Privacy Policy

Iron Realms collects the least it can and sells none of it. This page says exactly what is stored, why, and how to get rid of it.

Effective 30 July 2026. If this changes materially, this date changes and a notice goes up in the game.

The short version

We store your email so you can sign in, a one-way hash of your password so we never hold the password itself, and your game progress so it follows you between devices. Your keep's position, power, name and house are visible to other players — that is the game. Nothing is sold, rented, or handed to advertisers.

There is no advertising SDK, no analytics vendor, and no tracking pixel in this client. Crash reports go to our own server, not a third party.

What we store, and why

If you register an account

• Your email address. It identifies your account and is the only way to recover it. It is never shown to other players — the forum and chat use your display name.
• A scrypt hash of your password, plus a random salt. Not the password. We cannot read it, tell it to you, or recover it; we can only reset it.
• A session token. A random opaque string proving this device is signed in, kept in your browser's local storage and expiring after 30 days. It is not a cookie and is not used to follow you anywhere.
• Your display name, house and kingdom. Chosen by you, shown to other players.
• Your saved game. Buildings, troops, research, inventory and progress, so the same realm loads on your phone and your laptop.

Because it is a shared world

• Your keep. Its map position, power, level, garrison and stored resources are visible to other players in your kingdom. Rival lords can scout and attack it. That visibility is the game, not a leak.
• Battle records. Raids, marches, rallies and their outcomes, so both sides can read the same report.
• Messages you send. Kingdom chat, alliance chat and forum posts, kept so the conversation persists and so moderators can act on reports.

Automatically

• Crash reports. When the game throws an error it POSTs the error, a short trail of recent in-game actions, and the app version to our own server. No page contents, no keystrokes, no third party.
• Server logs. Our host (Vercel) records request metadata including IP addresses, as any web server does, for security and abuse prevention.

What we do not do

We do not sell or rent your data. We do not share it with advertisers or data brokers. We do not embed third-party analytics or advertising code. We do not build a profile of you for marketing, and we do not track you across other sites — there is nothing in the client capable of it.

Playing without an account

You can play offline from the landing screen. Your realm is then stored only in your own browser and never reaches us — no email, no account, no server record. If you later register, that local progress is carried up to your new account.

Children

Iron Realms is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, message lordking_uhtred on Discord and we will delete it. Some regions set that age higher — where local law requires a higher minimum, that minimum applies.

Your rights

Wherever you live, you can get a copy of your data, correct it, or have it erased. Under the GDPR (Europe/UK) and the CCPA (California) these are legal rights; we extend the same handling to everyone because maintaining two standards is how mistakes happen.

• See it. Sign in and request an export — the game returns everything tied to your account as a single JSON file.
• Delete it. Deleting your account removes your login, your save, your keep, your battle records and your sessions. Messages you posted publicly are unlinked from you rather than removed, so conversations other players took part in stay readable — the same way a deleted forum account leaves the thread intact.
• Ask a human. Message lordking_uhtred on Discord and we will do it by hand.

How long we keep things

Account data lives until you delete the account. Session tokens expire after 30 days. Crash reports are kept while they are useful for fixing the bug and then discarded. Deleting your account takes effect immediately, not after a grace period.

Security

Passwords are hashed with scrypt and a per-account salt, so a stolen database does not yield passwords. Sign-in comparisons are constant-time, so an attacker cannot learn anything from how long a failure takes. Traffic is HTTPS end to end. Administrative endpoints are disabled unless an admin key is configured, and fail closed if it is not.

No system is perfect. If you find a vulnerability, please report it privately to lordking_uhtred on Discord before disclosing it publicly, and we will credit you.

Where your data is

The game runs on Vercel's infrastructure, with the database in the United States. If you play from outside the US, your data is processed there.

Changes

If this policy changes in a way that matters, the effective date above changes and the game shows a notice. We will not quietly widen what we collect.

Contact

Questions, requests, or corrections: Discord — lordking_uhtred.

This policy describes the system honestly and specifically, but it is not legal advice and its authors are not your lawyers.