Privacy Policy

Last Updated: 26 October 2026

This Privacy Policy explains what personal data Kleopolis (the game and website at kleopolis.io, the "Service") collects, why, who receives it, and what rights you have. It applies to everyone who visits the website or plays the game.

1. Who We Are

The data controller is:

Iceware OÜ (registry code 16916913)
Müürivahe tn 31-16, 10140 Tallinn, Estonia
Email: admin@kleopolis.io

Send any question or request about your personal data to that email address.

2. What We Collect

2.1 If you play without an account

Connection data. Your IP address and browser details reach our servers with every request. The game server uses the IP address in memory to limit abuse (for example, too many connections). It does not store it in our database.
Gameplay data. The name you play under, your moves, and the result of each match. Other players in the match see your name and moves.
Settings on your device. The game keeps your settings (for example, language and display options) in your browser's local storage. This data stays on your device. We do not receive it.

2.2 If you sign in with Google

Account data from Google. Your Google account id, email address, name, and profile picture. Google sends these to us when you sign in.
Account records. A public player id, the date you joined, your sign-in sessions, and the lobbies you host.
Match history and statistics. For each match: the map, mode, date, duration, your placement, and in-game statistics such as territory, buildings, and attacks.

2.3 Usage analytics

We use PostHog (EU Cloud) to count visits and see how the Service is used: pages viewed, buttons clicked, the referring website, browser and device type, and approximate location (country or city). PostHog runs in cookieless mode: it stores nothing on your device. It counts unique visitors with a hash that it computes on its servers and changes every day, so it cannot follow you from one day to the next. We do not link analytics data to your account, email, or name.

3. Cookies and Local Storage

We use only cookies that the Service needs to work. We do not use advertising or analytics cookies, so we do not ask for cookie consent.

Name	Purpose	Duration
landwar_session	Keeps you signed in	30 days, or until you sign out
landwar_oauth_state, landwar_oauth_verifier, landwar_oauth_return	Protect the Google sign-in against forgery and return you to the page you came from	A few minutes, during sign-in
Local storage	Your game settings, kept on your device	Until you clear your browser data

4. Why We Use Your Data and Our Legal Bases

Purpose	Data	Legal basis (GDPR)
Run matches, lobbies, and your account	Connection, gameplay, account data	Contract (Art. 6(1)(b)): we need it to provide the Service you asked for
Show public profiles, match history, and leaderboards	Name, profile picture, public id, statistics	Contract (Art. 6(1)(b)): rankings are part of the game
Prevent abuse and keep the Service secure	IP address, connection data, server logs	Legitimate interests (Art. 6(1)(f)): a safe, working Service
Understand usage and improve the game	Cookieless analytics data	Legitimate interests (Art. 6(1)(f)): we learn what to improve with a method that stores nothing on your device
Answer your emails and requests	Your email and what you write to us	Legitimate interests (Art. 6(1)(f)), or a legal obligation

You can object to processing based on legitimate interests at any time (see Section 8). We do not sell your data, show ads, or make decisions about you by automated means that have legal or similar effects.

5. What Is Public

If you sign in, your profile page, match history, and leaderboard entries are public. They show your name and profile picture from Google, your public player id, the date you joined, and your statistics. They never show your email address. In a match, other players see the name you play under.

6. Who Receives Your Data

Recipient	Role	Location
Google Cloud (Google Cloud EMEA Ltd and Google LLC)	Hosting: servers, database, and logs (processor)	EU, region europe-north1 (Finland)
PostHog Inc.	Cookieless usage analytics (processor)	EU Cloud (Germany)
Google (Google Ireland Ltd and Google LLC)	Google sign-in, if you choose it. Google is a separate controller under its own privacy policy.	EU and US

We may also disclose data when the law requires it, or to protect the rights and safety of players and the Service. If Iceware OÜ sells or transfers the Service, the data moves to the new owner under this policy.

7. Transfers Outside the EU

We keep data in the EU. Google LLC and PostHog Inc. are US companies, and their US staff or sub-processors may access data in some cases. Such transfers rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

8. How Long We Keep Data

Account data: until you delete your account.
Match history and statistics: while your account exists. When you delete your account, we remove your name and picture from past matches, and keep only anonymous results.
Sign-in sessions: until they expire (30 days) or you sign out.
Server logs: up to 30 days.
Analytics events: up to 1 year.
Emails to us: as long as needed to handle your request.

9. Your Rights

Under the GDPR, you have the right to:

get a copy of your personal data (access);
correct data that is wrong (rectification);
have your data and account deleted (erasure);
limit how we use your data (restriction);
get your data in a portable format (portability);
object to processing based on legitimate interests, including analytics.

To use these rights, or to delete your account, email admin@kleopolis.io from the address linked to your account. We answer within one month.

You can also complain to a data protection authority. In Estonia, this is the Andmekaitse Inspektsioon (Data Protection Inspectorate), www.aki.ee. You can also contact the authority in the EU country where you live or work.

10. Children

You must be at least 13 years old to create an account. If you are under the age of digital consent in your country (13 to 16, depending on the country), a parent or guardian must agree before you sign in. If you believe a child gave us personal data without that consent, email us and we will delete it.

11. Security

All traffic uses HTTPS. The database accepts only encrypted, authenticated connections, and only the operator has access to the servers. No system is perfectly secure. If a breach puts your data at risk, we will inform you and the authority as the law requires.

12. Changes to This Policy

We may change this policy. The date at the top shows the latest version. If a change is significant, we will announce it in the Service before it takes effect.

Origin of This Software

Kleopolis is a fork of OpenFront. OpenFront code is copyright © OpenFront and Contributors and is licensed under the GNU Affero General Public License v3.0. See NOTICE.md and LICENSE in the Kleopolis source.