Privacy Policy — War of Fantasia

Last updated: 15 September 2026

In force (D256). Written to standard patterns and the requirements of

the GDPR, the UK GDPR, the CCPA/CPRA and COPPA as they apply to a small

game. Not reviewed by a lawyer.

The short version: we hold as little as the Game can work with, we do not sell

it, and you can have it deleted by asking.

Who holds your data

Erik Perez, reachable at erikdanielperez@nexuscoregaming.com. For UK/EU purposes that is the

data controller.

What we hold, and why

We never see your card details. Payments go to Stripe, which handles them

under its own privacy policy. We receive only an identifier and whether the

payment succeeded.

What a recording is, and what it is not. A match here is a starting number

and the list of things you clicked, with the time you clicked them. That is all

a recording holds — there is no video, no screen capture, nothing about your

device, and nothing you typed. Replaying it reproduces the match exactly,

which is how we check that a result is real and how we work out whether a rule

is doing what we intended. Nobody is identified by it beyond the account it

belongs to, and deleting your account deletes your recordings with everything

else.

Stripe is the seller of record. Purchases and contributions are sold to you

through Stripe's Link, which means Stripe — not us — collects your billing

details, works out and pays any sales tax or VAT, sends your receipt, and

handles payment questions and disputes. Your card statement will read LINK.COM

with War of Fantasia beside it. We see the same identifier and success flag we

always did, and nothing more; everything else about the transaction is held by

Stripe under its own policy. You can manage or cancel a monthly contribution

either from the Support screen here or at link.com.

Your friends list is only ever shown to you. Nobody can search for you:

adding a friend needs your exact name, which somebody has to have been told.

You can turn friend requests off entirely, and you can appear offline to your

friends, both in Friends → Who can reach you. Blocking somebody stops all of it

at once — they cannot ask, cannot see whether you are here, and are removed

from your friends — and they are not told. Nor is anybody told when you decline

a request.

**We do not use advertising trackers, and nothing here follows you to another

website.** The Game stores a few settings in your browser (sound, session

token, chat window position) — those never leave your device except for the

session token, which authenticates you to our server.

How we count visitors

We want to know whether anybody is playing. We do it in the two least

intrusive ways we could find, and neither one involves a cookie or a profile

of you.

Traffic — Cloudflare Web Analytics. It counts page views, and records the

page you came from, your country, your browser and how fast the page loaded.

It sets no cookie, stores nothing on your device, and does not fingerprint

you or follow you to any other site. Cloudflare processes this as our

processor and does not use it to build a profile of you or to sell anything.

This is why you are not being asked to accept cookies: there are none to

accept.

What happens in the Game — our own server, and nobody else's. The Game

adds up how many times things happen — the game was opened, a match was

started, a match reached wave 10, a fighter was placed, the Store was opened —

and sends those totals to our own server every thirty seconds.

What that means in practice, because the detail is the point:

• It is counts only. The server receives a list like

{ "match.start": 1, "buy.fighter": 6 } and adds those numbers to the day's

running totals.

• There is no identifier of any kind — no account id, no session id, no

cookie, no device id — sent, generated or stored. It is sent without your

sign-in token even when you are signed in.

• The stored record has **three columns: the date, the name of the thing, and

how many times it happened.** There is no column a person could be in, so

there is nothing in it to connect to you, to us, or to anyone else.

• Only a fixed list of names can be counted, and it is in the source code.

The Game cannot report anything else, including anything you type.

• It never leaves our server, and no third party receives any of it.

The feedback box is the exception, and it is not counting

The *Send us feedback* box in Options is not part of any of the above. It is

the one place in the Game where something you wrote reaches us, so it is

treated as your data rather than as a count:

• It sends what you typed, up to 1000 characters, plus a short note of

where you were when you wrote it: the version, your language, whether you

were in the menus or in a match and at which wave, whether you are on a

phone, and the size of your window. That note exists so a bug report can be

acted on without a conversation.

• **The Game does not send your email address, your portrait, your match

history or anything else from your account.** What leaves your browser is

what you typed and the note about where you were, and nothing else.

• If you are signed in, it is attributed to you — we store your account id

with it, so we can tell one person's three reports apart and reply if you

asked us to. If you are not signed in, it is anonymous and stays that

way; the box works either way, on purpose, because the people most worth

hearing from are often the ones who never made an account.

• Your address is not stored with it. Rate limiting sees your IP in memory,

as it does everywhere else, and nothing writes it down.

• We read it, and so that we read it promptly rather than eventually, each

message is also emailed to us as it arrives. That email goes through Resend,

the same provider that sends sign-in links and the only one on the list below

that sees any of this. **If you signed in with an email address, that address

is set as the reply address on it**, so that answering you is one click

rather than a separate errand — it is not stored anywhere new, and if you

signed in with Discord or not at all there is no address to use.

• It is not published and it is not shared with anyone else.
• It goes when you go. Deleting your account deletes everything you sent

through the box, text and all — not just the link to your name. You can also

ask us to delete a single message without deleting your account.

Please do not type anything secret into it. It is a box for "the wave

counter overlaps the gold on my phone", not for passwords, card numbers or

anybody's personal details — including other people's. Anything you put in it

is held as written.

Because none of the counting above identifies anybody, there is nothing in it

to show you or to delete when you ask us to delete your account — your account going does not

change a count of how many matches were started last Tuesday, any more than

leaving a shop unrings the till.

Who we share it with

Only the services needed to run the Game:

• Stripe — payments
• Cloudflare — counting page views, without cookies (see above)
• Resend — sending sign-in emails, and passing on what you write in the

feedback box so we actually read it

• Fly.io — hosting the game server
• Netlify — serving the website
• Discord — only if you choose to sign in that way

We do not sell your data, and we do not share it for advertising. We may

disclose data if the law requires it.

Where it lives

The server and its database run on Fly.io. Data may be processed in the United

States. If you are in the UK or EU, transfers rely on the standard contractual

clauses those providers offer.

Your rights

Wherever you live, you may ask us to show you what we hold, correct it,

or delete it. Write to erikdanielperez@nexuscoregaming.com and we will act within 30 days.

You do not have to ask us to delete your account. There is a *Delete

account* button on the Profile screen in the Game. It removes your name, your

email address or Discord id, your portrait, your favourites, your balance,

every match record and everything you sent us through the feedback box,

immediately and permanently. We keep no copy and no

tombstone row; the deletion happens in the database as you press it. Aggregate

counts that identify nobody may remain. If you are a supporter, cancel your

subscription first — the button will say so, because we will not delete the

only record linking you to a payment that is still running.

In the UK/EU you also have the right to object to or restrict processing, to

data portability, and to complain to your data protection authority. Our lawful

bases are: performing our contract with you (running your account), legitimate

interests (keeping the service working and fair), and consent where you gave it.

In California, you have the right to know, delete and correct, and not to be

discriminated against for asking. We do not sell or share personal information

as those terms are defined by the CCPA/CPRA.

How long we keep things

Sign-in links expire in 15 minutes and sessions in 30 days, both automatically.

Everything else is kept while your account exists, because the point of an

account is a record that persists. Ask us to delete it and it goes.

An account that has not been signed in to for two years may be deleted along

with everything attached to it. We will email first, if we have an address.

Automated decisions

We do not make automated decisions with legal or similarly significant effects

about you. Match results are decided by the game's rules, which are the same for

everyone and which you can read in World Info.

Children

The Game is not directed at children under 13, and we do not knowingly collect

personal information from them. If you believe a child under 13 has given us

data, write to erikdanielperez@nexuscoregaming.com and we will delete it. A parent or guardian may

ask to see, correct or delete their child's data at the same address.

If you are in the UK or EU

Our lawful bases, in the language the GDPR uses:

• Contract (Art. 6(1)(b)) — running your account, your record, your matches,

and any subscription you buy

• Legitimate interests (Art. 6(1)(f)) — keeping the service working, secure

and fair, including rate limiting and acting on reports of abuse. We have

considered your interests and think a game that is not overrun is what you

want too

• Legal obligation (Art. 6(1)(c)) — keeping payment records for tax
• Consent — where you gave it, and you may withdraw it at any time

You may object to processing based on legitimate interests, ask us to restrict

it, ask for your data in a portable form, and complain to your supervisory

authority. We do not need an EU representative under Art. 27 as we do not

target the EU specifically; if that changes we will appoint one and name them

here.

Security

Sign-in tokens and session tokens are stored only as hashes, so a copy of our

database is not a copy of anyone's session. There are no passwords to lose.

Traffic is encrypted in transit. No system is perfect; if something goes wrong

we will say so here and by email where the law requires it.

Changes

We will post changes here and announce material ones in the Game.