Privacy Policy

1. What data we process

We process the following categories of data:

• Account data: your username and, depending on how you sign up, a password (stored hashed) or an identifier from your Discord or Google account. We do not store your email address; if you sign up with Google, your email is only used to generate an initial username.
• Technical and security data: your IP address, your browser/device (user-agent), and session and activity data (for example, login times and IP changes). We use these to keep your account secure and to detect bots, automation, and the use of multiple or shared accounts.
• Game data: your crew, your in-game actions, the chat messages you send, and, if you donate, a record of the donation (amount and order reference; we do not store card details).

2. Why we use your data and legal basis

We process your data for the following purposes, each with its legal basis under the GDPR and equivalent laws:

• To provide the Game and manage your account — performance of a contract (the Terms of Service).
• Security, fraud prevention, and detection of bots, automation, and multiple or shared accounts — legitimate interest (GDPR Recitals 47 and 49). For this we process your IP, user-agent, and activity data. You may object to this processing (see "Your rights"), though we may need it to protect the game from cheating.
• Content and conduct moderation (reports, sanctions) — legitimate interest in keeping a fair, safe environment.
• Processing donations — performance of a contract and compliance with legal/accounting obligations.

3. How long we keep your data

• Account and game data: for as long as your account is active.
• Login and IP-change records (security): 90 days.
• Revoked or expired sessions: deleted after 24 hours; an active session keeps its IP until it expires (at most 7 days) or you log out.
• Cached security-activity data: expires automatically within 14 days.

4. Who can access your data

Access to personal data (including IP) is restricted to the Game administrators, who consult it solely for moderation and security. We do not sell your data or use it for advertising.

5. Who we share data with (sub-processors)

To run the service we rely on the following providers, which process data on our behalf:

6. International transfers

Some providers are located outside your country or the European Economic Area (for example, in the United States). When that happens, the transfer relies on recognized mechanisms such as the EU-US Data Privacy Framework or standard contractual clauses, depending on the provider.

7. Cookies

We only use strictly necessary cookies to keep you logged in (access tokens). We do not use analytics, advertising, or tracking cookies, so we do not show a cookie banner.

8. Your rights

You have the right to access, rectify, and erase your data ("right to be forgotten"), to object to its processing, to request portability, and to restrict processing. To exercise any of these rights, contact [email protected]; we will respond within 30 days at most. If you live in the EU, you may also lodge a complaint with your data protection authority.

9. Minors

The Game is not directed at people under the minimum age required by the law of your country (16 in the EU, unless your country sets a lower age). If you are under that age, you need your parent or guardian’s consent to use the Game.

10. Changes to this policy

We may update this Privacy Policy. We will publish the current version on this page and show the date of the last update above.

11. Contact

Data controller: the OP Map team. Privacy contact: [email protected].