Privacy

This policy explains what personal data Valoria collects, why, for how long, who it is shared with, and the rights you have – wherever you live, including the European Union and the United Kingdom (GDPR / UK GDPR) and California (CCPA/CPRA). We do not sell personal data, and we do not share it for advertising.

Who we are

Valoria ("we") runs this site and the game worlds. For anything about your data: support@valoria-game.com, or the "Contact" page.

What we collect

• Your account: email address, password (stored only as a one-way hash – we cannot read it), language, your public ID, and – only if you fill them in – a display name, country and year of birth.
• Security: IP address, browser and device type, sign-in times, your devices, and the security log (sign-ins, password and email changes, duals). If you turn on two-step verification, its secret is stored encrypted.
• The game: what you do in the worlds – villages, armies, messages, reports, alliances – and, on a shared account, which person did each action.
• Support: what you write in tickets.
• Payments: gold is paid through PayPal. We never see your card or bank details – only the transaction number, the amount, the date and its status.
• Emails we send: which emails were sent to you and when (not their content).
• Anonymous visit counting: to know how many people visit the site and which promotion works, the server counts visits. Only the day is kept, with an encrypted id that changes every day (it cannot be turned back into an address or a person, nor linked to another day), which site or link you came from (for example ?ref=), and whether you were signed in. Your IP address is not kept. Sign-ups are counted per source as a number only, never linked to the account.

Why, and on what legal basis

• To provide the service you signed up for (contract): the account, signing in, the worlds, duals, support, receipts.
• To keep the service safe and fair (legitimate interest): the security log, devices, preventing cheating, multi-accounting and break-ins.
• Announcement emails (your consent): only if you ticked it; you can stop at any time with one click in any email or in "My account".
• Payments and accounting (legal obligation): payment records are kept as the law requires.
• Visit counting (legitimate interest): to know how many visitors we have and where they come from, to improve the site and our promotion.

Who we share it with

• Brevo – sends our emails.
• Cloudflare – the anti-bot check on some forms (Turnstile).
• PayPal – payments.
• Our hosting provider – the servers the site and the worlds run on.
• Authorities – only when the law requires it.

These providers process the data only for us and under contract. Some of them may process data outside your country; where the law requires it, the transfer is protected by standard contractual clauses.

How long we keep it

• The account – until you delete it. Deleting it removes your profile, devices, tickets and email history; game accounts are deleted in each world within 72 hours.
• Security log and email history – up to 12 months.
• A world's game data – until the round ends and the world is reset; the Hall of Fame keeps the names of the round's top players.
• Payment records – as long as tax and accounting law requires, even after the account is deleted.
• Visit counts – up to 13 months. The key that makes the daily id is deleted the very next day.

Your rights

You can, at any time:

• see and download your data – "My account" → "Download my data" (a JSON file);
• correct it – in "My account";
• delete your account – "My account" → "Delete my account";
• withdraw consent to announcement emails;
• object to or restrict a use of your data, or ask any question – through "Contact".

In the EU and the UK you may also complain to your data protection authority. Californian residents: we do not sell or share personal information, and you will not be treated differently for using your rights.

Children

Valoria is not meant for children under 13. In the European Union and the United Kingdom, a player under 16 needs a parent's or guardian's permission. If you believe a child signed up without it, write to us and we will delete the account.

Cookies

We use only the cookies the site needs to work: signing in and "remember me", security (protection against forged forms), your language choice, and whether you closed the language line. No advertising or tracking cookies, so no consent banner is needed. Visit counting adds no cookie either: where you came from is kept on the server, inside your normal visit, and is gone when it ends.

Changes

If this policy changes in a meaningful way, we will say so on the site before it takes effect.