Last updated 2026-10-01

Privacy policy

Short version: we collect what it takes to run the game and the beta waitlist, nothing more. No ads, no tracking cookies, no selling data. Ever.

1. Who we are

Galleonfall™ is an independent game made by Giuseppe Occhipinti (Italy), a private individual, who is the data controller for the data described here. You can reach us at [email protected] for anything about your data.

2. What we collect, and why

The beta waitlist

• What: your email address; when you signed up and which wording of the consent box you ticked (our proof that you asked us to write); the page language; your country as reported by our network provider (not your IP address); whether you confirmed, were invited or unsubscribed.
• Why: to confirm your address, send your invite to the beta, and the occasional major announcement (a new season, the public launch). Nothing else.
• Legal basis: your consent (GDPR art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in every email.
• How long: until you unsubscribe, or 12 months after the public launch, whichever comes first.

Your game account

• What: email address, pirate name, password (stored only as a salted scrypt hash, which we can't read), sign-up and last-login dates; your game data (your cove, crew, fleets, voyages, reports); messages you write in guild chat; a login session.
• Why: to let you play: log in, keep your cove alive while you're away, and show other players what the game shows them (your pirate name, your cove on their chart, your guild messages to your guild).
• Legal basis: performing our agreement with you, the terms of use (art. 6(1)(b)).
• How long: while your account exists. Seasons end and their worlds are archived or reset; we delete your account on request, and accounts left unused for 24 months.

Server and security logs

• What: your IP address, the time, the page or action requested and your browser's user agent, in our servers' technical logs.
• Why: to keep the service secure and working: stopping abuse and brute-force attempts, and fixing bugs.
• Legal basis: our legitimate interest in a secure service (art. 6(1)(f)).
• How long: logs rotate automatically and are gone within a few weeks.

Error reports

• What: when something breaks in the game or on our server, a report of the error: what failed and where in our code, the page, your browser and system, and your account's random id. No email, IP address, cookies or game chat.
• Why: to find and fix bugs, often before anyone has to tell us.
• Legal basis: our legitimate interest in a working service (art. 6(1)(f)).
• How long: up to 90 days, then deleted.

Visit statistics

We count visits with Cloudflare Web Analytics, which uses no cookies and doesn't fingerprint or follow you across sites; we only see totals (pages, referring sites, countries, page speed). Legal basis: legitimate interest in knowing whether anyone reads the site (art. 6(1)(f)).

3. Cookies and local storage

• This website sets one cookie, and only if you pick a language: gf_lang remembers your choice for a year so the home page opens in it. Nothing else.
• The game sets one strictly necessary cookie, pe_session, which keeps you logged in (up to 30 days). It holds a random token, nothing about you.
• Our network provider, Cloudflare, may set a strictly necessary security cookie to tell people from bots.
• Your browser's local storage keeps your preferences (graphics quality, language, whether you've signed the waitlist). It never leaves your device.

Strictly necessary cookies and preferences you set yourself don't need consent, so there's no cookie banner. We'll ask first if that ever changes.

4. Who helps us run it

We don't sell, rent or trade your data, and we don't use it for advertising. A few providers process it on our behalf, under data-processing agreements:

• DigitalOcean: the server and database, hosted in the European Union.
• Cloudflare: domain, network protection, visit statistics and the bot check on the waitlist form.
• Brevo (Sendinblue SAS, France): delivering our emails.
• Sentry (Functional Software, Inc.): error reports, stored in its EU data region.

Some of these companies are based in the United States. Transfers are covered by the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses.

5. Your rights

You can ask to see, correct, delete or take a copy of your data, to restrict or object to how we use it, and withdraw consent at any time. Write to [email protected] and we'll answer within 30 days. You also have the right to complain to a data-protection authority: in Italy, the Garante per la protezione dei dati personali, or the authority where you live.

6. Children

Galleonfall isn't meant for children under 14. If you're below the age of digital consent in your country (14 in Italy, up to 16 elsewhere in the EU), you need a parent's or guardian's permission to make an account.

7. Changes

If this policy changes in a way that matters (for example, if the game ever shows ads), we'll update this page first and tell players in the game. The date at the top shows the latest version.