Privacy policy · Kingsfate

Who we are

Kingsfate is made by an independent developer in Sweden, who is the controller of the personal data described here: the one who decides what is kept and why. Questions and requests go to support@kingsfate.com.

What we keep

Whenever you play:

The name you give your commander. Others at your table see it. A name others would see is first checked against the words the game refuses (slurs, obscenities, hate symbols, and names that pass for the game’s own); a refused one is shown to them as Wanderer.
Your legend: your renown, unlocks, achievements, the record of your wars and how you play them (the counts behind Your Legend’s Play Style), and your record in any mode you test for us. A guest’s legend is kept on the server under a random id the game makes and keeps on your device; an account’s, with the account.
The wars you are in: an open war table, with its commanders’ names, armies and moves, is kept on the server while the war lasts, so that a restart doesn’t end it.
The Daily Challenge: your scored run’s result, under the name you played it with (a guest is marked as one), on the day’s board; and with your legend, each day’s final place, from which the game shows you (and no one else) your week and your streaks.
Your record: your wars counted by their size (wars and wins), and your runs of wins, kept with your legend for Your legend’s Record.
If you win a tournament: your crown in the hall of champions, under the name you won it with (marked as a guest’s if you played as one), with the size of the tournament and when.
Wars fought offline: a war against bots fought with no connection waits on your device (20 at most, for 30 days) until the war server can be reached. The server then replays it and pays its renown only if the replay plays the same war. It keeps a row for each (your legend’s id, the war’s seed, how it was settled and what it paid), and the war’s whole record (your commander’s name and every move and choice in it) only for a war whose replay it withheld, to find out why. Both go after 60 days.

If you play one of the store apps:

Its proof that it is a bought copy: the App Store’s signed record of the game on your Apple account, which our server checks against Apple’s signature; or Google Play’s answer to its integrity check (that Play knows the app, that the Google account on the device has a licence for it, and that the device is genuine), which our server has Google read. The app sends it when an account is made, and the first time anyone signs in on a new install. It tells us that the copy was bought, never your name or that store account’s, and isn’t kept, beyond what follows.
So that one copy can’t make accounts without end: for the App Store, a keyed one-way hash (made with a secret key only the server holds) of the id Apple gives your Apple account’s copy of the game, with how many accounts it has made, and nothing else; for Google Play, the count of accounts made on your device, which Google keeps with the device for us (Play’s “device recall”), and we keep nothing.
Playing as a guest, the app trades that proof for a pass from the war server, kept on your device for 30 days and renewed before it runs out. The server keeps nothing of it: it is tied to no legend and no account. A session opened on a bought copy is marked as one.

If you enter an access code on the website:

A pass for that browser: a random token, of which we keep only a hash, with which code let it in and when the pass ends. It lasts 30 days, renewed while you play, and ends when the developer withdraws the code, or the code’s own time is up. Nothing in it names you or your address.

If you make an account:

A name (shown to others), a password and an email address. We never keep the password itself, only a salted hash of it (PBKDF2-SHA256, 100,000 rounds). We don’t ask for your real name or your age.
Your email address, shown to no one else. We mail it six-digit codes: to prove it’s yours, and to set a new password if you forget yours (which signs you out on every device). You may sign in with it instead of your name. When you change it, the address it had is told, with the new one shown only in part, so a change you didn’t make can be caught. We send it nothing else: no newsletters, no marketing. Only a hash of each code is kept, for 15 minutes at most, and a new account waits on its code that long (its name, its password’s hash and, from an app, its copy’s proof as checked, with it), then goes if the code never comes. An account made before addresses were asked for, or by signing in with Steam, has none until you add one; the title asks for one at most once every seven days.
Asking for a new password, or to move your account to another address, mails the address typed in either way: a code where it can take one, else a note saying why not (no account has proved it; another account already has it), so neither form tells anyone whose address has an account. Nothing of it is kept but the mail, until it goes.
If you make your account with an access code the developer gave you: which code made it, noted with your account. The codes themselves are kept only as a hash.
While you are signed in, a session: a random token, of which we keep only a hash. In a browser it is kept in a cookie; the apps keep it in their own storage.
A saved run of a mode in testing (only if you test it), so you can go on with it on another device.
Any mark on your account that you test a mode for us, if the developer asks you to test one.
Your friends: the accounts you follow, by their ids alone. Following someone asks nothing of them and tells them nothing.
Your rating on the rated ladder: for each of its ladders (duels, sides, every army for itself) and each month’s season, your rating, wars and wins, moved by the wars that count (Quick Match’s, and those listed on Open Wars with commanders on two sides or more; bots are never rated). A season’s ratings stay as its final board.
With them, your rating at the end of each day a rated war moved it, so your Record can draw its line, for 13 months.
So that two players can’t farm each other on the ladder, how many rated wars two accounts fought on opposite sides, by their ids, for two days at most.
Your renown of the season: what your legend earned each month, for the season’s board.
Whether your friends may see you online (Show me online, in Settings, on unless you turn it off). We keep only a mark on an account that has turned it off; where you are is worked out from who is connected at that moment, and never kept.

If you report or block a commander, or are reported:

A report: when, the reason chosen, the note for the keepers (as the game names the developer) if you add one (200 characters at most), and where it was made (the war table and its war, or the Open Wars row, friends list or board and place it was made from). Who sent it: their legend’s id, their account’s if any, and the name they played under. Whom it is about: their legend’s id, their account’s if any, and the name they were shown under. Then what the keepers did about it, and when.
A name held: when three different commanders report the same name within 24 hours, it is shown as Wanderer everywhere until the keepers look. A name the keepers retire is kept the same way, so that it stays retired.
What the keepers decide about a commander, while it lasts (kept off the boards, or suspended, and until when), and a log of each action and each lift: who acted, on whom and under which name, what, until when, and for which reports.
A block: whom you block (their legend’s id), the name they had then (and at a table, which of the game’s commanders they led), when and where. It is kept with your legend, so it follows your account to every device. Guests may report and block too.

To keep the game working, safe and fair:

The balance ledger: for every war, the warbands, the choices offered and taken, and how each round went, so we can balance the game. It never holds a name or an address. A seat played by a person carries that commander’s legend id for 90 days, then nothing; the rows themselves go after 365 days. A practice run of the Daily Challenge, which plays on your device alone, sends its rows too, on the same terms, with your guest legend’s id.
Error reports: when the game breaks, it tells us what broke, where in the game you were, the last few things you pressed (what kind of thing, never any text), what you play in (a browser or the app), your graphics card and your screen’s pixel density, and your legend’s id. Kept 30 days.
Performance reports, only while you have them switched on in Settings: how smoothly the game draws, with what you play in, your graphics card, screen and device. No legend and no name. Kept 30 days.
The server’s own log of what it does, which names commanders and war tables, never an address. Kept 7 days.
Your IP address, only to stop abuse: too many sign-in attempts, new accounts, codes asked for or mistyped, new passwords asked for, access codes tried, connections, scored Daily runs, wars fought offline sent to be paid, or reports from one address. It is counted as a keyed one-way hash (made with a secret key only the server holds), never the address itself, for two days at most, and we never log it or keep it with your account or legend. The mailbox an email address reaches is counted the same way, so codes and new passwords can’t be mailed to one inbox without end.

On your device:

The game keeps your settings, your commander’s name, your guest legend’s id and a copy of your legend, a saved run of a mode in testing (only if you test it), the names of the commanders you lately fought beside or against (for 30 days), the wars you fought offline until they are sent, the apps’ pass for a bought copy, and, for an account with no email, when the game last asked for one, in the storage of your browser or the app.
In a browser it sets at most two cookies: kingsfall_pass, when you enter an access code, which lets that browser play (for 30 days); and kingsfall_session, when you sign in, which keeps you signed in (for 60 days). Both are strictly necessary, can’t be read by scripts, and are renewed while you play. There are no other cookies. The apps set none: they keep their session, for as long, in their storage.

What we don’t do

No advertising, no analytics, no third-party trackers or advertising SDKs, and no selling or sharing of your data for anyone’s marketing. The game’s fonts, art and sounds are its own: they come with the app, or from the game’s own server.

Nothing is decided about you automatically beyond the game itself (who wins a war), the name filter (above), a store’s word on a copy of the game (a copy whose proof doesn’t hold, or that has made as many accounts as it may, makes no more) and a name held by many reports, shown as Wanderer until the keepers look. If one of them gets you wrong, write to support@kingsfate.com and a person will look.

Why we keep it

Your legend, your account (with its email address and the codes that prove it), your wars, your friends (and what they see of you online), the Daily board, the ladder’s ratings, the season’s renown and the hall of champions: to give you the game you asked to play (the GDPR’s Article 6(1)(b), a contract).
The limits on abuse, the rated ladder’s count of wars between two accounts, the error reports, the server’s log and the balance ledger: our legitimate interest in keeping the game working, safe and fair (Article 6(1)(f)). They are kept short and hold no names (but for the commanders the log names). You may object to them.
The check that a copy of the game was bought, and the count of accounts each copy has made: our legitimate interest in letting only bought copies play, and in keeping out accounts made by the hundred (Article 6(1)(f)). The count holds no name and no account.
Reports, blocks, held names, the keepers’ decisions and their log: our legitimate interest, and our players’, in a game that is safe to play (Article 6(1)(f)). You may object to them; we weigh that against the safety of the other players.
What you write to us: to answer you (our legitimate interest, Article 6(1)(f), or the contract where it is about your account or the game).
Performance reports: your consent, given by switching them on (Article 6(1)(a)). Switch them off in Settings at any time.

Where it is kept

The game runs on Cloudflare (Cloudflare, Inc., in the USA), as our processor under its data processing terms, including the EU’s standard contractual clauses for data that leaves the EU.

Accounts, legends, the boards, the balance ledger, error reports and players’ reports and blocks are kept in Cloudflare databases held in the European Union. A war table runs on Cloudflare’s network near the commander who opened it, which may be outside the EU, with its commanders’ names and play, while the war lasts.

Google Workspace (Google Ireland Limited) mails the codes, as our processor under its data processing terms, including the EU’s standard contractual clauses for any data that leaves the EEA. Should Google’s day of mail run out, Resend (Plus Five Five, Inc., in the USA) mails them instead, as our processor under its data processing addendum: its transfers to the USA rest on the EU’s standard contractual clauses, and it takes part in the EU–US Data Privacy Framework. They are given your address and the code’s mail, nothing else.

Our address, support@kingsfate.com, is a mailbox at Google Workspace (Google Ireland Limited), our processor on the same terms, which keeps what you write to us, and the game’s notice to us of each new report (whom it is about, why and where).

How long

An account and its legend: until you delete them. A guest’s legend: until you forget it in the game. The same goes for what is kept with them: the Daily’s places, a champion’s crown, your record of wars and runs of wins, and an account’s ratings and renown of every season.
Your rating day by day: 13 months.
Your email address: with your account. A code mailed to it, and a new account waiting on it: 15 minutes at most. A mail waiting to be sent: until it goes, or its code runs out.
The count of accounts a bought copy has made: for as long as the game is sold in its store, since the limit it keeps lasts as long.
A pass for a bought copy: 30 days, on your device alone.
A report: until the keepers handle it, then 180 days; a held or retired name, while it stays so, then as long as a report. The keepers’ decisions: while they last; their log: 365 days. A block: until you unblock them, or either legend goes.
The rated ladder’s count of wars between two accounts: two days at most.
A session: 60 days, renewed while you play; signing out ends it at once.
The balance ledger: your legend’s id for 90 days, the rows for 365.
Error reports and performance reports: 30 and 30 days.
The server’s log: 7 days.
Wars fought offline: on your device until they are sent, 30 days at most; on the server, 60 days.
A commander’s identity from one war table to the next (a name, a hashed key and the account, if any): forgotten once unseen for 30 days.
Counts of an address against a limit: two days at most.
What you write to us: as long as we need it to answer you, and to show what was asked and done.
The databases’ own history, which lets them be restored after a fault: 30 days, so what is deleted is gone from it too 30 days later.

Who sees it

Other players at your table, and anyone watching it, see your commander’s name and your play. Open Wars lists tables by their commanders’ names, and the Daily board shows names and scores.

Ranks shows the game’s boards by name, never by id (and to a signed-in commander, where their mutual friends stand on them): the season’s renown and the hall of champions to everyone, and the rated ladder (each account’s rating, rank, wars and wins) to everyone.

Your legend’s Record is yours alone: it shows you your own figures and places, never anyone else’s id or name, and no one else sees it.

Friends who keep you on their list, as you keep them, see whether you are on the title screen, mustering a war or at war, with that war’s code where they may join or watch it. Someone who follows you without your following back sees nothing, nor does someone you block or who blocks you, and a guest is never shown. Turn Show me online off in Settings and no one sees you.

A commander you report is never told who reported them, and one you block isn’t told at all. When the keepers act on a report, the commander it was about is told what was done (a name no longer shown, or a suspension and until when), never who asked for it.

No one else sees your email address: not other players, and not the game’s boards or lists. The developer can see the accounts (each one’s name, when it was made and its role), players’ records of play, the balance ledger and the error reports, to run and balance the game. Reports, and what was done about them, are read by the developer alone. Helpers he names as admins may open the balance figures and the error reports. Nobody else does, except our processors (above: Cloudflare, and those who carry our mail), or where the law requires it.

The stores: Google is sent the Play Integrity token your device got from Play, to read it and to count the accounts made on your device. Apple’s record of a bought copy is checked on our server against Apple’s own keys, asking them nothing about you. Apple and Google keep what they hold of you under their own privacy policies.

Deleting your data

If you have an account: in the game, sign in, open your account and choose Delete account. It lists everything that will go, then asks for your password. It is done at once, in one step, and can’t be undone. It deletes:

your account (its name, and its email address, may then be taken by someone else), its email address, its sign-ins on every device, the note of any access code that made it, and any mark on your account that you test a mode for us;
your legend: its renown, unlocks and record of wars (by size, with its runs of wins), your record in any mode you test for us and the saved run of a mode in testing kept on the server, the wars it fought offline as the server settled them, your Daily entries (your name comes off the Daily boards), and any renown still owed to you;
your friends list, your place on other players’ friends lists, the commanders you block, and whether you let your friends see you online;
your ratings on the ladder (with their line day by day), your renown of every season, and your crowns in the hall of champions (and your counts of wars rated against another account);
what the war tables kept of which account you were. A war already under way goes on, and nothing more is paid to the deleted legend.

If you play as a guest: in the game, open Sign in and choose Forget this browser’s legend (in the apps, Forget this device’s legend). It deletes the guest legend kept in this browser (in the apps, on this device) from the server (its renown, unlocks and record of wars (by size, with its runs of wins), the wars it fought offline, its Daily entries, its crowns in the hall of champions, the commanders it blocks, and any renown still owed), and the game begins a new one. A legend that an account has taken over goes only when that account is deleted.

Either way, what is kept for balancing and fixing the game, and for keeping it safe, stays, but loses your ids:

the balance ledger’s rows lose your legend’s id at once (the rows themselves go after 365 days);
error reports lose it too (they go after 30 days);
renown already paid for a war keeps that war’s id, with no owner and no amount, so that no war is ever paid twice;
reports you made, or that were made about you, and the keepers’ log lose your legend’s and your account’s ids, but keep the names as they were shown until their time is up (a report 180 days after the keepers handle it, the log 365 days);
the count of accounts a bought copy has made doesn’t go down (it never named an account).

Performance reports never hold a legend or a name, and go after 30 days.

Deleting an account and forgetting a guest legend both also clear what your device kept of the legend, once the server has done its part: its copy of the legend, the piece style it wore, the saved run of a mode in testing, with its story, and the wars it fought offline still waiting to be sent. Your commander’s name, your settings and the names of commanders you lately fought with stay on the device; clearing the game’s data from your browser, or the app’s, removes those too. A war another legend fought offline on the same device stays until it is sent for that legend, or for 30 days at most. Signing out ends your session.

To have anything else deleted, or your account deleted for you, write to support@kingsfate.com. Delete your account says all this on a page of its own.

Your rights

Under the GDPR you may ask to see what we keep about you, to have it corrected or deleted, to have its use restricted, to object to it, and to have it in a file you can take elsewhere. Where we rely on your consent you may withdraw it. Write to support@kingsfate.com: we answer within a month, and it costs nothing.

If you think we handle your data wrongly, you may complain to Sweden’s data protection authority, IMY (Integritetsskyddsmyndigheten), or to the one where you live.

Children

Kingsfate is for players aged 13 and over (13 is also the age from which you may agree to an online service yourself in Sweden). If you are under 13, please don’t make an account or play online. If we learn that a child under 13 has given us personal data, we delete it; a parent may write to support@kingsfate.com.

This website

This site sets no cookies, keeps nothing in your browser, and runs no analytics or third-party scripts. The server that sends you its pages sees your IP address in order to send them.

Changes

When this policy changes, this page changes, with its date. A change that matters is described here.