Privacy and cookie policy

1. Who is responsible

Project Terraform is operated by Cornelius Frylinck, an individual in South Africa, who is the responsible party (POPIA), data controller (GDPR), and information officer.

Postal address: Unit 24, Garsfontein Mews, 1005 Cocker Avenue, Garsfontein, Gauteng, 0060, South Africa.
Email: support@project-terraform.net

2. What we collect

• Account: email address, username, your password (stored only as a salted one-way hash), email-verification and terms-acceptance records, your confirmation that you are 18 or older, and your email preferences.
• Security and sessions: sign-in times, session tokens, failed sign-in counts, and your IP address, used for rate limiting and abuse prevention.
• Gameplay: players, bases, resources, units, alliances, leaderboard scores, Gold balances, rewards, and rewarded-ad claim records.
• Messages: private player messages, alliance messages, and coalition messages you send in the game.
• Support: support tickets and the messages in them.
• Advertising: your consent choices, and the identifiers and device data advertising partners collect when an ad is shown (see section 5).

We do not collect payment details. Nothing in the game can be bought with money.

3. Why we use it, and our legal basis

• To run your account and the game you asked to play: performance of our agreement with you.
• To keep the service secure and to prevent cheating, fraud, and abuse: our legitimate interests.
• To send verification, password, security, and support emails: performance of the agreement.
• To email you about new servers before and when they launch: only if you opted in. Every such email has an unsubscribe link, and you can opt out at any time.
• To show advertising and award Gold for rewarded ads: your consent where the law requires it, otherwise our legitimate interest in funding the game.
• To keep records the law requires, or that we need for disputes: legal obligation and legitimate interests.

4. Who receives it

• Hetzner Online GmbH (Germany): hosts the game servers and database in Falkenstein, Germany.
• Cloudflare, Inc. (USA): delivers the website through its global network, protects it from attacks, and provides aggregate traffic statistics. Cloudflare processes your IP address and request data in whichever of its data centres is nearest to you.
• Mailjet (Sinch) (EU): delivers our emails.
• Google (AdSense, Ad Manager, and its consent tool) and Adsterra: advertising, when ads are shown.
• Authorities, where the law requires it.

Other players see your username, player names, base positions, leaderboard scores, and the messages you send them. We do not sell your personal information for money. Allowing advertising partners to collect data for personalised ads can count as "selling" or "sharing" under some US state laws. Section 5 explains how to refuse.

Moderation: staff do not routinely read private, alliance, or coalition messages. If a user is reported, staff may read the reported conversation to investigate and enforce the rules.

5. Cookies, local storage, and advertising

Strictly necessary (no consent needed): the game stores your sign-in session, selected server, theme, and panel layout in your browser's local storage. Cloudflare may set security cookies that protect the site from bots and attacks. Without these the game cannot work or keep you signed in.

Advertising (consent where required): Google and Adsterra may set cookies or read device identifiers to deliver, limit, measure, and, if you allow it, personalise ads. Advertising stays off until you accept advertising cookies in the cookie bar or Protocols. Google ads also require Google's consent integration; the site's cookie choice does not replace it. While Google's setup is pending, its web ad tags and consent prompt stay unloaded, ordinary banners and rewarded Gold use Adsterra ads instead. If you refuse advertising cookies, the game still works, without ads or rewarded Gold. You can change your cookie choice and open this policy at any time from Protocols.

US residents can opt out of personalised advertising through the same consent options, at Google's ad settings, or by turning on Global Privacy Control in a supported browser. Read how Google uses information from sites that use its services.

6. International transfers

Your game data is stored in Germany, which is covered by the GDPR. Cloudflare and Google are US companies and may process data in the United States and elsewhere. For these transfers we rely on the EU–US Data Privacy Framework, standard contractual clauses, or equivalent safeguards (POPIA section 72, GDPR chapter V).

7. How long we keep it

• Gameplay data: for the life of the game server it belongs to. When a server closes, its database is deleted.
• Account and cross-server rewards: while your account exists.
• Inactive accounts: deleted after 24 months without a sign-in. We email you 30 days beforehand.
• Server logs, including IP addresses: up to 30 days.
• Support tickets: while your account exists, or until you ask us to delete them.
• Records needed for legal duties or disputes: as long as those duties or disputes last.

8. Deleting your account

You can request deletion in the game. Deletion takes effect after a 7-day grace period, during which you can cancel it. After that, your bases are abandoned, and your personal details, messages, and support tickets are deleted or anonymised. Anonymised leaderboard history may remain.

9. Your rights

Depending on where you live (POPIA, GDPR/UK GDPR, CCPA/CPRA, and other US state laws), you can ask to access, correct, delete, or receive a copy of your information, object to or restrict its use, and withdraw consent at any time. Email support@project-terraform.net from your account email address. We reply within 30 days, or 45 days where US law allows it. We will not treat you differently for using these rights.

You can complain to South Africa's Information Regulator (inforegulator.org.za), to your local EU or UK data protection authority, or to your state attorney general.

10. Age

Project Terraform is for adults aged 18 and over. We do not knowingly collect information from children. If you believe a child has an account, email us and we will delete it.

11. Security

Passwords are salted and hashed, traffic is encrypted in transit, and staff access is limited. No system is perfectly secure. If a breach affects your information, we will notify you and the regulators as the law requires.

12. Changes

We will post changes here and update the date above. Significant changes will also be announced in the game.