Data Controller
The data controller for 2WarD is the individual or entity operating this service. For privacy-related inquiries, contact us at privacy@twoward.com.
Data We Collect
We collect the minimum data necessary to operate the game:
| Data | Category | Where Stored | Type |
|---|---|---|---|
| Email address | Account access & verification | Supabase database | Essential |
| Username (freely chosen pseudonym) | Game identity | Supabase database | Essential |
| Game state (territories, buildings, troops, balance) | Gameplay data | Supabase database | Essential |
| Language preference | Functional setting | Browser localStorage | Functional |
| Cookie consent choice | Legal compliance | Browser localStorage | Essential |
| IP address | Infrastructure log | Render.com / Supabase servers | Automatic |
| Analytics & advertising data | Future — Google AdSense | Google servers (if consent given) | Consent-only |
How We Use Your Data
- Email address — to verify account ownership, protect login access, support password recovery, and send essential security-related account messages.
- Username & game state — to operate multiplayer rooms, allow reconnection, and persist your game progress.
- Language preference — to display the interface in your chosen language.
- IP address — used automatically by hosting infrastructure (Render.com) and database provider (Supabase) for security, rate-limiting, and DDoS protection. We do not access or analyse raw IP logs.
- Cookie consent — to respect your preferences and comply with GDPR and Swiss nFADP.
Legal Basis for Processing
| Processing Activity | Legal Basis (GDPR Art. 6) |
|---|---|
| Account registration, login security, and email verification | Art. 6(1)(b) — performance of a contract (account access) and Art. 6(1)(f) — legitimate interest (account security) |
| Running the game (username, game state, infrastructure) | Art. 6(1)(b) — performance of a contract (Terms of Use) |
| Language preference | Art. 6(1)(f) — legitimate interest (improving user experience) |
| Analytics & advertising cookies (future) | Art. 6(1)(a) — your explicit consent via cookie banner |
Cookies & Local Storage
2WarD uses browser localStorage (not HTTP cookies) for all game-side storage. No session cookies are set by the game itself.
| Key | Purpose | Type | Expiry |
|---|---|---|---|
2ward_cookie_consent |
Stores your cookie preference | Essential | Until browser data cleared |
2ward_lang |
Stores selected language | Functional | Until browser data cleared |
| Supabase auth token | Maintains real-time database connection | Essential | Session |
| Google AdSense cookies (future) | Personalised advertising | Consent-only | Up to 13 months (Google-managed) |
You can clear all localStorage data at any time via your browser settings (Dev Tools → Application → Local Storage).
Third-Party Services
| Provider | Role | Location | Privacy Policy |
|---|---|---|---|
| Supabase Inc. | Database & real-time backend | USA (AWS) | supabase.com/privacy |
| Render.com Inc. | Web application hosting | USA | render.com/privacy |
| Cloudflare CDN | JavaScript library delivery (Leaflet.js) | Global CDN | cloudflare.com/privacypolicy |
| jsDelivr CDN | JavaScript library delivery (Turf.js, Supabase JS) | Global CDN | jsdelivr.com/privacy-policy |
| Google Fonts | Web fonts (Orbitron, Roboto Mono) | Global CDN | policies.google.com/privacy |
| Google AdSense (future) | Advertising (only if consent given) | USA | policies.google.com/privacy |
Data Retention
- Account emails: retained while the account remains active, or until deletion is requested, subject to limited retention needed for fraud prevention and legal compliance.
- Active game rooms: data is retained for the duration of the game session.
- Inactive rooms: game data (territories, buildings, troops) is deleted after 30 days of inactivity.
- Player records: retained as long as the associated room exists.
- Infrastructure logs (IP): retained per Render.com and Supabase's own retention policies (typically 7–30 days).
Your Rights (GDPR)
Under EU Regulation 2016/679 (GDPR), you have the following rights:
Obtain a copy of your personal data held by us.
Correct inaccurate personal data.
Request deletion ("right to be forgotten").
Limit how we process your data.
Receive your data in a machine-readable format.
Object to processing based on legitimate interest.
Withdraw cookie consent at any time via the banner.
We do not make automated decisions with legal effect.
To exercise any right, email privacy@twoward.com. We will respond within 30 days.
Swiss nFADP Addendum
For users in Switzerland, the Federal Act on Data Protection (nFADP, in force since 1 September 2023) applies in addition to the information above. You have the right to:
- Information (Art. 19 nFADP) — be informed of data processing at the time of collection.
- Access (Art. 25 nFADP) — request a copy of your personal data.
- Rectification (Art. 32 nFADP) — correct inaccurate data.
- Erasure (Art. 32 nFADP) — request deletion where there is no overriding interest.
- Data delivery (Art. 28 nFADP) — receive your data in a common electronic format.
The supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC): www.edoeb.admin.ch
International Data Transfers
Our infrastructure providers (Supabase, Render.com) are based in the United States. Data is transferred under appropriate safeguards:
- Supabase: covered by Data Processing Agreement (DPA) with Standard Contractual Clauses (SCCs) per GDPR Art. 46(2)(c).
- Render.com: covered by DPA with Standard Contractual Clauses.
Contact & Complaints
For privacy requests: privacy@twoward.com
If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority:
- EU residents: your national DPA (list at edpb.europa.eu)
- Swiss residents: FDPIC — www.edoeb.admin.ch
- UK residents: ICO — ico.org.uk