Privacy Policy

The data controller responsible for your personal data is Starforge Interactive Ltd., registered in Ireland. Our registered office is at 123 Nebula Street, Dublin, D01 AA01, Ireland.

For all data protection enquiries, please contact our Privacy Team at privacy@starforgemmo.com.

We collect information you provide directly and information generated automatically when you play the Game.

2.1 Account Information

• Username and display name
• Email address
• Hashed password (we never store your password in plaintext)
• Chosen faction and empire name
• Date of registration and last login timestamp

2.2 Gameplay Data

• In-game actions: building upgrades, fleet movements, battles, market trades
• Resource levels and empire statistics
• Alliance membership and in-game chat messages
• Game progression data (level, experience, rank)
• IP address at login (used for security and fraud prevention)
• Browser type, operating system, and device type

2.3 Payment Data

• Transaction identifiers and purchase history
• Billing country (for tax purposes)
• We do NOT store full card numbers or CVV codes — payment processing is handled by our PCI-DSS compliant payment provider (Stripe)

2.4 Communications

• Support tickets and email correspondence
• Responses to surveys or feedback forms

We use your data for the following purposes:

• Providing and operating the Game and our website
• Creating and managing your player account
• Processing in-game purchases and premium subscriptions
• Sending transactional emails (registration, password reset, purchase receipts)
• Sending game notifications and email digests (if opted in)
• Detecting and preventing cheating, fraud, and abuse
• Enforcing our Terms of Service
• Complying with legal obligations
• Improving and developing the Game (aggregated, anonymised analytics)
• Responding to customer support requests

Under the GDPR we rely on the following legal bases:

• Contract — processing necessary to provide the Game and account services you signed up for.
• Legitimate interests — fraud prevention, security monitoring, and product improvement, where such interests are not overridden by your rights.
• Consent — optional marketing emails and non-essential cookies. You may withdraw consent at any time.
• Legal obligation — retaining financial records for tax purposes and complying with regulatory requests.

We retain your personal data for as long as your account is active or as needed to provide our services. Specific retention periods:

• Active account data — retained for the lifetime of your account
• Inactive accounts — accounts with no login for 60+ days enter a decay state; data is retained indefinitely until you request deletion
• Chat logs and in-game mail — 12 months
• Payment records — 7 years (legal / tax requirement)
• Anti-cheat and security logs — 12 months
• Support tickets — 3 years
• Anonymised analytics — indefinitely (no personal data)

Accounts are never deleted automatically. Deletion must be requested by you (see Section 6) or initiated by our administrators following an explicit written instruction.

We do not sell your personal data. We share data only with the trusted processors listed below and only to the extent strictly necessary:

• Stripe — payment processing. Stripe receives your billing details to authorise purchases. We do not store full card numbers or CVV codes. Stripe is PCI DSS compliant. stripe.com/privacy
• Sentry — error monitoring. Sentry receives stack traces and the URL that triggered an error. We configure Sentry to scrub personal data from error payloads before transmission. sentry.io/privacy
• Plausible Analytics — website analytics. Plausible is cookieless and collects no personal data. It does not track individuals and does not share data with any third parties. plausible.io/privacy
• Law enforcement or regulatory authorities when required by applicable law.
• Successors in the event of a merger, acquisition, or sale of our business — you will be notified in advance.

Where data is transferred outside the UK or European Economic Area (EEA), we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements or EU Standard Contractual Clauses (SCCs).

As a data subject under the GDPR (and equivalent regulations), you have the following rights:

• Right of access — request a copy of the personal data we hold about you ("Download my data" in Account settings; fulfilled within 30 days).
• Right to rectification — correct inaccurate or incomplete data (update username / email via Account settings or contact us).
• Right to erasure — request deletion of your account and personal data via the "Delete Account" option in Account settings or by emailing us. A 30-day cooling-off period applies.
• Right to restriction — request that we restrict processing of your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
• Right to lodge a complaint — with your national data protection authority (in Ireland: the Data Protection Commission, www.dataprotection.ie).

To exercise any of the above rights, contact us at privacy@starforgemmo.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.

We use cookies and similar technologies to operate the Game and improve your experience.

Essential cookies

Required for the Game to function (authentication session, CSRF protection, load-balancing). Cannot be disabled without breaking core functionality.

Analytics (Plausible)

We use Plausible Analytics — a privacy-first, cookieless analytics tool. Plausible does not set any cookies and collects no personal data. You may accept or decline Plausible tracking via our cookie banner; your choice is stored in your browser's localStorage under the key sf_cookie_consent. You can change your preference at any time by clearing that key.

Preference cookies

Store your in-game settings (graphics quality, notification preferences, sound volume). Functional but not essential — you may clear these in your browser at any time.

Most browsers allow you to control cookies via their settings. Disabling essential cookies will prevent you from logging in.

Starforge MMO is intended for players aged 13 and older. We do not knowingly collect personal data from children under 13 (or under 16 in jurisdictions where a higher age applies). If you believe a minor has provided us with personal data, please contact us immediately at privacy@starforgemmo.com and we will delete that information promptly.

We implement technical and organisational measures to protect your data against unauthorised access, loss, or destruction, including:

• Passwords hashed using bcrypt with a per-user salt
• TLS/HTTPS encryption for all data in transit
• Encryption of sensitive fields at rest
• Regular security reviews and penetration testing
• Access controls and principle of least privilege for internal systems
• Two-factor authentication for administrator accounts

No system is perfectly secure. In the event of a data breach affecting your rights, we will notify you and the relevant supervisory authority as required by law (within 72 hours of becoming aware).

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via in-game notification and email (if we hold your email address) at least 14 days before the changes take effect. Your continued use of the Game after the effective date constitutes acceptance of the updated policy.

We maintain an archive of previous policy versions. Contact us if you wish to review a prior version.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data:

• Email: privacy@starforgemmo.com
• Post: Data Protection Officer, Starforge Interactive Ltd., 123 Nebula Street, Dublin, D01 AA01, Ireland

We aim to respond to all enquiries within 5 business days and to fulfil formal data subject requests within 30 calendar days.