Privacy Policy

Last updated: 30 July 2026

Battle of Castles is played without signing up. No personal data is needed to start a game. One optional feature asks for personal data: the magic-link player account, which lets you find your progress again on another device.

Data controller

Eric Mollenthiel, Mollenthiel Studio (sole trader), SIREN 795 225 226, 103 avenue Lacassagne, 69003 Lyon, France.
Contact: mollenthiel@gmail.com.

What we process

• Game identifier (UUID): an anonymous technical identifier generated on your device and kept in your browser's local storage. It carries your nickname, your Elo and your stats. It cannot identify you personally. Clearing your browser data erases it.
• Nickname: the one you type. It is visible to other players during a match and on the public leaderboard. Pick one that does not identify you if you would rather stay anonymous.
• Game statistics: matches played, wins, losses, duration, Elo, attached to the game identifier.
• E-mail address: only if you create a player account. It is used solely to send you the sign-in link and to attach your progress to it. No newsletter, no advertising, never shared with a third party. Legal basis: performance of the service you requested.
• Anonymous audience measurement: number of visits, matches, average duration, concurrent players. Aggregated, self-hosted, never shared.

What we do not do

No advertising cookies, no third-party trackers, no profiling, no selling or sharing of your data. We keep no IP address for tracking purposes. Only your browser's local storage is used (game identifier, nickname, sound and key settings).

The magic link

When you request a sign-in link, only its SHA-256 hash is stored on the server: a database leak would not let anyone sign in as you. The link is valid for 30 minutes and can be used only once.

Hosting and processors

The game servers are hosted by OVH SAS (Roubaix, France, European Union). Sign-in e-mails are delivered through OVH's mail service. No data is transferred outside the European Union.

Retention

The game identifier and its statistics are kept for as long as the game is used. A player account (e-mail address) is kept until you ask for its deletion. Expired magic links are purged automatically.

Your rights

Under the GDPR you have the right to access, rectify, erase and port your data, and to object to its processing. In practice:

• Without an account: clearing your browser data deletes your game identifier.
• With an account: write to mollenthiel@gmail.com from the address concerned and the account and its data will be deleted.

You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

Children

The game is suitable for all audiences and is played without any personal data. In France, linking an e-mail address to an account requires being 15 or older; below that age, a parent or guardian must agree. We do not knowingly collect a younger child's e-mail address, and we delete on request any address reported to us.

Playing on a third-party portal

Battle of Castles can also be played on game portals (CrazyGames, itch.io…). When you play there, the portal applies its own privacy policy to whatever belongs to its site (audience measurement, possible advertising, portal account). This policy only covers what the game itself processes.

This policy will be updated if third-party services (advertising, external analytics, social sign-in) are added: a consent banner will then appear before any collection.