No data protection officer has been appointed, as none is required.
Hegemony is an online strategy game of negotiation. There is the app for Android and iOS, the Telegram Mini App and our Telegram bot; all of them use the same server. We process only the data the game needs. We do not sell data, show ads or build advertising profiles.
The server is located in Germany and run by us. All connections go through the network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), which connects to our server and protects it from attacks. As our processor, Cloudflare handles the IP address, the time, the requested address and technical details of the device. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); standard contractual clauses apply as well.
Our server logs the time, the requested address and errors; the IP address only on a failed sign-in, to detect abuse. Logs are deleted after 30 days at the latest.
Legal basis: Art. 6(1)(f) GDPR (secure and stable operation).
If you link the app and Telegram, we store the link. Legal basis: Art. 6(1)(b) GDPR (the contract of use, see the Terms).
Your nickname (required), your avatar (an uploaded picture or one drawn in the editor), your Elo rating, results and awards are visible to other players — on your profile, in games and on the leaderboard. Your friends list and blacklist are seen only by you and, where the feature needs it, the people concerned. In anonymous games nobody sees who plays which country until the game ends, except the game master if the game has one — they run it. Legal basis: Art. 6(1)(b) GDPR.
The Gazette of a finished game that is not private is published at hegemonyplay.com/gazette/: readable by anyone without signing in and indexed by search engines and AI services. It names each power together with its player's nickname (anonymous seats too, since the game has ended); it shows no orders, chats, avatars or account identifiers. Names are added when a page is shown, so changing your nickname or deleting your account removes the old one from these pages; copies that search engines have already stored are refreshed on their next visit. You can also object and ask us by email to leave your nickname out. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in showing the history of finished games.
We store which games you take part in, your orders, readiness and results. Other players see them as the rules provide. Games are kept as a game archive. If you delete your account, your moves stay in other players' games, but as “Unknown”, without any link to you. Legal basis: Art. 6(1)(b) GDPR; for the archive Art. 6(1)(f) (the other players' interest in complete games).
Legal basis: Art. 6(1)(b) GDPR.
When you report a player or messages, we store your account, the reported account, the game, the reason, your comment and the text of the reported messages — for end-to-end encrypted messages, the text your device decrypts and sends along. The report is also emailed to our mailbox (provider: Google Ireland Ltd.). Reports are deleted 365 days after they have been handled. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA, and Art. 6(1)(f) (protecting other players).
Through “Send feedback” we store your text, your account and technical details (screen, app version) and forward it by email to our mailbox (Google Ireland Ltd.); we process emails you send us in the same way. Feedback is deleted after 365 days. Legal basis: Art. 6(1)(f) GDPR (answering you and improving the game).
Legal basis: Art. 6(1)(b) GDPR.
Only if you agree on first launch or later under Settings → Legal, we use Firebase Analytics (Google Ireland Ltd.) to understand how the app is used and to find bugs. Before that, no analytics data is collected. Processed are a random app instance ID, usage events (e.g. app start, screens opened), device and app information and an approximate location derived from the IP address; the advertising ID is not collected. Google keeps the data for 2 months. A transfer to Google LLC in the USA is possible (EU-US Data Privacy Framework). Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time under Settings → Legal.
The app keeps your sign-in token, your settings, your analytics choice and your chat key in the device's protected storage. The Mini App keeps settings and the chat key in browser storage or in the cloud storage of your Telegram account. This is technically necessary for the service (§ 25(2) no. 2 TDDDG). Fonts are served by our own server; there is no connection to Google Fonts.
You have the right of access (Art. 15 GDPR), rectification (Art. 16) — including of your nickname —, erasure (Art. 17; see Delete account), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Write to us at [email protected].
You can lodge a complaint with a data protection supervisory authority, e.g. the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.
The game is for ages 16 and up. Without the data in sections 4–6 the game cannot be used; there is no obligation to provide it. There is no automated decision-making within the meaning of Art. 22 GDPR; the Elo rating is a game value. Backups are deleted after 90 days at the latest. If this policy changes, we will point it out in the app.