Privacy Policy

Wardens of Ilvaran · last updated November 10, 2026

This privacy policy explains what personal data is processed when you play Wardens of Ilvaran, the browser card-dueling game (the “Game”), and how it is used.

1. Administrator

The Game is administered by VILQ Grzegorz Wilczyński (“Administrator”). Email: [email protected].

2. Data processed

• Account data: the nickname you choose and your email address. The Game has no passwords: you log in with one-time links sent to your email. Login links and session tokens are stored only as one-way hashes.
• Game data: your characters (up to 12) and their progress – name, portrait, colour, level, experience, gold, deck, cards, quests, position on the map and similar game state – and progress shared across your account (Chronicle, Keywords, Bestiary, Collectables and Achievements).
• Activity data: the time you were last active, used to show how many players are online.
• Technical data: IP address and browser information in server logs, the IP address of login and activation requests (to limit abuse), and the cookies and browser storage described in section 6.
• Anti-bot check: when you log in or create an account, Google reCAPTCHA checks that the request comes from a person and not an automated program. For this, Google processes your IP address, browser and device information and how you interact with the page.
• Messages you send to the Administrator by email.

You can play without an account; then your progress is kept only in your browser and no game data is sent to the server.

3. Purposes and legal bases

• providing the Game, your account, saving your characters and shared progress, sending login and activation emails – performance of a contract (Art. 6(1)(b) GDPR),
• security, preventing abuse and cheating, error analysis, statistics and improving the Game, answering messages – the Administrator’s legitimate interest (Art. 6(1)(f) GDPR),
• non-essential cookies (e.g. analytics), if enabled – your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the cookie banner.

4. Recipients

Personal data is not sold. It may be processed on behalf of the Administrator by: the hosting provider of the Game’s server, Google (sending the login and activation emails through Google’s mail service, and the reCAPTCHA anti-bot check on login and registration, for which Google’s Privacy Policy and Terms also apply), CookieScript (the cookie consent banner) and the content delivery networks that serve parts of the Game’s code and fonts (jsDelivr and Google Fonts), which see your IP address when your browser downloads those files. Some of these providers may process data outside the European Economic Area; in that case transfers are based on the safeguards required by GDPR (e.g. standard contractual clauses).

5. Retention

Account and game data is kept until the account is deleted. Deleted characters are removed at once. Accounts that are never activated are removed after 7 days. Login links expire after 20 minutes (activation links after 48 hours) and logins after 30 days. Server logs and records of sent emails are kept as long as needed for security and statistics, then deleted or anonymised.

6. Cookies and browser storage

The Game uses a cookie needed for it to work: the login cookie that keeps you signed in. It also stores your settings (graphics quality, zoom, brightness, tutorials already seen) and, when you play without an account, your saved game in your browser’s local storage; these never leave your device. Your cookie choices are managed in the CookieScript banner, which you can reopen at any time from its small icon, or in your browser settings.

7. Your rights

You have the right to access your data, rectify it, delete it, restrict its processing, port it, and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. You can delete your characters in the Game; to delete your whole account, write to [email protected] from the email address of the account. You also have the right to lodge a complaint with the supervisory authority – in Poland the President of the Personal Data Protection Office (Prezes UODO).

8. Children

The Game is not directed at children under 16.

9. Data protection

The Administrator uses appropriate technical and organisational measures to protect personal data against loss, unauthorised access, disclosure, alteration or destruction. Connections to the Game are encrypted (HTTPS).

10. Changes

This policy may be updated. The current version is always available on this page; registered players will be informed about significant changes by email.

Contact

Administrator: VILQ Grzegorz Wilczyński
Email: [email protected]