Privacy policy

Last updated: 9 November 2026 Deutsche Fassung

Ferrum et Fluctus is a browser game. We process only the data we need to provide you with a game account and to run the game securely. We use no analytics or tracking tools, show no advertising and embed no third-party content: no external fonts, no third-party scripts, no social media plugins.

1. Controller

The controller responsible for processing your personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Email: info@enjoy-dialogs.de
Contact form: Send a message

Please send any question about data protection to this email address.

2. Visiting the website

When you open the website, your browser necessarily sends data to our server: your IP address, the date and time, the address requested, your browser's identifier (user agent) and, where applicable, the page you came from (referrer). We process this data to deliver the website, protect it against attacks and find errors. To protect sign-in and registration against automated guessing, the server counts the account forms submitted per IP address, holding the IP address briefly in memory for that purpose.

This information may be stored in server logs together with error messages and, when an email is sent, the recipient's address and the subject. The logs are deleted after 14 days at the latest. We keep individual entries longer only while they are needed to investigate a specific security incident. Within those 14 days we may also read the entries of accounts reported to us, to check a rule breach (section 3).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is operating the website securely and without disruption.

3. Game account and game data

To play, you create an account. For this we process your email address, which is also your user name, and your password. We store the password only as a cryptographic hash, never in plain text. The account also holds technical details: whether your email address is confirmed, when you created the account, failed sign-in attempts and any temporary lockout that follows from them.

You may, if you wish, add a profile name in your account settings and set up two-factor sign-in. We then store these details too; for two-factor sign-in, the key for your authenticator app and your recovery codes. For now only you and our administrators can see the profile name. We no longer ask for a phone number; we do not use a number added earlier, and it is deleted with your account.

When you join a game world, we store your participation: the ruler name you choose, your realm, your moves, when you joined and in which rounds you gave Orders. When your seat ends, because you leave the world, the seat is released or the world ends, we record when and how. Other players in that world can see your ruler name and your realm, but not your email address.

When you use the Chat in a game world, we store your messages with realm, ruler name and time, and what you have read and hidden. A message can be read only by the players who held a realm in that Chat at the time; in the World Chat, by everyone who had a seat in the world at the time. Whoever takes a realm over later does not read earlier messages. Messages are not sent by email. Chats stay readable until 90 days after their world has ended and are then deleted. If you delete your account, your messages are deleted, and the history shows "Message deleted".

You can block another player: we store whom you blocked, with the ruler name, realm and world you blocked them from, and hide their messages from you in every world. They are not told. You can also report a message to us: we store the report with your ruler name and realm at the time and the reason you give, if any. Our administrators then see the reported message and the 20 messages before it in the same Chat, and nothing from any other Chat. A reported message and those 20 are kept until the case is closed, even beyond the 90 days and beyond the deletion of the writer's account. We may warn the writer, bar their account from writing in the Chat for a time, or release their seat. The writer sees that measure, and you see whether we acted, as a notice on the start page until it is dismissed. The legal basis for reports, blocks and these measures is Art. 6(1)(f) GDPR; our legitimate interest is protecting players from abuse in the Chat.

The legal basis is Art. 6(1)(b) GDPR: we need this data to provide the game you signed up for. Without an email address and a password we cannot set up an account; everything else is optional.

Before we create an account, we check the email address you give and your IP address for known signs of abuse such as throwaway addresses, VPN services, proxies or Tor nodes. For this we send both to the SignupGate service of Highware GmbH, Baar (Switzerland), which by its own account processes them in Switzerland; Switzerland is covered by an adequacy decision of the European Commission (Art. 45 GDPR). SignupGate answers with a risk level, which we do not store with your account. At the highest level we do not create the account. This check decides automatically; write to us and a person will look at the case. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the game from accounts created in bulk or for abuse.

We also evaluate the times you joined, gave Orders and your seat ended in aggregate, to see where newcomers get stuck and whether players return (Art. 6(1)(f) GDPR; our legitimate interest is a game that new players find their way into).

The game's rule is one person, one account, and one realm per world. To check a rule breach, for instance after a report or before we hand out a gift to every account, we may read data we already hold: your account, your Orders, the goods your realm moves to and from other realms and, for accounts reported to us, the server logs of the last 14 days (section 2). We store no additional data for this. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a fair game for all players of a world.

Under "My data" in your account settings you can download this information as a JSON file at any time: your account details except the password, your seats in the game worlds with ruler name, realm, the times you joined and made your first and latest move and the round you came back in, your ended seats with when and how they ended, the worlds you opened, your own Chat messages, the players you blocked, the messages you reported, any warning or Chat ban on your account, your placings in finished worlds and in each round's ranking, and any action the operator took on your seats, with the reason recorded for it. The individual moves of your realm you see in the game itself.

We keep your account data until you delete your account, which you can also do yourself there. We then remove your email address, your password and all other account details at once; only the server logs (section 2) and the backups (section 7) keep them until their own deletion periods run out. What belongs to a world's history remains: your seat with the ruler name you chose, your realm, your moves and the times named above, your ended seats, your placings in each round's ranking and in the final ranking of finished worlds, the log entries recording that the operator released your seat or changed your ruler name, and, for worlds you opened, the record of who opened them. These entries contain neither your email address nor any other account detail, only a random identifier of your former account, which after the deletion points to no account. Other players in the world still see your ruler name, so it is best to choose one that does not identify you; on request we change it, also after the deletion. The legal basis for keeping this is Art. 6(1)(f) GDPR; our legitimate interest is a complete game history for the other players of the world.

4. Emails

We only write to you when your account requires it: to confirm your email address, to reset your password and to confirm a changed email address. We do not send newsletters or advertising.

We send these emails through Lettermint, a service of Lettermint B.V. (the Netherlands). Lettermint processes your email address, the content of the message and technical delivery data such as time and delivery status on our behalf (Art. 28 GDPR), within the European Union. Open and click tracking are switched off for our emails: they contain no tracking pixel, and their links lead straight to us.

The legal basis is Art. 6(1)(b) GDPR.

5. Contact

When you email us, we process your email address, your message and any details you choose to give. Our contact form is provided by the Aidbase service of Highware GmbH, Baar (Switzerland). It opens on their site hosted.aidbase.ai; our own pages load nothing from Aidbase. What you enter there (such as name, email address and message) is processed by Aidbase on our behalf (Art. 28 GDPR), together with technically necessary connection data such as your IP address. Switzerland is covered by an adequacy decision of the European Commission (Art. 45 GDPR).

We use this data only to answer your request and delete it once the request is settled, unless a statutory retention duty applies. The legal basis is Art. 6(1)(b) GDPR where your request concerns your game account, otherwise Art. 6(1)(f) GDPR; our legitimate interest is being able to answer requests.

6. Cookies

We set only cookies that are strictly necessary for operating the website. Under § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) these need no consent, which is why there is no cookie banner. We use no tracking or advertising cookies.

The legal basis for the processing involved is Art. 6(1)(b) GDPR (signing in) and Art. 6(1)(f) GDPR (protecting the forms).

7. Hosting and backups

The website and its database run on a server of Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, in a data centre in Germany. We back up the database daily to storage operated by Hetzner Online GmbH in Falkenstein (Germany). Each backup is deleted after 30 days at the latest; until then it may still contain data of an account that has since been deleted. Hostinger and Hetzner process the data solely on our behalf (Art. 28 GDPR).

8. Disclosure

Apart from the service providers named here, nobody receives your data unless we are legally obliged to disclose it. We do not sell data.

9. Your rights

You have the right

• to access the data we hold about you (Art. 15 GDPR),
• to have inaccurate data corrected (Art. 16 GDPR),
• to have your data erased (Art. 17 GDPR),
• to have processing restricted (Art. 18 GDPR) and
• to receive the data you have provided to us in a common, machine-readable format (Art. 20 GDPR).

Access to and a copy of your data (Art. 15 and 20) and the deletion of your account (Art. 17) you can handle yourself under "My data" in your account settings. For anything else, or if you prefer, write to us at the email address given above.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.

10. No automated decisions

We make no automated decisions within the meaning of Art. 22 GDPR and create no profiles.

11. Changes

If the game or the way we process data changes, we will update this policy. The version published here applies.