Earlier version. This is the Privacy Policy as published on 2026-10-08. It applied from 2026-10-08 until 2026-10-15. Read the current version · All versions

Glorious Factions — Privacy Policy

Draft — for legal review

Last updated: [DATE]

In short: Ananta Studios runs Glorious Factions and decides how your data is used. We collect what we need to run your account and the game: your email, username and game progress, the messages you write, records of your purchases, and some security records to fight cheating and abuse. We do not use analytics, advertising, tracking cookies or third-party fonts, and we do not sell your data. Some of your game profile is visible to other players, because that is how a multiplayer game works. You can download your data or delete your account from the Account panel in the game, or by emailing us.

Related documents: Terms of Service · Purchase Terms · Game Rules · Cookie and Local Storage Notice · Legal Notice

Contents

1. Who we are
2. What this policy covers
3. The data we collect
4. What we do not collect
5. How we use your data and our legal bases
6. What other players can see
7. Computer-controlled players
8. Who we share data with
9. International transfers
10. How long we keep data
11. How we protect data
12. Your rights
13. Additional information for players in the United States
14. Automated decisions
15. Children
16. Changes to this policy
17. Contact us
18. Notes for counsel (remove before publication)

1. Who we are

1.1 Glorious Factions (the "game") is operated by Ananta Studios, a subsidiary of RLM Global ("we", "us", "our").

1.2 Ananta Studios is the controller of your personal data. This means we decide why and how it is processed, and we are responsible for it.

1.3 Representatives. Because we are based in the United States, we have appointed representatives for privacy matters:

• EU representative (GDPR Article 27): [EU REPRESENTATIVE — name, address, email]
• UK representative (UK GDPR Article 27): [UK REPRESENTATIVE — name, address, email]
• EU Digital Services Act legal representative: [DSA LEGAL REPRESENTATIVE]

You can contact a representative instead of us if you are in their region.

1.4 Data Protection Officer. [PLACEHOLDER: We have not appointed a Data Protection Officer because the law does not require one for our activities. / Our Data Protection Officer is [NAME], [EMAIL].]

2. What this policy covers

2.1 This policy covers personal data we process when you visit our website, create an account, play the game, buy premium items, use optional features, or contact support.

2.2 It does not cover third-party websites you choose to visit. Those sites have their own policies. Stripe's payment page is covered in section 8.

3. The data we collect

We collect data you give us, data created when you play, and a small amount of technical data needed for security.

3.1 Account data

• Email address.
• Password. Our authentication provider stores it only in hashed form. We cannot see your password.
• Username, display or ruler name, and alias.
• Referral code you used when signing up, if any.
• The date your account was created.
• The time you were last active. We record this when the game loads.
• Your confirmation that you are 16 or older and that you accept the Terms and this policy.

3.2 Game data

Playing the game creates records such as:

• cities, buildings, troops, resources, research and titles;
• alliances, alliance roles and alliance membership;
• marches, combat reports, trade and market activity;
• quests, daily login records and referral relationships;
• account sitting ("substitution") records, including an audit log of what a sitter did on your behalf;
• your notification preferences.

3.3 Communications

• Chat messages you send in world, alliance or private chat.
• In-game mail you send and receive.
• Alliance forum and board posts.
• Notifications the game sends you (for example attack warnings or completed builds).

Moderators can hide (soft-delete) messages and review chat history when they handle reports or enforce the Game Rules.

3.4 Purchases

When you buy Sidereals, payment happens on Stripe's checkout page. Your card details go directly to Stripe. We never receive or store your full card number.

From Stripe we receive and keep a record of the payment event. Depending on the payment, this can include:

• your email address, name and billing country or address;
• Stripe's checkout and payment identifiers;
• what you bought, the price, and your player ID.

We also keep records of how you spend Sidereals in the game (for example shop items and Advisor plans). See the Purchase Terms.

3.5 Push notifications (optional)

If you turn on browser alerts, we store:

• the push "endpoint" and encryption keys your browser gives us;
• your browser's user-agent string, shortened to at most 200 characters, so you can recognise your devices;
• which alerts you want to receive.

You can turn alerts off in the game or in your browser at any time.

3.6 Support and reports

• Support tickets and the messages in them, including "Report a player" reports.
• Notes our staff add internally while handling a ticket.
• Logs of actions our staff take (for example a mute, suspension or refund).

3.7 Security and anti-abuse data

• Action log. A log of actions you take in the game, used to investigate bugs, cheating and disputes.
• Economic flows between players. The game records transfers of value between accounts (for example trades and shipments). Staff review these, and any automatic flags they raise, to detect multi-accounting and "pushing" (one account unfairly feeding another).
• Sign-in rate limiting. When you sign in with your username instead of your email, we limit repeated attempts. To do this we store a SHA-256 hash of your IP address, not the IP address itself, for no more than one hour.
• Provider access logs. Our hosting and authentication providers keep their own technical access logs (which can include IP addresses) to run and protect their services. See section 8.

3.8 Data stored on your device

The game keeps your sign-in session and your game preferences in your browser's local storage. We do not use cookies. Details are in the Cookie and Local Storage Notice.

4. What we do not collect

4.1 We keep data collection deliberately small. We do not:

• use analytics or usage-tracking services;
• show advertising or use advertising networks;
• set tracking cookies, or any cookies at all;
• load fonts or other resources from third-party font services;
• build profiles of you for marketing;
• sell your personal data, or share it for cross-context behavioural advertising.

4.2 If we ever want to change this, we will update this policy first and ask for your consent where the law requires it.

5. How we use your data and our legal bases

5.1 If you are in the EU, EEA, UK or Switzerland, we must have a legal basis for each use of your data. The table below shows what we do and why.

5.2 Legitimate interests. Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for details of that assessment, and you have the right to object (section 12).

5.3 What happens if you don't give us data. We need your email, password and username to create an account. Without them we cannot provide the game. Push notifications are optional.

5.4 Marketing. We do not send marketing emails. [PLACEHOLDER: If we add a newsletter later, we will ask for your consent first.]

6. What other players can see

6.1 Glorious Factions is a multiplayer game. To play with others, some information is visible to other players:

• your username and display or ruler name;
• your alliance and title;
• your cities (names, positions on the map and sizes) and your rankings;
• combat reports you choose to share;
• the chat messages and forum posts you write (visible to the people in that channel, alliance or conversation);
• mail you send (visible to its recipients).

6.2 Other players cannot see your email address, password, purchase history or security records.

6.3 Please do not put personal information, such as your real name, in your username, city names or public messages.

6.4 If you share information in the game (for example in chat), the people who see it may copy or remember it. Deleting it from the game cannot undo that.

7. Computer-controlled players

7.1 Some worlds include computer-controlled rivals that play by the same rules as human players. The Terms of Service explain how they work.

7.2 Computer-controlled players process only game state: the same map, city, alliance and combat information that any player can see in the game. They do not read your private profile fields, your email address, your payment data or your security records. They use rule-based behaviour, not generative AI, and they are not used to profile you.

7.3 If a computer-controlled player sends you mail, joins your alliance or attacks you, that interaction is stored as ordinary game data.

8. Who we share data with

8.1 Service providers (processors). We use a small number of providers who process data on our behalf, under contract, and only for the purposes we set:

8.2 Stripe. Stripe processes your payment. For the payment itself Stripe acts on our behalf. Stripe may also act as an independent controller for its own purposes, such as fraud prevention and meeting its legal and regulatory obligations. Stripe's own privacy policy explains that use: [STRIPE PRIVACY POLICY LINK].

8.3 cotgopt.com (optional feature, only if you use it). The game has an optional "import layout from cotgopt" feature. If you use it, your browser contacts cotgopt.com directly with the name you type. That site can see your IP address and the name you entered. We do not send any other data to it. cotgopt.com is an independent third party and is not controlled by us. If you never use the feature, no data goes there.

8.4 Within our group and in business transfers. We may share data with RLM Global and its other subsidiaries where needed to run, support or administer the game. If all or part of our business is reorganised, merged, or sold, personal data may be transferred to the new owner, who must continue to protect it in line with this policy. We will tell you before your data becomes subject to a different privacy policy.

8.5 Authorities and legal reasons. We may disclose data where we are legally required to (for example a valid court order), or where it is necessary to protect the rights, property or safety of our players, staff or the public, to enforce our terms, or to investigate fraud or security problems.

8.6 Other players. See section 6.

8.7 We do not sell personal data and we do not share it with advertisers or data brokers.

9. International transfers

9.1 Our game data is stored in [SUPABASE REGION]. Ananta Studios is based in the United States, and our staff and some providers process data in the United States.

9.2 If you are in the EU, EEA, UK or Switzerland, this means your data is transferred outside your region. Where a transfer goes to a country without an adequacy decision, we protect it with one or more of these safeguards:

• the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum where relevant;
• the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), where the recipient is certified [CONFIRM WHICH PROVIDERS ARE CERTIFIED];
• other safeguards permitted by law.

9.3 You can ask us for a copy of the relevant safeguards by emailing [PRIVACY EMAIL].

10. How long we keep data

10.1 We keep data only as long as we need it. Many records are deleted automatically.

10.2 Abandoned empires are different from deleted accounts. If you are inactive in a world for 30 days (20 days below the Equite title), your empire in that world is abandoned under the game rules. That does not delete your account. Your cities become abandoned cities in that world.

10.3 Deleted accounts. When you delete your account (section 12.3):

• we delete your account and personal data;
• we keep purchase records only in anonymised form for tax and accounting;
• we keep moderation records only in anonymised form, so that we can show how rules were enforced;
• abandoned cities may remain in the world, without your name;
• the mail you sent and received, your chat messages and your forum and board posts are deleted with the account;
• other players may still have copies of things you shared outside the game, or remember what you wrote.

You can cancel a deletion request during the 7-day grace period; until then your account plays on normally. Deletion runs automatically once the grace period ends.

10.4 We may keep specific data longer if we need it to deal with a legal claim, a dispute or an investigation, or if the law requires it. We delete it when that need ends.

11. How we protect data

11.1 We use technical and organisational measures appropriate to the risk, including:

• encrypted connections (HTTPS) between your browser and our services;
• passwords stored only as hashes by our authentication provider;
• database access rules (row-level security) so that each player can read only what they are allowed to, and all game actions validated on the server;
• staff access limited to people who need it, with staff actions logged;
• storing a hash of your IP address instead of the address itself for rate limiting;
• encrypted backups of the database, stored at [BACKUP LOCATION];
• payment card details handled only by Stripe.

11.2 No system is perfectly secure. If a breach affects your data and the law requires it, we will notify you and the relevant authority.

11.3 You help too: use a strong password that you don't use anywhere else, and never share your password. Account sitting is available through the in-game substitution feature, so you never need to give anyone your password.

12. Your rights

12.1 Your rights under the GDPR and UK GDPR

If you are in the EU, EEA, UK or Switzerland, you have the right to:

1. Access — get a copy of your personal data and information about how we use it.
2. Rectification — have inaccurate data corrected.
3. Erasure — have your data deleted, unless we must keep it (for example for tax).
4. Restriction — ask us to limit how we use your data in certain cases.
5. Portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another provider where technically possible.
6. Object — object to processing based on legitimate interests. We will stop unless we have compelling reasons that override your interests, or we need the data for legal claims.
7. Withdraw consent — where we rely on consent (push notifications), you can withdraw it at any time. This does not affect processing that already took place.
8. Not be subject to solely automated decisions with legal or similarly significant effects (see section 14).
9. Complain to a supervisory authority — in the country where you live or work, or where you think an infringement happened. In the UK this is the Information Commissioner's Office (ICO). We would appreciate the chance to resolve your concern first, but you don't have to contact us before complaining.

12.2 How to exercise your rights

• In the game: open the Account panel and use "Download my data" to receive a copy of your data, or "Delete my account" to delete it.
• By email: write to [PRIVACY EMAIL] from the email address on your account.
• Through a representative: see section 1.3.

We may need to confirm your identity before acting on a request, so that nobody else can get or delete your data. We will answer within one month. If a request is complex we may extend this by up to two more months and will tell you why. Requests are free unless they are clearly unfounded or excessive.

12.3 Deleting your account

When you choose "Delete my account", your account enters a 7-day grace period. During that time you can cancel by signing in again [PLACEHOLDER: confirm the cancellation mechanism]. After 7 days we delete your account as described in section 10.3. Deletion is permanent: your empires, Sidereals and items cannot be restored, and unused Sidereals are not refunded except as set out in the Purchase Terms or required by law.

12.4 Correcting your data

You can change some account details yourself in the game [PLACEHOLDER: list editable fields, such as display name and password]. For anything else, contact us.

13. Additional information for players in the United States

13.1 California Online Privacy Protection Act (CalOPPA). This policy describes the personal data we collect, how we use and share it, and how you can review and request changes to it (section 12). We will post any changes here with a new "Last updated" date.

13.2 Do Not Track. Some browsers send a "Do Not Track" signal. There is no common standard for how to respond to it. Because we do not track you across other websites or services, and do not allow third parties to do so through our game, our practices are the same whether or not your browser sends this signal. [PLACEHOLDER: state whether we honour Global Privacy Control signals; we have no sale or sharing to opt out of.]

13.3 State privacy rights. Depending on where you live (for example California, Colorado, Connecticut, Virginia or other states with consumer privacy laws), you may have the right to know what data we hold, to get a copy, to correct it, and to delete it. Even where a law may not apply to a business of our size, we honour these requests from any player. Use the methods in section 12.2. You can use an authorised agent; we may ask for proof of their authority and verify your identity. We will not treat you differently for exercising your rights. If we decline a request, you can appeal by replying to our decision or writing to [PRIVACY EMAIL].

13.4 No sale or sharing. We do not sell personal data, and we do not "share" it for cross-context behavioural advertising, as those terms are defined in California law. We have not done so in the past 12 months. We do not knowingly sell or share data of anyone under 16.

13.5 Categories of data (California summary). In the past 12 months we collected: identifiers (email, username, player ID, hashed IP address); commercial information (purchase records); internet or network activity (in-game action logs); and the content of messages you send in the game. We collected them from you and from your use of the game, for the purposes in section 5, and disclosed them only to the recipients in section 8. We do not use sensitive personal information to infer characteristics about you.

14. Automated decisions

14.1 The game raises automatic flags when it sees patterns that may indicate cheating, such as unusual transfers of value between accounts. A flag is a prompt for review, not a decision.

14.2 Staff review flags before taking action against an account. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

14.3 Normal game mechanics (for example the result of a battle, or an empire being marked abandoned after the inactivity period) are rules of the game you agreed to, applied the same way to every player.

14.4 If you think a sanction against you is wrong, you can appeal through the in-game Support panel, as set out in the Game Rules.

15. Children

15.1 Glorious Factions is not intended for anyone under 16. You must confirm that you are 16 or older when you sign up.

15.2 We do not knowingly collect personal data from anyone under 16. If we learn that a player is under 16, we will delete the account and its personal data.

15.3 If you believe a child under 16 has an account, please tell us at [PRIVACY EMAIL].

16. Changes to this policy

16.1 We may update this policy when our game, our providers or the law changes. The "Last updated" date at the top shows when it last changed.

16.2 If we make a material change, we will tell you in advance by email or in the game. Where the law requires your consent to a change, we will ask for it.

17. Contact us

• Privacy questions and requests: [PRIVACY EMAIL]
• Post: Ananta Studios, [ADDRESS]
• In the game: Support panel → new ticket
• EU representative: [EU REPRESENTATIVE]
• UK representative: [UK REPRESENTATIVE]

See also the Legal Notice.

18. Notes for counsel (remove before publication)

1. Art. 27 representatives. The operator is US-based and the game is offered to EU and UK players, so GDPR and UK GDPR Art. 27 representatives are likely required (the "occasional processing" exemption is unlikely to fit a persistent online game). Fill in section 1.3 and decide whether the DSA legal representative is required at our size and service type. Confirm whether a DPO is needed (section 1.4). Our assessment is no, because there is no large-scale systematic monitoring or special-category data, but the anti-cheat economic-flow review should be considered.
2. Supabase region and DPA. Confirm the Supabase project region ([SUPABASE REGION]) and that Supabase's DPA (including SCCs) has been accepted for the project. Confirm the email sender used by Supabase Auth (Supabase's built-in sender or a custom SMTP provider). If it is a custom provider, add it to section 8.1. Confirm Hostmonster's terms include data-processing commitments and SCCs, and what its access logs keep.
3. Stripe's role. The draft treats Stripe as a processor for payment processing and an independent controller for its own fraud and compliance purposes, in line with Stripe's public position. Confirm this against Stripe's current Services Agreement and DPA, and insert the link in section 8.2. Confirm which payment-event fields we actually keep (email, name, billing address) and minimise them if possible.
4. Retention placeholders. Decide: purchase records ([7] years is a placeholder; check Kansas and US federal rules plus EU VAT/OSS record-keeping, which is 10 years for OSS); support tickets; staff and moderation logs; substitution audit logs; longer-kept PvE kill records; game data after a world ends; forum posts; inactive-account deletion (with a reminder email); what happens to sent mail and posts on account deletion. Each needs a matching automatic job before the policy is published.
5. Backups. State the backup location, encryption method and retention. Backups currently hold player accounts. Deleted accounts persist in backups until they expire; the policy says so. Confirm that restores re-apply deletions made since the backup was taken.
6. CCPA thresholds. We believe the operator is below the CCPA/CPRA thresholds (US$25m+ annual revenue as adjusted; buying, selling or sharing personal information of 100,000+ consumers or households; or 50%+ of revenue from selling or sharing). The 100,000-consumer test may be reached by a successful game. Section 13 honours requests voluntarily. Re-check thresholds for other states (for example, some count consumers at lower numbers) and decide whether to formally recognise Global Privacy Control signals.
7. Features that must ship before publication. In-game "Download my data" and "Delete my account" (7-day grace period, section 12) are built (migration 269); they must be live in production before this policy is published, otherwise point only to the email route. Account deletion deletes mail sent and received, chat and forum posts; purchase records and payment/abuse tickets are kept unlinked from the player. A technical fix so that other players can no longer read private profile fields is half done (migration 268); section 6 describes the final state, so the second step must be deployed before publication.
8. Legitimate-interests assessments. Prepare short written LIAs for anti-cheat (action log and economic-flow review), moderation and security logging. Section 5.2 offers them on request.
9. Sign-up confirmation. The sign-up checkbox combines age confirmation and acceptance of the Terms and Privacy Policy. Under the GDPR, "accepting" a privacy policy is not a legal basis. Consider rewording it to "I have read the Privacy Policy" and keeping consent separate (push notifications only).
10. Push services. Notification content is encrypted end to end to the browser under the Web Push protocol. The push services see the endpoint and metadata. Confirm we keep notification text free of personal data beyond what is needed.
11. cotgopt.com. Framed as a user-initiated direct connection, with no data sent by us. Confirm the in-game feature shows a short notice before contacting the third-party site.