This is a translation for your convenience. Only the German version is legally binding.
Privacy Policy
1. Controller
Harold Pinther, c/o POSTFLEX PFX-654-704, Emsdettener Straße 10, 48268 Greven, Germany
Email: [email protected]
2. Principle
We only process the data needed to run Frontline Sectors. There is no advertising, no tracking or analytics services and no social media plugins. Fonts and graphics are delivered by our own server. The exceptions are Cloudflare's bot check during login and registration (see section 4) and the checkout at Stripe when you book premium (see section 13).
3. Hosting and server logs
The game, database and login run on our own server at netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany (data processing on our behalf under Art. 28 GDPR). When you visit a page, the server technically processes your IP address, the time, the address requested and the browser identifier in order to deliver the page, ward off abuse and find errors. The legal basis is Art. 6 (1) (f) GDPR (secure operation). We do not analyse these technical logs and do not pass them on.
We back up the database every night. The backups are stored encrypted at Cloudflare R2 (see section 4) and are deleted automatically after 90 days at the latest. Cloudflare cannot read them without our key.
4. Cloudflare
Our pages run via the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare forwards requests to our server, protects it against attacks and overload, and in doing so processes your IP address and technical data of the request. During login and registration, Cloudflare Turnstile checks whether a human or a program is using the page. For this your browser loads a script from Cloudflare and transmits technical characteristics of the browser. The legal basis is Art. 6 (1) (f) GDPR (protection against attacks and automated registrations).
Cloudflare is our processor. A transfer to the USA is possible. Cloudflare is certified under the EU-US Data Privacy Framework; the EU standard contractual clauses also apply.
5. Game account
For registration we store your email address, your password, the password only as a hash, and the language in which you registered, so that we can send you confirmation and password emails in that language. So we do not know your password. We delete unconfirmed accounts after 7 days.
When you register, we also store the country you register from (Cloudflare determines it from your IP address; we do not store the IP for this) and how you found us: the tag in the link you used or the page you came from. This shows us which advertising works. No cookies and no tracking services are used for this. The legal basis is Art. 6 (1) (f) GDPR (effectiveness of our advertising). We delete the entry together with your account.
For every server you play on, we store your player name, your region and your game data: buildings, units, research, resources, missions, battle and spy reports, trading, bank, messages, union membership, profile text and settings. The legal basis is Art. 6 (1) (b) GDPR (contract of use).
Other players see your player name, your coordinates, your points and your rank, your union, your profile text and whether you are currently online. Optionally, you can add a real name for your union in your profile. Only the members of your union see it, in the member list. You can change or delete it at any time.
Profile and union images. You can voluntarily upload a profile picture, and your union's leadership a union image. We crop the image to 256 × 256 pixels and save it anew as a WebP file on our server. In doing so we remove all embedded additional data (for example camera data and location). We do not pass the image on to any external service. All players can see it, also via the image's address. If someone reports an image, we store who reported it and why, so the team can decide. If you replace or remove the image, delete your character or the union is dissolved, we delete it immediately, together with the reports. The legal basis is Art. 6(1)(b) GDPR (the feature you requested). Please do not upload photos of other people.
6. Protection against multiple accounts and abuse
One account per server is allowed per person (Game Rules §6). During registration, login and while you play, we store your IP address with the time, the type of event and the browser identifier. We also classify the IP address, for example as a data centre, VPN, Tor or proxy, and store the country it comes from (as provided by Cloudflare). For this we compare it with public lists. Only the team sees whether several accounts share an IP address or log in shortly after one another.
The result is only an indication. A ban is never automatic but only follows after a review by a person (no automated decision within the meaning of Art. 22 GDPR). The legal basis is Art. 6 (1) (f) GDPR (fair play and prevention of abuse).
We delete these entries after 30 days. If a review for multiple accounts is in progress, the entries of the accounts concerned are kept until the review is completed.
In addition, we store your game actions (for example building, attacking, trading, sending messages) with the time and brief details, but without the IP address. They help with support requests and disputes and are deleted after 7 days. The legal basis is Art. 6 (1) (f) GDPR.
To protect against scripts, bots and AI agents (Game Rules §11), we also record a few technical features of your browser with each game action: whether the click came from a real input or was triggered by a program, whether the browser reports itself as remote-controlled, whether the tab was visible, how much time passed since your last input and whether the mouse was moved before a mouse click. We do not record keystrokes, texts or mouse trails, only these brief details. They are stored together with the game action and deleted after 7 days. If they lead to a suspicion, the system automatically creates an internal note for the team. Here too, a person always decides, a ban is never automatic. The legal basis is Art. 6 (1) (f) GDPR (fair play and prevention of abuse).
7. Cookies and browser storage
We only set technically necessary cookies:
- login cookies so that you stay logged in
- a cookie that remembers the server you are currently playing on
- a cookie that remembers your language choice for the start page
- a cookie if you hide the newsletter notice in the game with “No thanks” (1 year)
- a cookie if you hide the notice about your unconfirmed newsletter order with “Later” (30 days)
In addition, your browser remembers your last entries in the battle simulator in local storage. This information stays on your device and is not transmitted to us. You can remove it with the “Clear inputs” button or via your browser settings.
The legal basis is § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act; technically required). No consent is needed for this. We do not set statistics, analytics or advertising cookies, which is why there is no cookie banner.
8. Emails and newsletter
If you have not confirmed your account after 24 hours, we send you the confirmation email once more. If you have confirmed your account but not joined a server after 24 hours, we send you a one-time reminder showing how to get into the game. There are no further reminders. The legal basis is Art. 6(1)(b) GDPR (providing the account you created).
You only get game reminders by email if you explicitly turn them on, either right after confirming your account, when joining a server or in your account on the start page. We then write to you, for example, if nothing has been built on your base three hours after joining, at most one email per occasion and character. For this we store the setting, the language, the wording and version of your consent, the time of the last change and which reminders a character has already received. The legal basis is Art. 6(1)(a) GDPR (consent). You can turn them off at any time via the link in every reminder or in your account. Right after confirming your account you can also subscribe to the newsletter with one click. Since the address has just been confirmed by email at that moment, no second confirmation email is needed.
We send confirmation and password emails, this reminder as well as the newsletter via Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, data processing on our behalf under Art. 28 GDPR).
You only receive the newsletter if you expressly order it and confirm the order via the link in a confirmation email (double opt-in). If you ordered the newsletter and have already confirmed your account with the same address by email, you can instead confirm the order with one click while logged in to the game. For this we store your email address, the language in which you ordered the newsletter (German, English, Spanish, French or Portuguese), the wording and version of your consent and the times of ordering, confirmation and unsubscription. You receive the newsletter in this language. The legal basis is Art. 6 (1) (a) GDPR (consent). We delete unconfirmed orders after 30 days. You can unsubscribe at any time via the link in every newsletter email or in your account. We keep the proof of consent and unsubscription for as long as your account exists. We do not analyse whether you open an email or which links you click.
Push notifications to your device. You can choose to turn on push notifications in your profile, for example for new messages, finished orders or (with Premium) attacks. Your browser asks for permission once. We then store your device's push address with two technical keys and the browser identifier with your account. We send the notifications through your browser's push service (for example Google, Apple or Mozilla). It only receives the encrypted notification and the push address, not your email address. A transfer to the USA is possible. The legal basis is Art. 6(1)(a) GDPR (your consent). You can turn push off at any time in your profile or your browser settings, and we then delete the push address. Expired addresses are deleted automatically. So that the game can be installed as an app and receive notifications, your browser sets up a small background service (service worker). It does not store any game data.
9. Support and contact
We store support tickets in the game together with your account. The legal basis is Art. 6 (1) (b) GDPR (support within the contract of use). We delete closed tickets 1 year after closing. Images you attach to a ticket are stored on our server in reduced size and without metadata (for example without location data). Only you and the support team can see them. We delete them 30 days after the ticket is closed, and images that were never sent after 24 hours.
If you write in a language other than German, we translate ticket messages into German when needed using DeepL (DeepL SE, Maarweg 165, 50825 Cologne, Germany, data processing under Art. 28 GDPR), and our replies into your language. Only the text of the message is transmitted, no account data. The legal basis is Art. 6(1)(b) GDPR.
To keep our replies factual and consistent, the team can have a draft reply checked by an AI service before sending it: Claude by Anthropic (Anthropic PBC, San Francisco, USA, data processing under Art. 28 GDPR). Only texts are transmitted, namely the draft and the latest messages of the ticket, no email addresses and no account data. This involves a transfer of data to the USA. A human member of the team always decides whether and what is sent. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in factual replies that follow the rules).
If you send an email to [email protected], it is forwarded via Cloudflare Email Routing to the operator's mailbox at Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). A transfer to the USA is possible, which Google bases on the EU-US Data Privacy Framework and the EU standard contractual clauses. We send our replies via Brevo (see section 8). We only use your information to reply to you. The legal basis is Art. 6 (1) (f) GDPR (answering enquiries).
10. Messages and inspection by the team
We store messages to other players until you delete them or your account is deleted. To enforce the Game Rules, for example in the case of insults, fraud or multiple accounts, the team can view messages and account data (see Terms of Use, section 6). The legal basis is Art. 6 (1) (f) GDPR (fair play and protection of players).
11. Bans and violations
In the event of rule violations, we store the reason, the duration and the team's decision. The legal basis is Art. 6 (1) (f) GDPR. We delete these entries 2 years after the ban expires or is lifted. A permanent ban remains stored for as long as the account exists. We log the team's actions (for example bans, reverting battles, granting resources) for 365 days as proof.
12. Voluntary support
On some servers you can voluntarily support development via a link to PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). Only when you click the link are you taken to PayPal. PayPal's privacy policy applies there, and PayPal processes the payment under its own responsibility.
We receive the name and email address of your PayPal account, the amount and your message. We use this information to assign the payment. If you tell us your player name, we add you to the supporter list in the game. The list only shows the player name, never the amount. The legal basis for the entry is your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time by email, and we will then remove the entry. We keep payment details for as long as tax law requires (Art. 6 (1) (c) GDPR).
13. Premium and payment
Free trial. So that every account can only try premium once for free, we store that your account has used the trial, on which server and character, and when it starts and ends. The legal basis is Art. 6 (1) (b) GDPR. We delete the entry together with your account.
Payment via Stripe. If you book premium, we redirect you to Stripe for payment (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). Stripe processes your payment data (for example name, email address, payment method, billing address) as well as technical data such as IP address and device data in order to process the payment and prevent fraud. Stripe is itself responsible for fraud checks and for fulfilling its own legal obligations. Stripe's privacy policy also applies (stripe.com/privacy). A transfer to Stripe, Inc. in the USA is possible. Stripe is certified under the EU-US Data Privacy Framework, and the EU standard contractual clauses also apply.
From Stripe we receive a customer and subscription ID, the amount, date, payment status, country and type of payment method, but no complete card or account details. We store which character on which server has premium for which period. The legal basis is Art. 6 (1) (b) GDPR (premium contract). We keep invoices and accounting records for as long as tax and commercial law requires, usually 8 to 10 years (Art. 6 (1) (c) GDPR).
Telegram alerts. With premium you can be notified via Telegram when you are attacked. For this we store the Telegram ID that you enter yourself. When you are attacked, we send a message with the attacker's player name and coordinates, your coordinates and the arrival time to this ID via the Telegram bot. Telegram (Telegram Messenger Inc. or Telegram FZ-LLC, Dubai, United Arab Emirates) processes the message under its own responsibility in accordance with its privacy policy. There is no EU adequacy decision for the United Arab Emirates. The transfer takes place because you requested the alerts yourself (Art. 49 (1) (b) GDPR). The legal basis is Art. 6 (1) (b) GDPR. You can delete the ID at any time under “Premium”. We will then no longer send anything.
Other premium features. For the buddy list we store which players you have added until you remove them. For the Cloak Field, bonus ticks and the build queue we store the times and orders the game needs for them. Other players cannot see whether you have premium.
14. Social media profiles
We have our own profiles on Instagram and Facebook (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland), TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland), YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), X (Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland), Telegram (Telegram FZ-LLC, Dubai, United Arab Emirates) and Discord (Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands).
Links on our website. The links to these profiles, for example at the bottom of every page, are plain links. Your browser only connects to the platform when you click one. Before that, we do not transfer any data to them.
Visiting our profiles. When you visit our profiles, the respective operator processes your data (for example IP address, device information, your interactions and, if you are logged in, your account) under its own responsibility and privacy policy, including for advertising. A transfer to the USA or other third countries is possible. We only see what the platform shows publicly (for example profile name, comments and messages to us) and aggregated statistics that do not relate to individual persons, for example the reach of a post.
Facebook and Instagram. For the statistics of our Facebook page and Instagram profile, we are jointly responsible with Meta (Art. 26 GDPR). Meta provides an agreement for this (facebook.com/legal/terms/page_controller_addendum) in which it takes primary responsibility, including for fulfilling your rights. You can contact Meta directly for this, but also us.
Legal basis. Our presence is based on our legitimate interest in making the game known and staying in touch with players (Art. 6(1)(f) GDPR). If you write to us via one of these platforms, we only use your details to reply.
Discord link and union channels. You can voluntarily link your Discord account to your game account in your profile. You log in to Discord and allow us to retrieve your Discord ID and Discord name and to add you to our Discord server. We only store this ID and the name. If your union has a private union channel, our bot gives you your union's role on Discord, which makes the channel visible. The role name (tag, union name and game server) is visible to other members of our Discord. If you leave the union, we remove the role. If you unlink or delete your account, we delete the ID and name and remove all union roles. What you write in union channels is processed by Discord under its privacy policy. The Discord admin (the game operator) can see all channels. The legal basis is the use of the feature you requested (Art. 6(1)(b) GDPR).
15. Deleting your account
You can delete individual characters in the profile of the respective server or your entire account on the start page. Deletion takes effect immediately and permanently. We delete characters, game data, reports, received messages, support tickets, ban entries, premium data such as the buddy list and Telegram ID, and the logs of your account. A running subscription is cancelled. When deleting the entire account, we also delete your email address, your password hash, your newsletter subscription including the proof, your Discord link and the free trial entry.
Messages you sent to others remain with the recipient, without any link to your account, until the recipient deletes them. Battle and spy reports and transfers of other players that involved you remain with them. They then show “Deleted player” instead of your name, but your player name may still appear in the text of game messages. Payment details subject to statutory retention under tax law are kept until the period expires. Your data remains in encrypted backups for up to 90 days until the backup is deleted automatically.
If you can no longer log in, we will delete your account on request to [email protected].
16. No disclosure
We do not sell your data and do not pass it on to third parties. Exceptions are the service providers named in this policy and cases in which we are legally obliged to do so.
17. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Simply write to us at [email protected].
You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority at your place of residence. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
18. Obligation to provide data
An email address and password are required for an account. Participation is not possible without them. To book premium, the payment data requested by Stripe is also required.
Last updated: 2026-11-05