 30 days of your request.
• Beta account: while your account exists. Ask us to delete it at any time and we do so within 30 days.
• Sessions: 30 days at most, or until you sign out.
• Request counters for security: a few minutes to a day.
• Backups: we keep daily backups for 14 days, so deleted data disappears from backups within 14 days.

Your rights

You can ask us at any time to tell you what data we hold about you and give you a copy, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. You can withdraw your consent to wishlist emails at any time; this doesn’t affect what we did before. Under KVKK Article 11 you also have the right to learn whether your data is processed, for what purpose and to whom it is transferred, and to claim compensation for damage caused by unlawful processing.

To use any of these rights, write to [email protected] from the email address concerned. We answer within 30 days. If you think we handle your data unlawfully, you can complain to the data protection authority where you live, and in Turkey to the Personal Data Protection Authority (KVKK).

Age

The wishlist and the beta are meant for people aged 16 or over. If you are younger, please don’t send us your details.

Changes to this notice

If we change how we use your data, we will update this page and the date at the top. If a change is significant and we have your email address, we will tell you by email.