Privacy Policy
Settlers MMO · version 5, 10 October 2026
This policy says which personal data Settlers MMO handles, why, for how long, who else handles it, and what rights you have. It covers the website settlers-mmo.com, the sign-in service at auth.settlers-mmo.com, the game clients (Windows, Linux, macOS, Android and iOS) and the game servers.
1. Who is responsible
Operator: see contact address
Questions and requests about your data: privacy@settlers-mmo.com. General contact: contact@settlers-mmo.com. We run the servers ourselves, in Romania; there is no hosting company in between.
2. The data we handle
Your sign-in account (Keycloak, at auth.settlers-mmo.com). Your e-mail address (it is also your user name), the name you give, whether the address was verified, a random account number, the time the account was made, and, if you registered with a password, a salted hash of it (we never see the password itself). If you choose "Continue with Google", Google tells us your Google account number, e-mail address and name; we ask for nothing else and read nothing from your Google account. If you choose "Sign in with Microsoft" (a personal, work or school account), Microsoft tells us your Microsoft account number (an identifier it gives to our sign-in service), e-mail address and name; we ask only for permission to read that basic profile, keep nothing else from Microsoft's reply (for example a job title or phone number of a work account), and read no mail, files or contacts. We do not take the e-mail address from Microsoft as proof that it is yours: a new account has to confirm it by mail, and if the address already belongs to an account here we link the two only after you confirm by mail or password. While you are signed in Keycloak keeps a session record: your IP address, the type of browser or app, and the start and last use of the session. We keep no history of past sign-ins.
Website records (settlers-mmo.com). When you sign in on the website you are put on the waitlist: your account number, e-mail address, name, the time you first appeared, whether the address is verified, and whether an operator has approved your access. Operators can also note you down on the list of a restricted game world. Approved or revoked access is told to the game servers by account number.
Game data (the game servers). The name you choose in the game, which other players can see, and the player that goes with it: an identity derived from your account number (not your e-mail address or real name, which the game servers do not store), where you started and where the camera was, your score, when you were created and last active, and everything you do in a world: buildings, units, resources, claimed land, roads, alliances and diplomacy, the text of alliance proposals, battle reports and your game actions.
Technical data. Our traffic goes through Cloudflare, which sees the IP address, browser type and address of every request. Our own servers keep short technical logs (section 5). Neither the website nor the game contains advertising, analytics, tracking or crash-report services.
Mail. The addresses and texts of the mails we send you (verification, access approved or revoked, security) and of mails you send us.
On your device. The website keeps your sign-in in your browser's local storage so you stay signed in, and the sign-in service sets its own session cookies (below). The game keeps a saved sign-in, settings, a map cache and log files in its private app folder; none of it is uploaded.
You are not required to give us anything beyond what the sign-in needs; without it we cannot give you an account.
3. Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Make and run your account, sign you in, let you play, show your name to other players | Sign-in account, game data | Art. 6(1)(b): contract (the Terms of Service) |
| Approve access, tell you by mail that access was approved or revoked | Website records, e-mail address | Art. 6(1)(b): contract |
| Keep the service secure, find and stop abuse and cheating, repair faults, restore from backups | Logs, sessions, backups | Art. 6(1)(f): our legitimate interest in a secure, working service |
| Moderate names and messages, act on reports | Names, alliance messages, reports | Art. 6(1)(f): our legitimate interest, and the interest of other players |
| Answer your requests and be able to show that we did (including the record of a deleted account) | Your mails, deletion record | Art. 6(1)(c) and (f): our duty to answer (Arts. 12 to 22) and to show compliance (Art. 5(2)) |
We do not sell your data, do not use it for advertising, do not send marketing mail and do not build profiles. The only thing that rests on your consent is the optional alerts for when you are away (section 5, "Alerts when you are away"); you give that consent by turning them on and can withdraw it at any time by turning them off.
4. Who else receives it, and transfers outside the EU
| Who | What for | Where |
|---|---|---|
| Other players | Your in-game name and what the game rules show them (for example an ally sees what an alliance shows) | In the game |
| Cloudflare, Inc. | DNS, TLS and the proxy in front of all our addresses, including the secure tunnel to our servers. It sees the traffic metadata of every visit. | Worldwide network, company in the USA: EU-US Data Privacy Framework and standard contractual clauses |
| Amazon Web Services (Amazon SES) | Relay for the mails Keycloak and the website send (verification, access approved or revoked). It sees the recipient address and the text. | EU (Stockholm) region |
| Only if you choose Google to sign in: Google learns that you sign in to Settlers MMO and sends us your name, e-mail address and account number. Google’s own privacy policy covers its side. | Company in the USA and Ireland: Google’s own transfer safeguards | |
| Microsoft | Only if you choose Microsoft to sign in: Microsoft learns that you sign in to Settlers MMO and sends us your name, e-mail address and account number. Microsoft’s own privacy statement covers its side. | Company in the USA and Ireland: Microsoft’s own transfer safeguards |
| Our own mail server | Receives the mails you send to our addresses | Romania |
| Authorities | Only when the law obliges us | Romania / EU |
Our servers (website, sign-in service, game servers, mail, backups) are in Romania. Apart from Cloudflare and, if you choose them, Google or Microsoft, nothing leaves the EU, except Apple's push service if you turn on alerts on an iPhone (section 5). If you install the game through an app store, that store's own privacy policy governs what it collects.
5. How long we keep it
| Data | Kept |
|---|---|
| Sign-in account | Until you or we delete the account. We do not delete accounts for inactivity automatically. |
| Sign-in session records (with IP address) | Until the session ends: 30 minutes without use, 10 hours at most; if you tick "Remember me", 30 days without use and 90 days at most. |
| Website records and world access lists | Until the account is deleted (section 7). |
| Game data | While the world exists or until your player is erased (see "Delete your account"). Worlds are reset from time to time, as announced; a reset removes every player’s data in that world. |
| Alert devices and choices (only if you turn alerts on) | Until you remove the device or turn alerts off, you delete your account, or the world is reset; at the latest 90 days after you last played. The text of a waiting alert: 10 minutes at most. Copies in world backups follow the backup rows below. |
| Record that an account was deleted | A time and a one-way hash of the account number, nothing else, for 3 years, to show that the request was handled and to delete you again if an old backup is ever restored. |
| Technical logs | The website API and web server: a rotating log of at most 50 MB each, which in practice covers days to a few weeks. The sign-in service: its log is kept until the container is replaced at an update (weeks). The game servers: a rotating log of at most 30 MB each. Cloudflare keeps its own logs for its own periods. |
| Backups of the website and the sign-in service | Every night, kept 14 days on three machines. Up to ten copies of the website database taken just before an update are kept until newer ones replace them, so they can be older than 14 days. |
| Backups of the game worlds | Every night; the last 7 days and the last 4 Sundays are kept (up to about five weeks). A copy made on purpose before a reset or an update is kept until we remove it. |
| Mails you sent us and our answers | As long as the matter needs, and up to 3 years after it was settled. |
Direct messages you delete. When you delete a direct message you sent, it disappears from your list and from the recipient's, but the game server does not erase the text at once: it keeps it hidden, so that a moderator can still read it if a player reports it, for up to 180 days. It is deleted earlier if your player or the recipient's player is erased, if a moderator removes it, or if the world is reset. At most 500 hidden messages wait for each sender; beyond that, a delete is final at once. When the recipient deletes a message, it is deleted for good.
Alerts when you are away (optional). In the game, under Menu, Notifications, you can ask to be told on your phone or computer when you are attacked or one of your buildings is captured, and, if you choose, when an ally is attacked, also while the game is closed. Alerts are off until you turn them on, and nothing about them is stored or sent before that. For each device you add, the game server stores a device name you type, the kind of device (iPhone, Android or desktop) and a delivery address: a random private link (an ntfy topic) that the server makes for an Android phone or a computer, or, on an iPhone and only once push for iPhone is available, an Apple push device token. It also stores your choices: which alerts you want, whether the lock screen may show details, your quiet hours and the time-zone offset of your phone. When an alert is due, the game server hands a short text to the game's own notification service, which passes it to your device. Unless you turn on details, the text only says that your settlement is under attack or that a building was captured; with details on it can name your building, and an alert about an ally names that ally's public in-game name and nothing else. On an iPhone the alert also goes through Apple's push service, which receives the device token and the alert text; if you use the ntfy app on an iPhone, ntfy's public relay (ntfy.sh) is also told that a message arrived, but not its text. Alerts are limited (at most six an hour for attacks and captures); an alert over the limit or in your quiet hours is dropped, not sent later. An alert waiting for delivery is deleted after 10 minutes at the latest. A device and your choices are deleted when you remove the device, turn alerts off, delete your account, or the world is reset, and in any case when you have not played for 90 days. This rests on your consent: you give it by turning alerts on and can withdraw it by turning them off.
Data you have deleted disappears from backups as they are replaced. If we ever have to restore a backup, we delete again what was deleted since.
6. Your rights
You can ask us, free of charge, for:
- access to your data and a copy of it (Art. 15), also in a machine-readable form (Art. 20)
- correction of data that is wrong (Art. 16); your name and e-mail address can also be changed in the sign-in account
- erasure (Art. 17): see "Delete your account" below
- restriction of the use of your data (Art. 18)
- to object to use that rests on our legitimate interest (Art. 21)
- to withdraw a consent you gave, at any time, if we ever rely on one (Art. 7)
Write to privacy@settlers-mmo.com from the e-mail address of your account. We may ask you to confirm that the account is yours before we hand over or change anything. We answer within 30 days. If a request is very complex we may need longer, and then we tell you why within that time (Art. 12(3)).
You can delete your account yourself on the Delete account page, which also explains how to ask for a copy of your data.
You have the right to complain to a data protection authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), www.dataprotection.ro; you may also complain to the authority of the EU country where you live or work.
7. Delete your account
You can delete your sign-in account and your website records yourself, and your game data from inside the game or by asking us, as described on the Delete account page. Deleting the sign-in account does not by itself erase the data of a game world; that is done by the in-game delete or by us on request. The order that works is explained on that page. It also removes our link to your Google or Microsoft account; the permission you gave there stays listed in that account until you remove it yourself (in your Google or Microsoft account settings).
8. Children
Settlers MMO is not for children. You must be at least 16 years old to create an account. If we learn that an account belongs to someone younger, we delete it. If you are a parent and think your child has an account, write to privacy@settlers-mmo.com.
10. Security and automated decisions
Connections use HTTPS and secure websockets. Passwords are stored only as salted hashes. Access to the servers is limited to the operator. Nothing is decided about you by purely automated means with legal or similarly significant effect, and we do not profile you.
11. Changes to this policy
The version and date are at the top of this page. When something changes, we raise the version and date, and announce material changes on the website's home page.