Privacy policy
Controller responsible for data processing: Rivernature, Christian Etten (address see legal notice), e-mail: support@depotempire.com.
This game stores your save data (investor name, title and profile picture, population, treasury, building state, progress such as achievements/stars and login days, plus your music, volume and graphics settings) in your browser's localStorage, a local store on your device that is not transmitted to any server. This storage is technically necessary for the game to work (legal basis: Art. 6(1)(b) GDPR). Access to your device for this is permitted without consent under § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), because it is strictly necessary for the game to work. A technical cookie is also set (valid for 365 days) which only records that you have taken note of the privacy notice. Neither store contains personal data other than the investor name you chose yourself.
New, companies & exchange: If you use the optional company feature (unlocking the company grounds in game), a game account on our server is created for the first time, you are asked for separate consent beforehand, and nothing is transmitted without unlocking. Only pseudonymous game data is then stored (no credentials, no portfolio values). You can irreversibly delete this server data at any time in the game (imperials window or legal notice/privacy), except for purchase records that must be kept by law, if you have bought time crystals or the add-on (see below).
If you link your Parqet account via Parqet Connect, the portfolio ID, the portfolio name, the date of your first investment and the most recently retrieved portfolio values and dividends per asset class (including your filter settings) are stored exclusively in your browser's localStorage. Your browser keeps the Parqet access key (OAuth token) encrypted in a technically necessary cookie. Scripts on the page cannot read this cookie, it is only sent over HTTPS and only to the parts of our server that need access to Parqet, and it is valid until you disconnect, for at most 400 days. If your browser does not allow the cookie, the access key is kept in localStorage instead. The server decrypts the key only for the duration of a request, passes the request on to the Parqet API as a technical relay and stores nothing in the process (exception: the optional company feature, see below, even there your Parqet token is only used briefly for sign-in and never stored). The legal basis is Art. 6(1)(b) GDPR, and access to your device is permitted without consent under § 25(2) no. 2 TDDDG. You can disconnect at any time by holding the Parqet button for 2 seconds, which also deletes the cookie.
When the page is accessed, the web server processes your IP address for technical reasons so that the page can be delivered. The access logs are kept by our host IONOS (see below) as a processor, deleted after 7 days at the latest and not passed on to third parties. We serve fonts and graphics ourselves, so no data is transmitted to other providers when the page is loaded. External services (PayPal, Ko-fi, Parqet, Instagram, YouTube, Discord) are only reachable via links and are contacted only when you tap them. When the company feature is used, the IP address is additionally processed briefly to prevent abuse (rate limit, legitimate interest, Art. 6(1)(f) GDPR) and deleted automatically after one hour at the latest.
The "Tip" button leads to an external PayPal service. PayPal (Europe) S.à r.l. et Cie, S.C.A. is responsible for the data protection provisions applying there. The same applies to the Ko-fi button: it leads to Ko-fi (Ko-fi Labs Limited), whose privacy provisions apply there. The Ko-fi image itself is hosted on our server.
You can delete your save data and all stored data at any time by clearing your browser's site data (localStorage and cookies) for this site.
Companies & exchange (server storage): If you unlock the company grounds in game, a game account is created on our server. The hosting provider is IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany), acting as a processor under Art. 28 GDPR exclusively on our instructions, a data processing agreement is in place. Data is processed in data centres in the EU. Stored are: your Parqet user ID (pseudonym), your investor and company name, game metrics as normalised factors (0-1), the date of your last visit and your login streak. No credentials, no portfolio values, positions or amounts. Your company share price on the in-game exchange is derived from these factors, among other things from how your portfolio developed over the last 7 and 90 days, normalised and capped. Other players do not see any amounts, but can roughly tell whether your portfolio recently did better or worse than theirs. Legal basis: Art. 6(1)(b) GDPR. You can irreversibly delete this server data at any time in the game, in the menu under “🔒 Privacy” or in the imperials window (Art. 17 GDPR), except for purchase records that must be kept by law, see “Time crystals” and “Add-on” below:
Time crystals (paid optional feature): If you buy time crystals, we store your crystal balance on our server, the crystal history (time, amount and reason of every entry) and records of your purchases (order number, transaction ID, pack, amount, currency, status and time). Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
The sale itself is not handled by us but by CopeCart GmbH, Rosenstr. 2, 10178 Berlin, Germany. They sell in their own name and are the independent controller for name, address, payment data and invoice, that data never reaches us. CopeCart GmbH is responsible for the privacy terms applying there.
When a purchase starts, we transmit a pseudonymous, time-limited identifier of your game account to CopeCart, which comes back to us with the payment confirmation. It is the only way we can credit the crystals to the right account. It contains no plain data and expires after 60 minutes.
If you delete your game account, any remaining time crystals are forfeited and are not refunded. Purchase records must be kept for ten years by law (§ 147 AO, § 257 HGB); on deletion they are separated from your account and no longer contain any reference to you.
Add-on “Battles & Defence” (paid optional feature): If you have the add-on, we additionally store your add-on progress on our server: map and towers with levels and items, research, units and troop, your boss (animal, the name you chose, level, food, training and items), your war chest, defence and attack points, monthly ranking, badges and titles, and battle reports (attacker, defender, time, result, loot, bonuses and losses). For each battle we also store a log for the replay (course of the battle and the line-ups of both sides); it is deleted after 7 days. Battle reports are kept until one of the two accounts involved is deleted. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
What other players see in the add-on: Players with the add-on see your investor name, your profile picture, your city on the world map, your defence and attack level and whether a protection period is running. After a battle, the other side sees your investor name, the result, loot and losses and can watch a replay with your map and towers or your troop. Of your boss, they only see the animal and level, never the name you gave it. The ranking shows investor name, profile picture, points, badges and titles. This is necessary for battles between players (Art. 6(1)(b) GDPR).
If you buy the add-on, the same applies as for time crystals: the sale is handled by CopeCart GmbH, they receive only the pseudonymous identifier from us, and we store the unlock (add-on, time, any refund, reference to the purchase record) and the purchase record. If the purchase is withdrawn or refunded, your add-on progress is kept for 90 days so that a new purchase continues from there, and is then deleted automatically. Battle reports, rankings and badges remain. If you delete your game account, we delete all add-on data immediately, including the battle reports and replays you appear in, also in your opponents' battle history. Purchase records are kept for ten years as described above, separated from your account.
Notifications (web push): If you turn on notifications in the game under “Notifications”, your browser or device first asks for your permission. After that we store, linked to your game account and for each device, the delivery address your browser creates for this, two technical keys used to encrypt the messages, the selected language and the time of the last successful delivery. The messages only contain events from the game (e.g. “Mission complete”) and are handed over in encrypted form to the push service of your browser or operating system, which forwards them to your device. Depending on the device this is Google, Apple, Mozilla or Microsoft. These services cannot read the content but do process the delivery address, partly also outside the EU (e.g. in the USA). So that you do not get a message while you are playing, we briefly note the time of your last activity in the game (deleted after one hour at the latest). So that each message only arrives once, we keep a list of events already reported, which is deleted after three days. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time by turning notifications off in the game or blocking them in your browser or device settings. We delete devices that are turned off or no longer reachable, and deleting your game account removes all entries as well.
Bug reports: If you report a bug in the game, we store your text, a short technical note on where in the game it happened and, if you have a game account, your player ID, in order to trace and fix the bug (Art. 6(1)(f) GDPR). To protect against mass reports, your IP address is processed briefly (see above). Please do not include personal data in the report. We delete reports as soon as we no longer need them to fix the bug.
Contact form: If you write to us using the form next to the legal notice, we store your message and, if you provide them, your name and email address in order to handle your request and reply to you (Art. 6(1)(f) GDPR, for questions about a purchase or your game account Art. 6(1)(b)). To protect against mass messages, your IP address is processed briefly (see above). If you have a game account, we include your player ID so we can match your message to your account. Discord only informs us of a new message with a short notice, without its content, name or email address. We delete the message once your request has been dealt with, unless a statutory retention obligation applies.
Notifications to the operator (Discord): For certain events the server informs us with a short message in a private Discord channel that only the operator can access, no player and no other person. Only game data is transmitted: new investors and company foundings (investor and company name, player ID, product), special events such as finding a legendary item or treasure, rejected investor or company names for moderation, bug reports (see above), notices of new contact requests without their content and purchase confirmations with order number, package, amount and player ID. No data from Parqet is transmitted, no portfolio values, no real names, no address and no payment data. The investor name is the name you give yourself in the game. Only for security events, such as failed logins to the administration area, is the sender's IP address also transmitted. The provider is Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA. The transfer to the USA is based on appropriate safeguards (EU standard contractual clauses or the EU-US Data Privacy Framework). The legal basis is our legitimate interest in safe and moderated game operation (Art. 6(1)(f) GDPR). We delete the messages as soon as we no longer need them.
Block list for rule violations: If you seriously violate the game rules, for example through offensive or unlawful company or investor names, or through attempts at manipulation, we may block your game account. For this we store only your Parqet user ID (pseudonym), the time of the block and a brief internal note on the reason, in a separate block list. This list persists even if you delete your game account, otherwise a block could be circumvented by deleting and re-creating it. The legal basis is our legitimate interest in abuse-free game operation (Art. 6(1)(f) GDPR). Entries are deleted automatically after 12 months at the latest. Other game data is unaffected and is removed in full upon deletion as described. You may object to a block informally at any time (Art. 21 GDPR), contact details are in the legal notice. While your account is blocked, you cannot delete it yourself in the game. In that case, send an e-mail to support@depotempire.com and we will delete your game data for you as described above.
Your rights: You have the right to access your stored data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You manage data on your device yourself, you can delete your game data on the server at any time in the game (if your account is blocked, by e-mail, see “Block list for rule violations”), and for anything else an e-mail to support@depotempire.com is enough. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority where you live.
This game stores your save data (investor name, title and profile picture, population, treasury, building state, progress such as achievements/stars and login days, plus your music, volume and graphics settings) in your browser's localStorage, a local store on your device that is not transmitted to any server. This storage is technically necessary for the game to work (legal basis: Art. 6(1)(b) GDPR). Access to your device for this is permitted without consent under § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), because it is strictly necessary for the game to work. A technical cookie is also set (valid for 365 days) which only records that you have taken note of the privacy notice. Neither store contains personal data other than the investor name you chose yourself.
New, companies & exchange: If you use the optional company feature (unlocking the company grounds in game), a game account on our server is created for the first time, you are asked for separate consent beforehand, and nothing is transmitted without unlocking. Only pseudonymous game data is then stored (no credentials, no portfolio values). You can irreversibly delete this server data at any time in the game (imperials window or legal notice/privacy), except for purchase records that must be kept by law, if you have bought time crystals or the add-on (see below).
If you link your Parqet account via Parqet Connect, the portfolio ID, the portfolio name, the date of your first investment and the most recently retrieved portfolio values and dividends per asset class (including your filter settings) are stored exclusively in your browser's localStorage. Your browser keeps the Parqet access key (OAuth token) encrypted in a technically necessary cookie. Scripts on the page cannot read this cookie, it is only sent over HTTPS and only to the parts of our server that need access to Parqet, and it is valid until you disconnect, for at most 400 days. If your browser does not allow the cookie, the access key is kept in localStorage instead. The server decrypts the key only for the duration of a request, passes the request on to the Parqet API as a technical relay and stores nothing in the process (exception: the optional company feature, see below, even there your Parqet token is only used briefly for sign-in and never stored). The legal basis is Art. 6(1)(b) GDPR, and access to your device is permitted without consent under § 25(2) no. 2 TDDDG. You can disconnect at any time by holding the Parqet button for 2 seconds, which also deletes the cookie.
When the page is accessed, the web server processes your IP address for technical reasons so that the page can be delivered. The access logs are kept by our host IONOS (see below) as a processor, deleted after 7 days at the latest and not passed on to third parties. We serve fonts and graphics ourselves, so no data is transmitted to other providers when the page is loaded. External services (PayPal, Ko-fi, Parqet, Instagram, YouTube, Discord) are only reachable via links and are contacted only when you tap them. When the company feature is used, the IP address is additionally processed briefly to prevent abuse (rate limit, legitimate interest, Art. 6(1)(f) GDPR) and deleted automatically after one hour at the latest.
The "Tip" button leads to an external PayPal service. PayPal (Europe) S.à r.l. et Cie, S.C.A. is responsible for the data protection provisions applying there. The same applies to the Ko-fi button: it leads to Ko-fi (Ko-fi Labs Limited), whose privacy provisions apply there. The Ko-fi image itself is hosted on our server.
You can delete your save data and all stored data at any time by clearing your browser's site data (localStorage and cookies) for this site.
Companies & exchange (server storage): If you unlock the company grounds in game, a game account is created on our server. The hosting provider is IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany), acting as a processor under Art. 28 GDPR exclusively on our instructions, a data processing agreement is in place. Data is processed in data centres in the EU. Stored are: your Parqet user ID (pseudonym), your investor and company name, game metrics as normalised factors (0-1), the date of your last visit and your login streak. No credentials, no portfolio values, positions or amounts. Your company share price on the in-game exchange is derived from these factors, among other things from how your portfolio developed over the last 7 and 90 days, normalised and capped. Other players do not see any amounts, but can roughly tell whether your portfolio recently did better or worse than theirs. Legal basis: Art. 6(1)(b) GDPR. You can irreversibly delete this server data at any time in the game, in the menu under “🔒 Privacy” or in the imperials window (Art. 17 GDPR), except for purchase records that must be kept by law, see “Time crystals” and “Add-on” below:
Time crystals (paid optional feature): If you buy time crystals, we store your crystal balance on our server, the crystal history (time, amount and reason of every entry) and records of your purchases (order number, transaction ID, pack, amount, currency, status and time). Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
The sale itself is not handled by us but by CopeCart GmbH, Rosenstr. 2, 10178 Berlin, Germany. They sell in their own name and are the independent controller for name, address, payment data and invoice, that data never reaches us. CopeCart GmbH is responsible for the privacy terms applying there.
When a purchase starts, we transmit a pseudonymous, time-limited identifier of your game account to CopeCart, which comes back to us with the payment confirmation. It is the only way we can credit the crystals to the right account. It contains no plain data and expires after 60 minutes.
If you delete your game account, any remaining time crystals are forfeited and are not refunded. Purchase records must be kept for ten years by law (§ 147 AO, § 257 HGB); on deletion they are separated from your account and no longer contain any reference to you.
Add-on “Battles & Defence” (paid optional feature): If you have the add-on, we additionally store your add-on progress on our server: map and towers with levels and items, research, units and troop, your boss (animal, the name you chose, level, food, training and items), your war chest, defence and attack points, monthly ranking, badges and titles, and battle reports (attacker, defender, time, result, loot, bonuses and losses). For each battle we also store a log for the replay (course of the battle and the line-ups of both sides); it is deleted after 7 days. Battle reports are kept until one of the two accounts involved is deleted. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
What other players see in the add-on: Players with the add-on see your investor name, your profile picture, your city on the world map, your defence and attack level and whether a protection period is running. After a battle, the other side sees your investor name, the result, loot and losses and can watch a replay with your map and towers or your troop. Of your boss, they only see the animal and level, never the name you gave it. The ranking shows investor name, profile picture, points, badges and titles. This is necessary for battles between players (Art. 6(1)(b) GDPR).
If you buy the add-on, the same applies as for time crystals: the sale is handled by CopeCart GmbH, they receive only the pseudonymous identifier from us, and we store the unlock (add-on, time, any refund, reference to the purchase record) and the purchase record. If the purchase is withdrawn or refunded, your add-on progress is kept for 90 days so that a new purchase continues from there, and is then deleted automatically. Battle reports, rankings and badges remain. If you delete your game account, we delete all add-on data immediately, including the battle reports and replays you appear in, also in your opponents' battle history. Purchase records are kept for ten years as described above, separated from your account.
Notifications (web push): If you turn on notifications in the game under “Notifications”, your browser or device first asks for your permission. After that we store, linked to your game account and for each device, the delivery address your browser creates for this, two technical keys used to encrypt the messages, the selected language and the time of the last successful delivery. The messages only contain events from the game (e.g. “Mission complete”) and are handed over in encrypted form to the push service of your browser or operating system, which forwards them to your device. Depending on the device this is Google, Apple, Mozilla or Microsoft. These services cannot read the content but do process the delivery address, partly also outside the EU (e.g. in the USA). So that you do not get a message while you are playing, we briefly note the time of your last activity in the game (deleted after one hour at the latest). So that each message only arrives once, we keep a list of events already reported, which is deleted after three days. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time by turning notifications off in the game or blocking them in your browser or device settings. We delete devices that are turned off or no longer reachable, and deleting your game account removes all entries as well.
Bug reports: If you report a bug in the game, we store your text, a short technical note on where in the game it happened and, if you have a game account, your player ID, in order to trace and fix the bug (Art. 6(1)(f) GDPR). To protect against mass reports, your IP address is processed briefly (see above). Please do not include personal data in the report. We delete reports as soon as we no longer need them to fix the bug.
Contact form: If you write to us using the form next to the legal notice, we store your message and, if you provide them, your name and email address in order to handle your request and reply to you (Art. 6(1)(f) GDPR, for questions about a purchase or your game account Art. 6(1)(b)). To protect against mass messages, your IP address is processed briefly (see above). If you have a game account, we include your player ID so we can match your message to your account. Discord only informs us of a new message with a short notice, without its content, name or email address. We delete the message once your request has been dealt with, unless a statutory retention obligation applies.
Notifications to the operator (Discord): For certain events the server informs us with a short message in a private Discord channel that only the operator can access, no player and no other person. Only game data is transmitted: new investors and company foundings (investor and company name, player ID, product), special events such as finding a legendary item or treasure, rejected investor or company names for moderation, bug reports (see above), notices of new contact requests without their content and purchase confirmations with order number, package, amount and player ID. No data from Parqet is transmitted, no portfolio values, no real names, no address and no payment data. The investor name is the name you give yourself in the game. Only for security events, such as failed logins to the administration area, is the sender's IP address also transmitted. The provider is Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA. The transfer to the USA is based on appropriate safeguards (EU standard contractual clauses or the EU-US Data Privacy Framework). The legal basis is our legitimate interest in safe and moderated game operation (Art. 6(1)(f) GDPR). We delete the messages as soon as we no longer need them.
Block list for rule violations: If you seriously violate the game rules, for example through offensive or unlawful company or investor names, or through attempts at manipulation, we may block your game account. For this we store only your Parqet user ID (pseudonym), the time of the block and a brief internal note on the reason, in a separate block list. This list persists even if you delete your game account, otherwise a block could be circumvented by deleting and re-creating it. The legal basis is our legitimate interest in abuse-free game operation (Art. 6(1)(f) GDPR). Entries are deleted automatically after 12 months at the latest. Other game data is unaffected and is removed in full upon deletion as described. You may object to a block informally at any time (Art. 21 GDPR), contact details are in the legal notice. While your account is blocked, you cannot delete it yourself in the game. In that case, send an e-mail to support@depotempire.com and we will delete your game data for you as described above.
Your rights: You have the right to access your stored data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You manage data on your device yourself, you can delete your game data on the server at any time in the game (if your account is blocked, by e-mail, see “Block list for rule violations”), and for anything else an e-mail to support@depotempire.com is enough. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority where you live.