Who is responsible

The controller for personal data processed in connection with Terra Idle is Maximilian Meister, Postfach 80 07 10, 70563 Stuttgart, Deutschland. For any privacy request, write to contact@machinebot.xyz. Provider details are also in the Impressum.

What we collect

We keep the data needed to run an account-based game, and very little else.

Account data. Email address, password hash (if you register with email), the display name you choose, and the date the account was created. Passwords are hashed by the authentication library; we never see them in plain text.
Guest data. If you play as a guest, we create a random account identifier and a temporary address in a reserved, non-deliverable domain. No email is sent there. Your chosen name and progress are stored exactly as for a registered account.
Linked sign-in providers. If you sign in with Google or Apple (when available), we store the provider's account identifier, and the name and email address the provider shares with us. We do not request access to your mail, contacts, or files, and we do not request advertising scopes.
Game data. Your player identifier, currency balance, progress timestamps, ledger entries, and stored responses for idempotent commands.
Session and technical data. A session identifier, expiry time, and the IP address and user agent recorded on the session. Server logs contain the request path, status, timing, and IP address.
Support messages. Whatever you include when you email us.

We do not collect payment data in the current build, because nothing is for sale. We do not use advertising identifiers, cross-site tracking, or third-party analytics.

Cookies and local storage

We use one essential cookie for signed-in web sessions. It keeps you signed in and is not used for advertising or analytics. The native app stores its session token in the operating system's secure storage. Our hosting and tunnel provider (Cloudflare) may set short-lived security cookies when it protects the service from abusive traffic.

There is no consent banner because we do not use non-essential cookies.

Why we process it

Under the EU and UK GDPR, we rely on:

Performance of a contract (Art. 6(1)(b)) for creating and operating your account, storing your game progress, and providing the service you asked for.
Legitimate interests (Art. 6(1)(f)) for keeping the game secure, preventing cheating and abuse, rate limiting, debugging, and maintaining service integrity. We keep this data minimal and do not use it for advertising.
Legal obligation (Art. 6(1)(c)) where we must retain or disclose something under applicable law.
Consent (Art. 6(1)(a)) where we ever ask for something optional, such as an email newsletter. You can withdraw consent at any time.

Who we share it with

We do not sell personal data. We use a small number of processors to operate the game:

Cloudflare — DNS, content delivery, and the secure tunnel in front of our servers. Request data, including IP addresses, passes through Cloudflare.
Our hosting infrastructure — the application server and PostgreSQL database that store accounts and game state.
Google and Apple — only if you choose to sign in with them. They process the sign-in under their own privacy policies.
Cloudflare Email Service — when transactional email is enabled, it sends verification and password-reset messages and processes the recipient address and message content on our behalf. Replies are not monitored; the support address above is the contact channel.

Payment processors will be added only if and when purchases exist. We will update this policy before that happens.

How long we keep it

Account and game data — until you delete your account.
Server logs — short-lived operational logs, rotated automatically by size.
Backups — database backups are kept for up to 14 days, then rotated out. A deleted account may therefore remain in a backup for a short period before it is overwritten.
Support email — kept only as long as needed to resolve and document the request.

Deleting your account

You can delete your account inside the app: open Account and choose Delete account. This removes the account, linked sign-in records, sessions, player state, and game history. You can also read the deletion page for the full instructions, including a fallback by email.

Deleting a guest account permanently discards that guest's progress, because there is no other credential attached to it.

Your rights

You have the right to access, correct, delete, restrict, or object to the processing of your personal data, and the right to data portability where it applies. Write to contact@machinebot.xyz and we will respond within the period required by law, normally within 30 days.

You also have the right to complain to a supervisory authority. Because the controller is based in Germany, the competent authority is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg. You may complain in the EU member state where you live or work.

Children

Terra Idle is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has created an account, contact us and we will delete it. Where local law sets a higher minimum age for consenting to online services, that age applies.

International transfers

Our application and database run on infrastructure we control. Cloudflare and the sign-in providers operate globally, including in the United States, and may process data outside the EU/EEA. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision. You can ask us for more information about the safeguards used.

Changes

If this policy changes in a way that affects you, we will update the date above and, for material changes, tell you in the app or by email. The current version is always available at /privacy.

Contact

Email contact@machinebot.xyz. Postal address: Maximilian Meister, Postfach 80 07 10, 70563 Stuttgart, Deutschland.