Privacy policy

The short version

Five things worth knowing

Warpack is an asynchronous PvP game. The army you build is uploaded so other players can fight it, with your Steam name on it. That is the game, not a side effect.
We never store your Steam ID. Your online key is a one-way hash of it. The key cannot be turned back into your Steam profile.
Every fight is recorded (both armies, the result, the round, your rating at the time) so we can balance the game and catch cheating. These records are deleted after at most six months.
No ads, no analytics SDK, no selling or sharing of data for marketing. The game talks to our own servers and to Steam, nothing else.
You can ask us to show, correct or delete your data at any time, by email.

In the game

What Warpack sends, and why

This applies to the Warpack demo and the full game alike. The game sends data to our backend at api.n1ghtmarestudios.com when you play with an internet connection. Without one, it plays fully offline against your own saved armies and bundled rivals, and nothing below is sent.

Data	What it is	Why we need it	Kept for
Online key	A one-way hash (salted SHA-256) of your Steam ID. If you play outside Steam, a hash of a device identifier instead. We never store the Steam ID or the device identifier themselves.	To tell your uploads apart from everyone else's, keep you from fighting your own armies, give you one ladder row, and block cheaters.	As long as the rows it sits on, see below.
Your name	Your Steam persona name. Outside Steam: a name you typed in Settings, or one the game made up for you.	Shown to the players who fight your army (the matchup screen, the recap) and on the ladders.	With the ghost army, ladder row or match record it is on.
Ghost armies	The army you fielded: units, levels, items, commander, faction, formation, the round, your wins in that run, your rating, the season and the arena you chose, plus the game version.	Other players fight it. This is the multiplayer.	Up to 14 days, then deleted automatically.
Ladder rows	Your name, faction, season, rating, peak rating, tier, title, crowns and the commander you earned them with.	The RANKS screen in the game.	While that season's ladder is shown in the game, and at most twelve months.
Match records	For every fight: both armies as fielded, the random seed and the result, the round and your run's record, your rating at the time, gold, the cards you picked that run, fight length, and the game settings in force (text size, battle speed, whether you played on a Steam Deck), together with your operating system version, the game version and the time.	Balancing the game, tuning matchmaking, finding bugs and spotting impossible armies or gold (cheating). Every balance patch is measured on these records.	Up to six months, then deleted. We keep aggregate statistics that no longer identify anyone.
IP address	Our hosting providers see your IP address to deliver the data, as any server does.	Delivery and abuse protection. We do not store it in our own tables.	In the providers' own logs, under their policies.

Steam

Achievements, Steam leaderboards and Steam Cloud saves are run by Valve under your Steam account and Steam's privacy policy. The game uploads a score to Steam leaderboards together with a small detail (which commander you played). Your save files are stored on your computer and, if you have Steam Cloud on, in your Steam Cloud storage. We receive none of that.

The ladder's friends filter reads your Steam friends list on your own computer and compares hashed keys locally. Nobody's friends list is uploaded.

Cheating

If an account uploads armies or gold the rules of the game cannot produce, its online key can be blocked from the ghost pool and the ladders. The block is tied to the hashed key. Write to us if you think a block is wrong.

On your own computer

The game writes its save files and a log file on your machine. The log can contain the names of the opponents you fought. It stays on your computer and is only ever read if you choose to send it to us when reporting a bug.

The legal side

Why we are allowed to do this

Our legal basis is legitimate interest (GDPR article 6(1)(f)). Uploading your army and your name is what makes Warpack a multiplayer game, and the match records are the only way to balance a game of this kind honestly and to keep cheaters out of everyone else's fights. We have weighed this against your interests: the data is pseudonymous, it is deleted on a schedule, it is used for nothing else, and the name shown is the one you already show on Steam. You can object at any time, see below.

We make no automated decisions with legal or similarly significant effects about you, build no profiles for advertising, and sell no data.

Who sees it

Other players, and the companies that host us

Other players see your name, your army and your rank in the game, because that is what they are fighting and climbing against.
Supabase Inc. hosts our database and API under a data processing agreement that includes the EU standard contractual clauses for any processing outside the EU/EEA.
Cloudflare Inc. provides the network in front of our API and website under its data processing terms.
Valve Corporation (Steam) is a separate controller for everything that happens through your Steam account.

No other company receives the data. We hand it over to authorities only when the law obliges us to.

Your rights

What you can ask us to do

Under the GDPR you can ask to see the data we hold about you, have it corrected, have it deleted, have its use restricted, object to the processing, and receive a copy in a machine-readable format. Email contact@n1ghtmarestudios.com.

Because we store a hash of your Steam ID rather than the ID itself, we cannot find you from your name alone. Include a link to your Steam profile in the request; we compute the same hash and find your rows with it. If you play outside Steam, include the name shown in the game.

A deletion request removes your ghost armies, your ladder rows and the match records keyed to you, and strips your name from match records where you were the opponent. Steam achievements, leaderboards and Cloud saves are deleted through Steam, not through us.

If you think we are handling your data wrongly, you can complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), or to the authority in your own country.

This website

n1ghtmarestudios.com

The site is static and is hosted on GitHub Pages. GitHub may log the IP address of visitors to serve and protect the site, under the GitHub privacy statement.
We count page views with Cloudflare Web Analytics, which uses no cookies and no cross-site tracking and gives us only aggregated numbers.
A few pages load fonts from Google Fonts, so your browser fetches them from Google's servers. The main pages use fonts hosted here.
The free browser games on this site have small shared high-score boards. A score is sent only when you type a name and submit it; the name and score are stored on Cloudflare, and your IP address is held briefly to limit how many scores one visitor can post.
We set no cookies of our own.

N1ghtmare Studios AB