Privacy Notice
Draft revision: November 5, 2026 · English version · Applies to proposed v22 beta
1. Operator and contacts
Country Forge is operated by [LEGAL OPERATOR NAME], located in [OPERATOR COUNTRY / BUSINESS ADDRESS OR APPROPRIATE CONTACT DETAILS]. Privacy contact: [PRIVACY EMAIL]. Complete these details before launch. This English draft is not a substitute for jurisdiction-specific advice.
2. Information you provide
Online accounts use an email address, display name and username. If Google sign-in is configured, we receive a verified email, a Google account identifier and basic display name from Google. We store profile and avatar choices, friends and invitations, game records and rankings, referral codes/status, coin balances, owned digital items, membership status, and payment-provider transaction references. We do not ask for or store card numbers in the game server.
3. Automatic and technical information
The server receives connection addresses and request metadata to process traffic, secure sign-ins, rate-limit email requests and investigate abuse. Your browser stores a session token and local preferences such as language, game settings, and a cookie notice acknowledgement. Basic technical server logs may be produced by hosting providers. Browser-side audio and visual preferences may be retained locally.
4. Why we use information
We use account data to authenticate users, run multiplayer and friends features, calculate rankings, award referral rewards, fulfill purchases, prevent cheating and fraud, provide support, and handle deletion/consumer-rights requests. We use email to send requested sign-in or deletion verification codes, not to send marketing emails by default.
5. Legal bases and international users
Where laws such as GDPR apply, the relevant legal bases may include performance of a contract (account/play/purchases), legitimate interests (security and abuse prevention), legal obligations (financial recordkeeping), and consent when legally required for optional uses. [OPERATOR MUST CONFIRM GDPR RESPONSIBILITIES, INTERNATIONAL TRANSFERS, AND LOCAL REPRESENTATIVE REQUIREMENTS BEFORE MARKETING IN COVERED REGIONS].
6. Service providers and sharing
Depending on configuration, we use a hosting provider, Resend for transactional emails, Google Identity Services for optional login, and Stripe/PayPal for payment processing. Those providers process information under their terms and privacy notices. Other players may see your display name, avatar, friends status and game results. We do not currently operate a behavioral advertising network or sell account information to advertisers.
7. Cookies, local storage and external services
Essential local storage is used to retain session and game preferences. Country Forge does not currently integrate optional analytics, advertising pixels or tracking cookies. Google, Stripe or PayPal may use their own cookies or comparable technology when their sign-in or payment services are loaded. Read the Cookie Notice for details.
8. Retention
Gameplay profiles are retained while accounts remain active unless the operator deletes them or applicable law requires otherwise. Some account-unlinked transaction references may be retained for accounting, tax, fraud or chargeback requirements. Server backups and processor records may persist beyond deletion under documented retention processes once production hosting is configured. Do not state a fixed backup-deletion time until one is established.
9. Security
The current implementation uses email one-time codes, server-side session tokens, rate limits, and limited server-side payment validation. These are not guarantees of complete security. Before a high-volume paid launch, the operator should implement a transactional database, backup procedures, stronger session controls, monitoring, and a production security review.
10. Your choices and rights
Within Profile, you can request an export of gameplay account data and permanently delete your account after email verification. You may contact [PRIVACY EMAIL] to request access, correction, deletion, objection or other rights where your law provides them. You can unsubscribe from any optional marketing separately, if such marketing is later added. You may contact your regulator where your law permits.
11. Children
Online registration is not intended for children under 13; users in some countries may require a higher minimum age or parental permissions. If we discover that we improperly collected a child’s information, contact [PRIVACY EMAIL] so the account can be reviewed and deleted as appropriate.
12. AI and policy changes
Current gameplay uses programmed scores, probability and animation rather than generative AI. We do not currently send player account content to a generative AI service for gameplay. Read the AI Use Notice. Material changes to data practices will require an updated notice and any legally required consent.