Privacy policy
In short: we collect only what the game needs to run and to protect it against cheating. We use no analytics, no ads and no tracking cookies. We do not sell your data. You can delete your account yourself at any time in Settings.
1. Who processes your data
The controller of your personal data is Michal Novák, company ID (IČO) 02775093, Augustina Lukeše 2708, 250 01 Brandýs nad Labem-Stará Boleslav, Czech Republic, registered in the Czech Trade Licensing Register, the operator of the game Aumen (“we”).
For anything about personal data, contact us at mail@aumen.cz. We have not appointed a data protection officer, as the law does not require one for an operation of this size.
2. What data, why and for how long
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Account: email, player name, password (only as an irreversible hash), chosen people, language, settings, date of sign-up, last sign-in and last activity | Creating and running your account, signing in, password reset | Performance of a contract (Art. 6(1)(b) GDPR) | Until the account is deleted |
| Game data: villages, resources, troops, hero, alliances, reports, messages between players | The game itself | Performance of a contract | Until the end of the season or deletion of the account. Reports and system messages are deleted after 90 days. |
| Support requests and their text | Handling your question or report | Performance of a contract | 90 days after closing |
| Access records: IP address, device fingerprint (a one-way hash of the browser type and its language, no actual device scanning), time of first and last appearance. Recorded only at sign-up, sign-in and email confirmation. | Protecting accounts and detecting several accounts run by one player | Legitimate interest in fair play and security (Art. 6(1)(f) GDPR) | 90 days after the last appearance |
| Server logs: IP address, requested address, time, browser type | Operation, troubleshooting, defense against attacks | Legitimate interest | Overwritten continuously by volume (the logs have a fixed size limit) |
| Moderation: sanctions and their reason, a record of moderator actions | Enforcing the game rules and keeping moderator actions traceable | Legitimate interest | For as long as the account exists |
We only send you emails your account needs: address confirmation, password reset and confirmation of an email change. Alerts about an incoming attack are sent only if you turn them on in Settings. We send no newsletters or marketing emails.
3. What other players see
Your player name, villages, alliance, profile and ranking are public in the game. Other players never see your email or IP address. Messages are seen only by their sender and recipients.
4. Detecting multiple accounts
To enforce the one-account-per-player rule, we compare access records between accounts. A matching address or device means nothing on its own. The system only suggests suspicious pairs, and a moderator reviews each one. A sanction is always decided by a person, never by an algorithm. Addresses shared by many accounts (schools, dormitories, mobile carriers) are left out of the comparison entirely.
5. Cookies and browser storage
We only use what the game cannot work without. That is why we do not need your consent and show no cookie banner.
| Name | Purpose | Lifetime |
|---|---|---|
PHPSESSID (cookie) | Keeps you signed in | 14 days |
_nss (cookie) | Protection against forged requests from other sites | Until the browser is closed |
| Browser local storage | Language, display of some screens and a note that you are signed in (the home page then takes you straight into the game) | Until you clear it |
We use no Google Analytics or other analytics, no ad networks, no social plugins and no fonts loaded from third-party servers.
6. Who we share data with
We do not sell your data or share it for marketing. Only these processors, who provide the technical infrastructure, work with it:
- the provider of the server the game runs on: netcup GmbH (Karlsruhe, Germany), with the server located in Vienna, Austria,
- the provider of the mailbox the game's emails are sent from: Thinline s.r.o. (Czech Republic).
We process data in the European Union and do not transfer it outside the EU/EEA. We disclose data to authorities only when the law requires it.
7. Deleting your account
You delete your account yourself in Settings → Delete account. Deletion is immediate and cannot be undone:
- Your email, password, settings, hero, received messages, alliance membership and quest progress are deleted.
- Your player name remains only as a signature in the world's history (battle reports, messages you sent to other players). No email or other contact stays attached to it.
- Your villages stay on the map under a neutral name and are taken over by barbarians, so your neighbors' targets and reports do not vanish.
- Access records run out their 90-day period, to prevent bans from being circumvented.
- Data disappears from the daily database backups within 60 days at the latest. Backups are used only to recover from a failure.
8. Your rights
Under the GDPR you have the right to:
- access the data we hold about you and get a copy,
- have inaccurate data corrected (you can change your email and password yourself in Settings),
- erasure (see deleting your account above),
- restriction of processing,
- portability of the data you gave us, in a machine-readable format,
- object to processing based on legitimate interest,
- lodge a complaint with the Czech Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz) or the supervisory authority of your country.
Send your request from the email address on your account to mail@aumen.cz. We reply within one month at the latest.
9. Security
The connection is encrypted (HTTPS). We store passwords only as a hash using Argon2id, so nobody, not even we, can read them. Only authorized moderators have access to administration, and every action they take is recorded.
10. Children
The game is intended for players aged 15 and over. Younger players need the consent of a legal guardian. If you find out that a child has an account without consent, let us know and we will delete it.
11. Changes
If the way we process data changes, we will update this policy and announce significant changes in the game. If the Czech and English versions differ, the Czech version prevails.