Way of Citizen
Operator: Kevin Heymann
Address: Armstrongstraße 17A, 63654 Büdingen, Germany
Email: spiel@wayofcitizen.de
We take the protection of your personal data very seriously. It is treated confidentially and in accordance with statutory data protection regulations (in particular the GDPR) and this privacy policy.
This website is hosted by the following provider:
IONOS SE
Elgendorfer Str. 57
56410 Montabaur, Germany
IONOS provides the technical infrastructure (servers, database, security mechanisms). When you visit the site, data is automatically processed by IONOS (see "Server Log Files"). We have a data processing agreement with IONOS pursuant to Art. 28 GDPR.
The hosting provider automatically collects and stores information in server log files that your browser transmits:
This data serves the secure and stable operation of the website (Art. 6(1)(f) GDPR) and is not combined with other data sources.
A user account (registered or as a guest) is required to play. In doing so, we process: email address and username (on registration), password (stored only as a hash, never viewable in plain text), and all save-game data (cities, resources, troops, messages, chat/alliance contributions) under your account.
The legal basis is the performance of the usage agreement for providing the game (Art. 6(1)(b) GDPR). Guest accounts have no email requirement; the account is bound to your device via a cookie (see item 6).
We use the following technically necessary cookies to operate the site (Art. 6(1)(b)/(f) GDPR, no consent required):
Additionally, but only with your explicit consent, we set a Google Analytics cookie – see section 8.
To protect our registration form from automated bot sign-ups, we use Google reCAPTCHA, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google"). In doing so, your IP address and other data required for reCAPTCHA (e.g. mouse movements, browser and device information) are transmitted to and processed by Google, including in the USA. We have entered into a data processing agreement with Google pursuant to Art. 28 GDPR.
The reCAPTCHA script is only loaded once you open the registration form, not already when the homepage is loaded. The legal basis is our legitimate interest in a registration process protected against abuse/spam (Art. 6(1)(f) GDPR); the check is a technically necessary part of the registration you requested.
You can find further information in Google's privacy policy: policies.google.com/privacy.
With your consent, we use Google Analytics, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google"). Google Analytics sets cookies that enable an analysis of how our website is used (e.g. which pages are viewed how often and for how long, which source you found us through).
The information generated in this way is transmitted to and processed on Google servers, including in the USA. We have entered into a data processing agreement with Google pursuant to Art. 28 GDPR.
The legal basis is exclusively your consent (Art. 6(1)(a) GDPR). Without your consent via the cookie banner, no Google Analytics script is loaded and no corresponding cookie is set. You can withdraw your consent at any time with effect for the future:
You can find further information on how Google Analytics handles user data in Google's privacy policy: policies.google.com/privacy.
Way of Citizen offers optional, paid premium features (subscription or one-time purchase). Payment processing is handled entirely by the payment provider Stripe:
Stripe Payments Europe, Limited
1 Grand Canal Street Lower, Grand Canal Dock
Dublin 2, Ireland
When you make a purchase, your payment data (e.g. card details) is processed directly by Stripe – it never passes through our own servers and is not stored by us. Depending on the payment method, data transmitted to Stripe includes your email address, an internal user ID (to match the purchase to your account), and the actual payment data. After a successful purchase, we receive a confirmation from Stripe (including a Stripe customer/subscription ID where applicable) to unlock your account accordingly.
The legal basis is contract performance (Art. 6(1)(b) GDPR). Stripe may transfer data to the USA; Stripe is subject to its own, publicly available data protection mechanisms (standard contractual clauses) for this. Details: stripe.com/de/privacy.
If you enable browser push notifications (e.g. for attacks or completed construction orders), we store the push subscription required for this (an endpoint address assigned by your browser) for your device. Delivery is technically handled by your browser provider's push service (e.g. Google, Mozilla, Apple). You can disable notifications again at any time in the game settings or browser settings; the subscription is then deleted.
The legal basis is your consent (Art. 6(1)(a) GDPR) when you enable the feature.
For registration confirmations, password resets, and optional game notifications by email, we use the email delivery service Resend. Your email address and the message content are transmitted to Resend for delivery.
The legal basis is contract performance (Art. 6(1)(b) GDPR) or, for optional notifications, your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the settings.
If you contact us by email, the data you provide (e.g. name, email address, message) is stored in order to process your request (Art. 6(1)(b) GDPR). We do not pass on this data without your consent.
Your data is only disclosed:
You have the right at any time to access, rectify, erase, and restrict the processing of your stored data, to object to its processing, and to data portability. You can contact us at any time regarding these rights.
If processing is based on your consent, you can withdraw it at any time. The lawfulness of processing carried out until the withdrawal remains unaffected.
You have the right to lodge a complaint with the competent data protection authority:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
(Hesse State Commissioner for Data Protection and Freedom of Information)
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany
We reserve the right to amend this privacy policy in response to technical or legal changes.