Privacy Policy

We hold your email address, a password we cannot read, and how your matches went. We do not run analytics, we never see your card, and your address is never shown to another player. Promotions in the game are for City Rivals features only.

1. The short version

City Rivals is a game, not a data business. The account system was built to need as little about you as possible: you can play the whole game offline without an account at all, and an online account is an email address and either a password or a sign-in provider. No phone number, no postal address, no real name, and nothing we could sell if we wanted to.

Your email address is an identifier here, not a marketing channel. We currently have no way to send email at all, and we do not sell, rent or share your address with anyone.

This policy explains the rest honestly. It covers www.cityrivals.org and applies to everyone who plays.

2. What we collect

When you create an account

• Your email address — what you sign in with. It is never shown to other players, never appears on the ladder, in a seat list or on a profile card, and is returned by our API only to the holder of that account's own session.
• Display name and avatar — chosen by you, shown at the table. This is the only name other players see.
• Password — if you use one. Stored only as a scrypt hash with a per-account salt. We cannot read it, recover it, or tell you what it is.
• A recovery code — also stored only as a hash, and shown to you exactly once at sign-up.
• The date the account was created.

If you sign in with Google or Discord

Pressing one of those buttons sends you to that company, which asks you to approve the sign-in and then sends us back a small amount of information. What we receive, and nothing else, is:

• An account identifier issued by that provider. We store it, and it is what links your Google or Discord account to your City Rivals account. It is not your email address, so changing your address at the provider does not cost you your account.
• Your email address, and whether the provider has confirmed it belongs to you.
• Your name and avatar url at that provider, used only to fill in a display name you can immediately change.

We ask for the smallest permission each provider offers for signing in and nothing more. We never receive your password for that service. We cannot read your Google mail, your files, your Discord messages, your servers or your friends, and we cannot post or act as you anywhere.

Using one of those buttons means that provider knows you signed in to City Rivals, and its own privacy policy covers what it does with that. You can avoid it entirely by using an email address and a password.

When you play

• Match results — who played, who won, when, and in which mode.
• Your rating and record — wins, losses and ladder position by season.
• Your balance and inventory — coins, items owned, items equipped.
• Room state while a match is live — the seats, the board and the chat messages sent in that room. This is deleted automatically a few hours after the room goes quiet.

Technical

• Your IP address, used transiently to rate-limit sign-ups, logins and password recovery so the game cannot be brute-forced or spammed. It is used as a short-lived counter key and expires on its own; we do not build a browsing profile from it or attach it to your match history.
• Ordinary server logs kept by our hosting provider, which may include IP address and request path, retained by them for a short period for security and debugging.

3. What we never collect

• No phone number, postal address, date of birth or real name.
• No marketing email, ever. There is still no email-sending service in this project — which is why account recovery works from a one-time code rather than a reset link. Your address is a way to identify you, not a way to reach you.
• No card or bank details. They are entered on our reseller's checkout and never reach our servers — see section 8.
• No analytics and no fingerprinting. There is no Google Analytics and no social tracking script anywhere in the page.
• Advertising: our own promotions only. City Rivals loads no third-party advertising script, sets no advertising cookies and uses no advertising identifiers. The only promotions in the app are our own, for things inside City Rivals. Buying the No Ads perk hides them. If we ever introduce third-party advertising we will update this notice, and the consent mechanism the law requires, before it goes live — not after.
• No sale of your data. We do not sell or rent personal information to anyone, for any purpose.

4. Why we collect it

Everything in section 2 is collected for one of four reasons: to run the game you asked us to run (your account, your matches, your items); to keep it fair and safe (rate limits, abuse handling); to deliver something you bought (crediting coins after a payment); or because a law requires us to keep a record of a sale.

Where the law calls for a legal basis, ours is the performance of our contract with you for the first and third of those, and our legitimate interest in a working, non-abusable game for the second.

5. Cookies and local storage

City Rivals uses essential cookies for account sign-in and to protect social sign-in from forgery. The account cookie is marked HttpOnly, so page scripts cannot read its value, and Secure on the live HTTPS site. We do not use cookies for tracking or advertising.

The game does keep a few things in your browser's own storage, on your device, readable only by this site:

Clearing your browser's site data removes all of them and signs you out. It does not delete your account.

Our payment reseller sets its own cookies on its checkout when you open one; those are covered by that reseller's privacy notice, linked from your receipt.

6. What other players see

Your display name, avatar, equipped cosmetic items, rating and win/loss record are visible to other players — on the ladder, in a room's seat list, and on your profile card. Chat messages are visible to everyone in that room. Nothing else about you is shown to anyone.

7. Who else handles it

We use three services to run City Rivals, and only three. Each acts on our instructions under its own data-protection terms:

If you choose to sign in with a provider, Google or Discord also processes that sign-in — but as an independent controller of your account with them, not on our instructions. See section 2 for exactly what they send us.

We may also disclose information where we are legally required to, or where it is necessary to investigate fraud, abuse or a security incident.

8. Payments

Our order process is conducted by an authorised online reseller acting as our Merchant of Record. It collects and processes the payment details, calculates and remits tax, and issues the receipt. Our current Merchant of Record is Paddle.com; if that changes we will update this page, and your receipt always names the one that actually handled your payment.

Your card number never reaches us — the checkout runs on the reseller's own page, under its own privacy notice, which is linked from your receipt. What comes back to us is a confirmation containing the transaction reference, which pack was bought, the amount, and the account to credit.

We keep the transaction reference and the coins granted against your account, because that is the record of what you paid for and the reason the same payment cannot be credited twice.

9. How long we keep it

• Your account and its history, including your address and any connected provider identifiers — for as long as the account exists.
• Live room state, including room chat — deleted automatically a few hours after the room stops being used.
• Rate-limit counters — minutes to hours, then they expire on their own.
• Sign-in handoff and anti-forgery values used during a social sign-in — sixty seconds and ten minutes respectively, then they delete themselves.
• Purchase records — kept for as long as tax and accounting law requires, typically six to seven years, even if the account is deleted. This record is a transaction reference and an amount, not your name or your card.

10. Security

Traffic is served over HTTPS. Passwords and recovery codes are hashed with scrypt and a per-account salt, never stored or logged in the clear, and login compares them in constant time so an unknown address and a wrong password cannot be told apart by how long the answer takes. A social sign-in is protected against cross-site forgery, and the session it produces is handed over through a single-use sixty-second code rather than being written into a url. Sign-up, login and recovery are rate-limited. Nothing about a price or a coin balance is ever accepted from the browser.

No system is perfectly secure. If we discover a breach affecting your data we will act on it promptly and, where the law requires, notify the relevant authority — though note that we have no way to send email, so the way we would reach you is a notice in the game and on this site.

11. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to receive a copy of it, to restrict or object to how we use it, and to complain to your local data protection authority.

To exercise any of them, email Cityrivals@cityrivals.org from the address on the account. If you cannot, or the account was created through Google or Discord without an address, we will ask you to prove control of it another way — by making a change we can observe on it, or by supplying your recovery code. This is a protection for you: without it, anyone who knew your address could ask us to delete your account.

We will respond within 30 days. There is no charge.

Deleting your account removes your email address, display name, avatar, password hash, recovery hash, any connected provider identifiers, rating, match history, coin balance and inventory. It cannot be undone, coins and items are not refunded, and the purchase records described in section 9 are retained because the law requires it.

12. Children

City Rivals is not intended for children under 13, and accounts may not be created by them. We do not knowingly collect data from a child under 13. If you believe a child has created an account, email us and we will delete it.

13. Where your data goes

Our hosting, database and payment providers operate internationally, so your data may be processed on servers outside your country, including in the United States. Where personal data leaves the UK or EEA, our providers rely on the safeguards available to them, such as the European Commission's Standard Contractual Clauses.

14. Changes

If this policy changes, the date at the top changes with it. If a change materially affects what we collect or why, we will make it visible in the game before it takes effect.

15. Contact

Any privacy question, request or complaint: Cityrivals@cityrivals.org. A real person reads it, usually within five working days.