Medieval Industry

Privacy policy

Version of 30 October 2026.

This English version is a translation provided for convenience. In the event of a discrepancy, the French version prevails.

1 · Data controller

Studio "Fabius", independent developer · sole trader (entrepreneur individuel)
Contact: support@medieval-industry.online

2 · Data processed and purposes

• Account: username, e-mail address, password hash (the password itself is never stored), creation date. Purpose: to identify you and secure your account. Legal basis: performance of the contract (the game's terms of use).
• Google or Facebook sign-in: if you choose this method, we receive from that service your account identifier, your confirmed e-mail address and your first name (suggested as a username). We receive neither your password, nor your contacts, nor your posts, and we publish nothing on your behalf.
• Game: village, resources, armies, chat messages, guild, statistics. Purpose: to run the multiplayer game.
• Vassalage: if you sign up through another player's link, we record this link between your two accounts. Your liege and your vassals are visible on your player profile. Purpose: to place your village near theirs and grant the planned protection.
• Wars and battle reports: usernames, guilds and losses of both sides. Declared wars are public. A battle report can be read by anyone who has its link; each player chooses whether to share it.
• Discord: if you link your account, your Discord identifier, to assign your roles on the game's Discord server.
• Security: IP address at the time of connections, kept in memory for only a few minutes to limit abuse (bursts of sign-in attempts, mass account creation), and in the server's technical logs for at most 30 days. Legal basis: legitimate interest (protecting accounts and the service).
• Purchases: items purchased, amounts, dates and consents given before payment (see the Terms of sale). Payment is processed by Stripe; we never see card numbers. Legal basis: performance of the contract and accounting obligations.
• E-mails: address confirmation, new password, order and cancellation confirmations. No advertising e-mails.

3 · Recipients and processors

• Server hosting: Amazon Web Services EMEA SARL (AWS), 38 avenue John F. Kennedy, L-1855 Luxembourg. The game servers are located in the European Union (Stockholm region).
• E-mail sending: Resend (Resend, Inc., United States).
• Payments: Stripe (Stripe Payments Europe, Ltd., Ireland).
• Sign-in, if you choose it: Google (Google Ireland Limited) or Facebook (Meta Platforms Ireland Limited).
• War announcements and roles, if the game's Discord server is connected: Discord (Discord, Inc., United States).
• Fonts: Google Fonts (your browser downloads them from Google).

Transfers outside the European Union are governed by the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

4 · Retention periods

• Account and game: as long as the account exists, then deletion within 30 days of your request. An account never confirmed by e-mail is deleted after 30 days.
• Sign-in sessions: 30 days.
• Links sent by e-mail: 48 hours (confirmation) or 1 hour (password).
• Battle reports: the latest 2,000 of the current game. Wars: for the duration of the current game.
• Accounting documents for purchases: 10 years (legal obligation).

5 · Cookies and local storage

The game sets no advertising or audience measurement cookies. It keeps in your browser (local storage) your session token, your language, your graphics and sound settings, and the invitation link you arrived through until you sign up. During a Google or Facebook sign-in, a 10-minute technical cookie protects the connection against forgery. These elements are strictly necessary: they do not require consent.

6 · Your rights and deleting your data

You have a right of access, rectification, erasure, restriction, objection and portability of your data.

To delete your account and your data (including an account opened with Google or Facebook): write to support@medieval-industry.online from your account's e-mail address, stating your username. Deletion is carried out within 30 days; only the accounting documents for purchases are kept, for the period required by law. You can also remove the game's access from the settings of your Google or Facebook account.

You can lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

7 · Security

Hashed passwords (scrypt), session tokens stored as hashes, encrypted connection (HTTPS), limits on sign-in attempts and temporary locking after several failures.