Privacy

Who runs the game

Guilds & Blades is an independent project run from Lithuania. Write to privacy@guildsandblades.com about anything on this page.

We keep only what the game needs to run, and we sell nothing to anyone.

Your account

• Play starts you on a guest account with no e-mail. A guest account you don't keep is deleted a week after it was made, with everything in it.
• Keeping it, or signing up, adds your e-mail address and a password. The password is stored hashed; we never see it.
• Your display name is public: every player can see it. So are whether you are an admin and when you were last seen.

What you do in the game

Your cities, armies, treasury, research and reports are stored so the world can run while you are away.

• Other players see what the game shows them: your name, your cities and armies on the map where they can see them, your guild, the score tables.
• Messages you send are read by you and the player you send them to. Guild threads are read by your guild.
• The game's admin can read the database, to fix faults and enforce the rules.

How we measure the game

To see whether new players find their feet, the game writes a few records about your account. Only the admin can read them.

• Milestones: when you started, founded a city, kept your account, came back the next day.
• Which days you played, and which screens you open.
• Where your first visit came from: the campaign tags in the link, the referring page and the page you landed on. A link's referral code is kept with your account.

Cookies

• Sign-in cookies keep you signed in. Without them nothing works.
• gb_src holds where your first visit came from (the campaign tags, the referrer, the landing page). It lasts thirty days and is copied to your account if you keep it.

That is all. No advertising cookies, no third-party trackers, no analytics script in your browser.

Notifications

If you turn on notifications, your browser gives the game an address to send them to. It is kept until you turn them off or it stops working, and deleted with your account.

Who else handles your data

• Supabase — the database and sign-in, in the EU (Ireland).
• Vercel — hosting; the game runs in Dublin.
• Brevo — sends the sign-up confirmation and password reset e-mails.
• Sentry — error reports, in its EU region: what broke, the page, your browser and its IP address. Errors only — it does not record your screen.
• PostHog — product analytics in its EU cloud, used only when it is switched on. The game sends it the milestones above from its own server, under your account's id. Nothing runs in your browser.

How long we keep it

• An unkept guest account: a week.
• The gb_src cookie: thirty days.
• A kept account and everything tied to it: until you ask us to delete it. Deleting an account deletes its game data, its records and its notification addresses.
• Error reports and analytics follow Sentry's and PostHog's own retention; we have set no shorter limit.

Your rights

Under the GDPR you may ask for a copy of your data, have it corrected or deleted, and object to how it is used. Write to privacy@guildsandblades.com from your account's e-mail; we answer within a month. You may also complain to the data-protection authority where you live.

The rules of play are in the Terms.