Informativa sulla privacy

1. Controller and Scope

1.1. This Privacy Policy describes how Skagry, the operator of the Skagry Universe game (the “Operator”), collects, uses, discloses and protects the personal data of Users in connection with the Service.

1.2. The Operator is the controller of such personal data. All questions and requests concerning personal data may be sent to info@skagry.com. The legal particulars of the Operator are published at https://skagry.com/legal/imprint (si apre in una nuova scheda).

1.3. Capitalized terms not defined in this Privacy Policy, including “Applicable Law”, have the meanings given to them in the Terms of Service. “GDPR” means Regulation (EU) 2016/679 (General Data Protection Regulation). Where the GDPR applies to the processing of the User’s personal data, the User has the rights set out in section 10.

2. Categories of Personal Data

2.1. Account data: user name and, for an Account created with an email address or through Google, the email address and, for an Account created with an email address, the password. The password is stored exclusively as a salted cryptographic hash and never in readable form. The Operator also records the date of creation of the Account and the version of the Terms of Service accepted by the User, together with a fingerprint of its text and the time of acceptance.

2.2. Google sign-in data: where the User signs in with Google, the Operator receives from Google, exclusively through the “openid”, “email” and “profile” scopes, the Google account identifier, the email address and its verification status, and the name and profile picture of the User. Section 4 sets out how such data is used.

2.3. Steam sign-in data: where the User launches the game from Steam, the Operator receives from Valve, through the Steam Web API, the identifier of the User’s Steam account (SteamID) that confirms the sign-in, and stores it in the Account to link the Steam sign-in to it. When an Account is created this way, the Steam persona name is used once to suggest a user name and is not stored. The Operator receives no email address, password or payment data from Steam for signing in.

2.4. Profile settings: language, region, time zone, date and number formats and, where provided by the User, the date of birth.

2.5. Game data: the User’s progress, activity and interactions in the game, including alliance membership and roles and participation in in-game elections, together with the times of such events.

2.6. Communications and User Content: messages sent in chat channels and alliances, alliance applications and invitations, alliance names and descriptions, uploaded images, reports concerning other Users and their messages, each stored together with the reported message and the messages that preceded it in the same channel, and the list of Users the User has blocked.

2.7. Transaction data: records of transactions made within the Service, including Purchases, the Virtual Items credited, refunds and chargebacks, and the payment notifications received from Payment Providers. Such notifications contain transaction identifiers, amounts and statuses and may contain limited details such as the User’s country, the type of payment method or the email address provided to the Payment Provider. The Operator does not receive or store full payment card numbers or security codes, which are processed exclusively by the Payment Providers.

2.8. Technical data: IP address, browser and device information, preferred language, and the logs generated by the Operator’s servers when processing requests and errors.

2.9. Correspondence: messages sent by the User to the Operator and the Operator’s replies.

2.10. Audience measurement data: for each page opened, the address of that page, the address of the page from which the User arrived, the country and approximate region, the type of device, the browser and the operating system, the size of the browser window and the language of the browser. The country and the region are determined on the Operator’s own server, from a local database and from the IP address of the request, which is not stored with such data. The page views of one visit are grouped by an identifier that the measurement derives from the request and from a secret of the Operator which is replaced periodically; that identifier belongs to the one website being measured, cannot be reproduced once the secret has been replaced, and is not linked to an Account.

2.11. The Operator does not use advertising trackers, does not create advertising profiles, does not follow Users from one website to another and does not knowingly collect special categories of personal data. The audience measurement described in clause 2.10 runs on the Operator’s own servers, sets no cookie and stores nothing on the User’s device.

3. Purposes and Legal Bases of Processing

3.1. Performance of the contract (Article 6(1)(b) GDPR): registering and administering the Account, signing the User in, operating the game and displaying the User’s user name, game activity and User Content to other Users, crediting Purchases, providing support and sending service communications concerning the Account and the Service.

3.2. Legitimate interests of the Operator (Article 6(1)(f) GDPR): ensuring the security of the Service and of Accounts; detecting and preventing cheating, fraud, chargeback abuse and other breaches of the Terms of Service; moderating communications in the Service, including reviewing reports and automatically masking objectionable words; keeping a record of the User’s acceptance of the Terms of Service; maintaining server logs; correcting errors and improving the Service; and establishing, exercising or defending legal claims. The User may object to such processing in accordance with section 10.

3.3. Compliance with legal obligations (Article 6(1)(c) GDPR): retaining transaction, tax and accounting records for the periods required under Applicable Law and responding to lawful requests of public authorities.

3.4. Consent (Article 6(1)(a) GDPR), where requested. Optional profile data, such as the date of birth, is processed solely because the User chooses to provide it and may be removed by the User in the Account settings at any time. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

3.5. The Operator does not take decisions based solely on automated processing which produce legal effects concerning the User or similarly significantly affect the User.

3.6. Legitimate interests of the Operator (Article 6(1)(f) GDPR): measuring the audience of the website, of the sandbox and of the game, in order to know which pages are opened, where Users arrive from and on which devices the Service is used, and to size and improve the Service accordingly. The measurement produces statistics and no profile of any User, and the User may object to it in accordance with section 10.

4. Google User Data

4.1. Where the User elects to sign in with Google, the Operator requests only the “openid”, “email” and “profile” scopes, through which it accesses the Google account identifier, the email address and its verification status, and the name and profile picture of the User. The Operator does not request access to any other Google data, such as contacts, files, calendars or Gmail.

4.2. Such data is used exclusively to create the Account and to sign the User in. The Google account identifier links the Google sign-in to the Account, and the email address is stored in the Account as its contact address. Upon registration, the name is used once to suggest a user name and is not stored. The profile picture is neither stored nor used.

4.3. The Operator does not sell Google user data; does not use it for advertising, retargeting or profiling; does not use it to train artificial intelligence or machine learning models; and does not transfer it to any third party except as necessary to provide the Service (the Operator’s hosting provider), to comply with Applicable Law, or in connection with a merger, acquisition or sale of assets with notice to the User. No person acting on behalf of the Operator reads such data except with the User’s consent, for security purposes or to comply with Applicable Law.

4.4. Skagry’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The policy is available at https://developers.google.com/terms/api-services-user-data-policy (si apre in una nuova scheda)

4.5. The User may disconnect Skagry from the Google account at any time at https://myaccount.google.com/permissions (si apre in una nuova scheda). Disconnection prevents further sign-in with Google but does not delete the Account. The Account, together with the Google data stored in it, is deleted in the Account settings in accordance with clause 10.3, as described at https://skagry.com/legal/account-deletion (si apre in una nuova scheda).

5. Recipients of Personal Data

5.1. The Operator does not sell or rent personal data and does not disclose it for advertising purposes.

5.2. Other Users can see the User’s user name and the information that the game displays about the User, including alliance membership, position and activity in the game, and messages sent in channels and alliances.

5.3. The Operator engages service providers that process personal data on its behalf under contracts obliging them to protect the data and to process it only on the Operator’s documented instructions:

(a) Fly.io: hosting of servers and databases in the European Union (Paris region);

(b) Tigris: storage of uploaded images and files;

(c) Google: Google Identity Services, where the User signs in with Google, and Valve: the Steam Web API, which confirms the sign-in where the User launches the game from Steam;

(d) Payment Providers: Xsolla, Stripe and CoinGate and, for versions distributed through a Platform, Steam (Valve) and Google Play. A Payment Provider acting as merchant of record is an independent controller of the payment data it collects, in accordance with its own privacy policy.

(e) Vercel: hosting of the sandbox at sandbox.skagry.com and the audience measurement of that sandbox alone;

5.4. The footer of the website links to the game’s channel on YouTube and to a profile on GitHub. The website loads no content from those services and the Operator passes no personal data to them; where the User follows a link, the operator of the linked site processes the User’s data as an independent controller in accordance with its own privacy policy.

5.5. The Operator may disclose personal data and take action in respect of an Account in compliance with a lawful request, order or judicial decision of a competent authority of the relevant jurisdiction. The Operator may also disclose personal data where required under Applicable Law; to protect the rights, property or safety of Users, the Operator or others; to investigate fraud or abuse; or to a successor in the event of a merger, acquisition or transfer of the Service, which shall remain bound by this Privacy Policy.

5.6. The audience measurement described in clause 2.10 is carried out by software that the Operator runs itself, on the Operator’s own servers, and what it records is kept in the Operator’s own database: no analytics provider and no other third party receives that data, and it is not combined with data from any other source. The sandbox is measured a second time by Vercel, which hosts it (clause 5.3(e)): that measurement records the pages opened, the page a visitor arrived from, the country and the type of device, sets no cookie and covers the sandbox alone.

6. International Transfers

6.1. The Operator’s servers and databases are located in the European Union. Certain service providers, including Fly.io, Tigris, Vercel, Google, Stripe, Xsolla and Valve, are established in, or may access data from, countries outside the European Economic Area, including the United States. Any transfer of personal data outside the European Economic Area is based on an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for certified recipients, or on the Standard Contractual Clauses adopted by the European Commission, supplemented by additional safeguards where necessary. A copy of the applicable safeguards may be requested from the Operator.

7. Retention

7.1. Account, profile, game and User Content data are retained for as long as the Account exists. Following deletion of the Account, such data is deleted or anonymized within thirty (30) days, save as provided below. Copies held in backups are erased as the backups are replaced in the ordinary course.

7.2. Transaction, tax and accounting records are retained for the periods required under Applicable Law, which typically range from six (6) to ten (10) years.

7.3. Records of acceptance of the Terms of Service and data relating to suspensions for cheating or fraud are retained for as long as necessary to defend legal claims and to prevent suspended Users from registering again, and in any event no longer than the applicable limitation periods. A record of acceptance contains the version of the Terms of Service accepted, a fingerprint of its text and the time of acceptance and, after the deletion of the Account, identifies the Account only by an internal identifier that no longer leads to the User.

7.4. Server logs containing IP addresses are retained for up to ninety (90) days, unless a specific log is required for longer to investigate a security incident or abuse.

7.5. Correspondence with the Operator is retained for as long as necessary to handle the request and for up to three (3) years thereafter.

7.6. A report and the messages stored with it are retained for as long as necessary to review the report and to apply any measure taken on it, subject to clause 7.1.

7.7. Audience measurement data carries no identifier that leads to an Account, and the identifier by which the page views of one visit are grouped stops being reproducible once the secret it is derived from has been replaced. Such data is retained for as long as the Operator measures the audience of the Service; the deletion of an Account does not affect it, because it cannot be attributed to that Account.

8. Security

8.1. The Operator protects personal data by appropriate technical and organizational measures, including encrypted connections (HTTPS), password hashing, sign-in cookies inaccessible to page scripts, access controls and restricted administrative access. No system is entirely secure, and the Operator does not warrant absolute security. Where a personal data breach is likely to result in a high risk to the rights of the User, the Operator will notify the User and the competent supervisory authority as required under Applicable Law.

9. Children

9.1. The Service is not directed at children under the age of sixteen (16). A person below that age or, where different, below the age of digital consent in the person’s country of habitual residence may use the Service only with the consent of a parent or legal guardian, as provided in the Terms of Service. The Operator does not knowingly collect personal data of children below that age without such consent and, upon becoming aware of any such collection, will delete the data and close the Account. A parent or legal guardian who believes that a child has provided personal data to the Operator may contact the Operator at info@skagry.com.

10. Rights of the User

10.1. Subject to the conditions laid down in the GDPR, the User has the right to:

(a) access the personal data concerning the User and obtain a copy of it;

(b) obtain the rectification of inaccurate data, much of which the User may also amend directly in the Account settings;

(c) obtain the erasure of personal data;

(d) obtain the restriction of processing;

(e) receive the personal data provided to the Operator in a structured, commonly used and machine-readable format and transmit it to another controller (data portability);

(f) object at any time to processing based on the legitimate interests of the Operator;

(g) withdraw consent at any time, where processing is based on consent.

10.2. Requests to exercise these rights, other than the deletion of the Account under clause 10.3, may be sent to info@skagry.com from the email address associated with the Account or stating the user name. The Operator may request information necessary to verify the identity of the requester. The Operator responds within one (1) month; this period may be extended by two (2) further months for complex or numerous requests, in which case the User will be informed. Requests are free of charge unless they are manifestly unfounded or excessive.

10.3. The User may delete the Account at any time in the Account settings, in the game or on the website, after confirming the deletion by typing the user name; a User who cannot sign in may request the deletion in the manner described in clause 10.2. The deletion takes effect immediately: the Account, the email address, the password, the links to Google and Steam, the profile settings and description, the uploaded picture and every signed-in session are deleted, and the user name is replaced, wherever other Users see it, by an anonymous call sign under which the User’s commander remains in the game world without any link to the User. Data that must be retained under section 7 is kept. The deletion is irreversible, and game progress and all Virtual Items are permanently lost. Deleting the Account does not cancel a subscription purchased through an app store or a Payment Provider; the User cancels it there. The procedure is described at https://skagry.com/legal/account-deletion (si apre in una nuova scheda).

10.4. The User has the right to lodge a complaint with a supervisory authority, in particular the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), https://www.aepd.es (si apre in una nuova scheda), or the supervisory authority of the User’s place of habitual residence or place of work.

11. Amendments

11.1. The Operator may amend this Privacy Policy. The version number and date displayed at the top of this page indicate the most recent amendment. Users will be notified of material amendments in advance through the Service or by email.

12. Contact and Effective Date

12.1. Questions and requests concerning this Privacy Policy or the processing of personal data may be sent to info@skagry.com.

12.2. This Privacy Policy is effective as of 2 October 2026.