Privacy Policy

Last updated: October 2026

1. Who We Are

Dynasty (“we”, “us”, “our”) operates the browser game available at thedynastygame.com and play.thedynastygame.com. This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable laws. You can reach us at support@thedynastygame.com.

2. Data We Collect

When you use Dynasty we collect the following data:

Data	Purpose	Retention
Username	Account identification and display	Until account deletion
Email address	Account verification and password recovery	Until account deletion
Password (hashed)	Account authentication — never stored in plain text	Until account deletion
Game state data	Storing your progress (characters, assets, history)	Until account deletion
IP address	Security, abuse prevention, and recognising accounts created by players banned for breaking the rules (see Section 3a)	30 days in server logs; up to 180 days in the sign-in record (IP address, device fingerprint, browser user agent, date and time of each sign-up and sign-in), deleted earlier if the account is deleted
Device fingerprint (a one-way code computed from characteristics your browser exposes: its user agent, i.e. browser and version, screen size and colour depth, time zone, language settings, number of CPU cores, device memory, operating system/platform and number of touch points)	Detecting duplicate accounts created by the same person, including new accounts created by players banned for breaking the rules (see Section 3a). The characteristics are read through your browser only when you sign up or sign in, and only the resulting code is stored — never the characteristics themselves. Nothing is written to your device (no cookie, no identifier). The code is seen only by our moderators, is never shared with third parties, and is never used for advertising or to follow you on other websites.	In the sign-in record: up to 180 days, deleted earlier if the account is deleted
Account review record (whether an account was held for review, when, which account it matched — a banned account, or another account on the same device — and which kinds of data matched)	Keeping one person from running several accounts and players banned for breaking the rules from returning with a new account, and letting a moderator make the final decision (see Section 3a)	Until account deletion
In-game messages (chat, private & party messages) and reports	Operating communication features, safety, content moderation and legal compliance	Chats keep only their latest 100 messages; private messages are deleted within 2 game years (at most about 2 real days). If your account is deleted, your name is removed from the messages that remain. A moderator can remove any message earlier. Reports are kept as a moderation record.
Login token (a random code stored in your browser)	Keeping you logged in to the game	Until you log out; removed from our server after 90 days without use
Days on which you opened the game (only your account ID and the date, one entry per day)	Counting how many players are active each day and how many new players come back, so we can tell whether the game is growing. Only totals are ever looked at: it is not used to profile you or for advertising, and it is never shared with anyone.	90 days, deleted earlier if the account is deleted. The daily totals worked out from it contain no personal data and are kept.
Cookie consent choice (categories, IP address, timestamp, policy version, and your account ID if you were logged in)	Evidencing your cookie consent choice, as required by GDPR Art. 7.1	3 years after your choice, also after account deletion (see “Consent record” in Section 4)

We do not collect payment data or sell your data to third parties. We do use Google Ads and Reddit Ads for advertising purposes as described in Sections 4 and 5 below, only with your consent.

3. Legal Basis for Processing

We process your data on the following legal bases (GDPR Art. 6):

Contract performance — your email and username are necessary to provide the game service you signed up for.
Legitimate interest — server logs and IP data are retained briefly for security purposes. The same basis covers the device fingerprint described in Section 2: preventing one person from running several accounts is necessary to keep a competitive game fair, it is computed only when you sign up or sign in, it stores nothing on your device, and the code it produces cannot be turned back into the characteristics it came from or used to identify you anywhere else. Because it is strictly necessary to keep the game you asked to play fair and secure, it is not one of the optional choices in the cookie banner; you can still object to it at any time (see Section 7). It also covers the automatic checks on new accounts described in Section 3a, which exist for the same reasons: one person must not play with several accounts, and a ban would mean little if the banned player could simply sign up again. Finally, it covers the record of the days on which you opened the game (Section 2): knowing how many people actually play is necessary to run and improve the game, the record holds nothing but your account ID and a date, it is used only to count players, and it is deleted after 90 days.
Consent — statistical analytics cookies (Google Analytics 4) and advertising cookies and pixels (Google Ads and, in the game, Reddit Ads) are only loaded after you explicitly accept them via the cookie banner, where you can choose each category independently. We ask for your choice again every 12 months. You may withdraw consent at any time by reopening your cookie preferences, clearing your browser’s local storage, or using the Google Analytics Opt-out Add-on.

3a. Automatic Checks on New Accounts

To stop one person from running several accounts, and players who were banned for breaking the rules from simply signing up again, new accounts are checked automatically:

When — at sign-up, and each time the account signs in during its first 5 days. Accounts created before these checks were introduced are not checked.
What is compared — the IP address and device fingerprint used by the new account, and the shape of its dynasty name, character name and email address, with the same data of accounts that were permanently banned. The device fingerprint alone is also compared with that of every other account (see “Same device” below); the IP address, names and email address never are.
What happens on a match — when enough of these signals point to the same banned account, or to a device or email pattern already used by several banned accounts, the new account is created but held: signing in shows “Your account is under review” until a moderator looks at it.
Same device — a new account with the same device fingerprint as another account is held in the same way. The other account is held too, and signed out, if it was also created after this check was introduced (September 2026) and a moderator has not already cleared it. Accounts created before then are never held by this check. Accounts that were never activated through the email link, and ended dynasties, are not compared.
A person always decides — the check never bans or deletes anyone on its own. A moderator reviews every held account and either lets it in or bans it.

Shared phones and networks (a family device, a school, a mobile carrier) can cause a match, which is exactly why a person makes the final decision. If several people in your home play on the same phone or computer, write to us before creating a second account. If your account is under review and you think it is a mistake, write to support@thedynastygame.com: you can explain your situation, ask for a human review and contest the outcome (GDPR Art. 22).

4. Cookies and Similar Technologies

We use cookies and similar technologies (your browser’s local storage and, in the game, an advertising pixel) in three categories. Only the first is strictly necessary; the other two are only used after you explicitly opt in via the cookie banner, where you can accept or reject each category independently. Nothing optional is switched on until you choose, the optional boxes start unticked, and closing the banner with ✕ has the same effect as “Reject all”.

Cookie	Type	Purpose	Retention
Login token (browser local storage, game only)	Strictly necessary	Keeps you logged in to the game. It is a random code: no personal data is stored in it.	Until you log out; removed from our server after 90 days without use
Cookie choice (browser local storage)	Strictly necessary	Remembers the choice you made in the cookie banner, so that we do not ask on every visit.	12 months, then we ask again
Device fingerprint (game only, read at sign-up and sign-in)	Strictly necessary (security)	Reads the browser characteristics listed in Section 2 to compute a one-way code that helps our moderators spot duplicate and banned accounts. Nothing is stored on your device. It keeps the game fair and secure, so it is not an optional choice in the cookie banner; see Sections 2, 3 and 3a.	The code: up to 180 days in the sign-in record
cf_clearance (Cloudflare, website only)	Strictly necessary (security)	Cloudflare’s bot protection runs a lightweight automatic check of your browser (“JavaScript Detections”) on thedynastygame.com and may store the result in this cookie, so that real visitors are not challenged again. It is not used for analytics or advertising. See Cloudflare’s cookie list.	Set and renewed by Cloudflare for the duration of its security check
_ga, _ga_*	Statistical analytics (consent-based)	Google Analytics 4 — counts visits and measures aggregate site usage. IP addresses are anonymised before collection.	2 months (configured at minimum)
_gcl_au and other Google Ads cookies	Advertising (consent-based)	Google Ads — measures the effectiveness of our advertising campaigns (e.g. which ad led to a visit or sign-up) and may be used for remarketing. Only set if you accept the “Advertising” category in the cookie banner.	Up to 90 days (per Google’s defaults)
_rdt_uuid (Reddit Pixel, game only)	Advertising (consent-based)	Reddit Ads — measures which of our Reddit ad campaigns led to a sign-up. Only set if you accept the “Advertising” category in the game’s cookie banner. See also Section 5.	90 days

We use Google Consent Mode v2: by default, all analytics and advertising signals are set to “denied” and no Google Analytics, Google Ads or Reddit script is loaded until you make a choice in the cookie banner. If you reject a category, the corresponding cookies and pixels are never set and no data is sent to Google or Reddit for that purpose. Google Analytics is configured with anonymised IP collection; Google Ads may use cookie data for conversion measurement and remarketing only where you have granted advertising consent.

You can change your choice at any time — just as easily as you gave it — via the “Cookie Preferences” link in the footer (on this site) or the “🍪 Cookie Preferences” button in the corner of the game screen (on play.thedynastygame.com). This reopens the cookie banner with your current choices pre-filled. We also ask again every 12 months, and sooner if the services we use for analytics or advertising change. You can also block or delete cookies and local storage at any time via your browser settings; clearing local storage will log you out of the game. You can also opt out of Google Analytics across all websites by installing the Google Analytics Opt-out Browser Add-on, or manage ad personalisation via Google Ad Settings.

Consent record: when you make a choice in the cookie banner (including closing it with ✕), we record it on our server (categories chosen, date/time, the cookie policy version shown, your IP address and, if you are logged in, your account ID) so that we can demonstrate compliance with GDPR Art. 7.1 if required. This record is kept for 3 years after your choice and is not used for any other purpose. It is kept for that period even if you delete your account, because your choice stays saved in your browser and remains in use there, so we must still be able to prove it.

5. Third-Party Services

We use the following third-party services to operate Dynasty:

Hetzner Online GmbH — VPS hosting for the game server. Your game data is stored on servers in the EU. Hetzner’s privacy policy: hetzner.com
Brevo (Sendinblue SAS) — transactional email delivery for account verification. Only your email address is shared with Brevo for sending purposes. Brevo’s privacy policy: brevo.com
Cloudflare, Inc. — CDN, DNS and bot protection for the landing page (a lightweight automatic browser check that may set the cf_clearance cookie, see Section 4), and Cloudflare Turnstile, the anti-bot check on the game’s sign-up form. Turnstile processes your IP address and technical characteristics of your browser only to tell people from bots; it is not used for advertising. Cloudflare may process your IP address as part of these services. Cloudflare is certified under the EU–US Data Privacy Framework. Cloudflare’s privacy policy: cloudflare.com; Turnstile privacy addendum: cloudflare.com/turnstile-privacy-policy
Google LLC — Google Analytics 4 — statistical analytics to measure aggregate site usage (visits, page views, session duration), loaded only with your consent. IP addresses are anonymised by default. Google is certified under the EU–US Data Privacy Framework, making data transfers to the US lawful under GDPR Art. 45. Google’s privacy policy: policies.google.com/privacy
Google LLC — Google Ads — advertising and conversion measurement for our marketing campaigns (e.g. measuring sign-ups resulting from an ad), and remarketing, loaded only with your consent to the “Advertising” cookie category. Google is certified under the EU–US Data Privacy Framework, making data transfers to the US lawful under GDPR Art. 45. Google’s privacy policy: policies.google.com/privacy. You can manage your Google ad preferences at myadcenter.google.com.
Reddit, Inc. — Reddit Ads — measuring which of our Reddit ad campaigns led to a sign-up. Used in the game only, and only with your consent to the “Advertising” cookie category: the Reddit Pixel (cookie _rdt_uuid) and, when you sign up, a notification from our server to Reddit (Conversions API) containing your IP address, your browser’s user agent and a random event code. Reddit processes this data under its own privacy policy: reddit.com/policies/privacy-policy. Reddit states that it relies on the EU–US Data Privacy Framework and, where that does not apply, on the European Commission’s Standard Contractual Clauses.

6. Data Security

We implement appropriate technical measures to protect your data:

Passwords are hashed with scrypt (a slow, salted algorithm) before storage — we never store plain-text passwords.
All connections use HTTPS/TLS encryption.
The server is protected by a firewall and access controls.

Despite our efforts, no system is completely secure. Please use a unique password for your Dynasty account.

7. Your Rights (GDPR)

If you are in the European Economic Area (EEA), you have the following rights regarding your personal data:

Right of access — request a copy of the data we hold about you.
Right to rectification — correct inaccurate data.
Right to erasure — request deletion of your account and associated data.
Right to restriction — ask us to stop processing your data in certain circumstances.
Right to data portability — receive your data in a portable format.
Right to object — object to processing based on legitimate interest, including the device fingerprint and the automatic checks on new accounts. We will stop unless the need to keep the game fair and secure outweighs your interests in your specific situation, and we will explain our decision.
Rights about automatic checks — if an account of yours is held for review (Section 3a), you can obtain a human review, express your point of view and contest the decision.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at: privacy@thedynastygame.com. We will respond within 30 days.

8. Data Transfers Outside the EEA

Your game data is stored on Hetzner servers located within the EU. Emails are processed by Brevo, which is based in France (EU). If you consent to analytics or advertising cookies, Google LLC (Google Analytics 4 and Google Ads) may process limited data (such as anonymised IP-derived location and cookie identifiers) in the United States; these transfers are lawful under GDPR Art. 45 as Google is certified under the EU–US Data Privacy Framework. If you consent to advertising in the game, Reddit, Inc. receives the data described in Section 5 in the United States; Reddit states that it relies on the EU–US Data Privacy Framework (GDPR Art. 45) and, where that does not apply, on the European Commission’s Standard Contractual Clauses (GDPR Art. 46). The Cloudflare Turnstile check on the sign-up form may process your IP address in the United States, under the same Data Privacy Framework. Aside from these, we do not intentionally transfer your personal data outside the EEA.

9. Children’s Privacy

Dynasty is not directed at children and is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will reflect any changes. Continued use of the Service after updates constitutes acceptance of the revised Policy. Where a change affects something you consented to (for example, a new advertising partner), we will ask for your consent again through the cookie banner.

11. Contact & Complaints

For privacy-related questions or to exercise your GDPR rights, contact us at:
privacy@thedynastygame.com

If you believe your rights have not been respected, you have the right to lodge a complaint with your national data protection authority.