Privacy Policy

Last updated: April 6, 2026

1. What We Collect

When you create an account, we collect:

Email address — for account authentication and recovery
Username — your public in-game identity
Password — stored as a one-way Argon2id hash (we cannot read your password)

If you sign in with Google or Discord, we receive your provider user ID and email. We do not store your social login tokens.

2. Game Data

We store your game state: biome configuration, organisms, battle history, economy transactions, Hive membership, and chat messages. All game actions are logged for anti-cheat and balance purposes.

3. How We Use Your Data

Authenticate your account and maintain your session
Provide the game experience (biome simulation, matchmaking, rankings)
Detect abuse, cheating, and unauthorized access
Send critical account notifications (security alerts, bans)

We do not sell your data. We do not serve ads. We do not share data with third parties except as required by law.

4. Data Storage & Security

Your data is stored on secured servers in Europe (Hetzner, Germany). All connections use TLS 1.3 encryption. Passwords are hashed with Argon2id. JWT tokens expire after 15 minutes. We perform regular security audits.

5. Cookies

We use HttpOnly, Secure, SameSite=Strict cookies for authentication tokens only. No tracking cookies, no analytics cookies, no third-party cookies.

6. Your Rights (GDPR)

You have the right to:

Access — export all your data from the Profile tab
Rectification — update your username and email in settings
Erasure — request account deletion from the Profile tab (confirmed within 30 days)
Portability — download your data as JSON

7. Data Retention

Active accounts: data retained while your account exists. Deleted accounts: data permanently erased within 30 days of confirmed deletion request. Battle replays and audit logs may be retained for up to 90 days for anti-cheat purposes.

8. Children

Biome War is not intended for children under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us for removal.

9. Changes

We may update this policy. Significant changes will be communicated via in-game notification. Continued use constitutes acceptance.

10. Contact

For privacy inquiries: [email protected]