Privacy policy

Last updated: 2026-11-10

This policy explains which personal data Cities of the Tide handles, why, for how long, and what you can ask of us. We collect as little as the game needs. We do not sell data, show advertising or use tracking or analytics cookies.

1. Who is responsible

The controller of your data is Digital Owwwl SRL, Str. Laloșu nr. 3, bl. 3A, sc. 1, et. 1, ap. 12, Sector 4, 041353 Bucharest, Romania, registered in the Trade Register under J40/3147/2016, tax ID (CUI) RO35742894.

For anything about your data write to [privacyEmail]. We have not appointed a data protection officer, as the law does not require one for a service of this kind.

2. What we store, why, and on what basis

• Your account: your username, your password (stored only as a salted scrypt hash, which nobody can read back), when the account was made and when you last signed in. Needed to give you an account (contract, Art. 6(1)(b) GDPR).
• Your email address, if you give one: used only to send you a link to reset your password. It is optional. Contract, Art. 6(1)(b).
• Your game: your towns, buildings, troops, research, reports, achievements, your Tidepearl balance and its history, and when you were last active. Needed to run the game (contract).
• What you write: messages to other players, alliance texts and support tickets, stored so they can be delivered and answered. The team may read them to answer support requests and to deal with reported breaches of the Terms (contract and our legitimate interest in a fair, safe game, Art. 6(1)(f)).
• Security data: your IP address is held in memory for a short time to stop abuse such as repeated sign-in attempts. To enforce the rule on accounts playing from one connection, a keyed hash of it (not the address itself) is kept for 30 days together with the dealings between players of those days (fleets, trades, armies, spies); the game masters see only which accounts share a connection. Server logs, which may contain the IP address, the time and the page asked for, are kept for at most 14 days to find faults and fend off attacks. Legitimate interest in a secure service, Art. 6(1)(f).
• The waiting list (before the game opens): the email address you leave on the home page, the language of the page, which site or post brought you there, and when you signed up and confirmed. Used for one thing only: one email on the day the game opens. Your consent, Art. 6(1)(a), given by confirming the address with the link we send you; you can withdraw it at any time with the link in every email.

The game sells nothing today, so we hold no payment data. If purchases are added, this policy will say beforehand what a payment provider receives and what we keep for accounting.

3. Cookies and storage in your browser

We use only cookies that are strictly necessary, so no consent banner is needed:

• psid and sid: keep you signed in (on the site and in a game world), for up to 30 days or until you sign out;
• pjoin: holds the step of founding your first town, for 15 minutes;
• lang: the language you chose.

The game also keeps settings in your browser's local storage (such as the sky and season of the map, or the page of a list you were on) and a copy of its pages and pictures so they load faster and work offline. These stay on your device and are never sent to us.

4. Who else receives data

• Other players see your username, town names, portrait, alliance, rankings and what you write to them.
• Our hosting provider, Hetzner Online GmbH, Germany (servers in the EU), runs the servers and stores the data and backups for us.
• Our email provider, [emailProvider], delivers the emails we send (password links, the waiting list's emails).
• Google Fonts (Google Ireland Ltd.) delivers the fonts of the pages and so receives your IP address.
• Authorities, only when the law obliges us to.

The providers act on our instructions under data processing agreements. Where a provider is outside the European Economic Area, the transfer rests on an adequacy decision of the European Commission (for the United States, the EU-U.S. Data Privacy Framework) or on the Commission's standard contractual clauses.

5. How long we keep it

• Your game data, as long as your town in that world exists. When you delete it (Options → Delete account), your towns, the messages you received, your reports and the rest of your game in that world are deleted at once. Messages you sent stay with the players who received them, without your name.
• Your account (username, password hash, email), until you ask us to delete it: write to [privacyEmail] from the address on the account, or through Support in the game.
• Backups of the databases are kept for 14 days and then overwritten, so deleted data is gone from them after that.
• Security data: 30 days for the connection hashes, 14 days for server logs.
• The waiting list: an unconfirmed address is deleted after 7 days; a confirmed one once the launch email has been sent to it, or at once when you use the link to leave the list.

6. Your rights

You can ask us for a copy of your data, have it corrected or deleted, restrict or object to its use, take it with you in a common format, and withdraw a consent at any time (this does not affect what was done before). Write to [privacyEmail] or use Support in the game. We answer within one month and may ask you to prove the account is yours.

You may also complain to a data protection authority: the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro), or the authority of the EU country you live in.

We make no decisions about you based solely on automated processing. The check for accounts sharing a connection only points the game masters to them; a person decides.

7. Security

The site is served over HTTPS only; passwords are hashed with scrypt; session cookies cannot be read by scripts; sign-in attempts are rate limited; only the people who run the game can reach the servers and the backups.

8. Children

Cities of the Tide is meant for players aged 16 or older. A younger player needs the consent of a parent or guardian. If you believe a child has given us data without it, write to us and we delete it.

9. Changes

We update this policy when the game changes how it handles data. The date at the top shows the latest version; important changes are announced in the game before they apply.

See also the Terms of use.