Privacy Policy
Version 1 · effective 13 October 2026
Who is responsible
Ludwig Markt, Loretzgasse 6e, 39023 Laas (BZ), Italy · ironmeltgame@gmail.com
Ironmelt: Fight for GAIA is an independent game made by a private individual. There is no data protection officer; please write to the address above for anything related to your data.
The short version
- We store only what your account needs: your player name, your email address, your password (as a one-way hash), your cloud bots and a few dates.
- We do not store IP addresses in our logs, we do not use tracking, ads or analytics, and we do not sell or share your data.
- You can download all your data and delete your account yourself at any time on your account page. Deleting is immediate.
What we store and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Player name, email address | To create and identify your account and to let you log in; to send you account emails (confirm address, reset password) | Art. 6(1)(b) — contract |
| Password | To log you in. Stored only as an Argon2id hash — nobody, including us, can read your password | Art. 6(1)(b) |
| Age confirmation, accepted terms version, account creation date, last login | To prove that you agreed to the terms and confirmed your age; to clean up unused accounts | Art. 6(1)(b), 6(1)(c) |
| Cloud bots (bot name, class, CPU, building data), your chosen battle bot | So you can use your bots on any computer and on your phone | Art. 6(1)(b) |
| Login sessions (a hash of your login token, expiry date) | To keep you logged in for up to 30 days | Art. 6(1)(b) |
| One-time codes (hashed) for confirming your email or setting a new password | Account security. They expire (password codes after 30 minutes) and work only once | Art. 6(1)(b) |
IP addresses. Your device's IP address is necessarily processed while it talks to our server (website, launcher updates, account functions, online matches). We use it only in the moment — for example to slow down repeated failed logins — and we do not write it to any log file or database. Our web server keeps a technical access log without IP addresses or browser details (only time, page, status and size), which we use to count downloads.
Your device. The account page stores your login token in your browser's local storage so you stay logged in; the game stores it in its own settings folder. Logging out removes it. We use no cookies.
Who processes data for us
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — hosts our server in Germany (EU). A data processing agreement under Art. 28 GDPR is in place.
- Brevo (Sendinblue SAS), 106 boulevard Haussmann, 75008 Paris, France — sends our account emails (confirm your address, reset your password) from noreply@ironmeltgame.com. Brevo receives only your email address and the content of that email. A data processing agreement under Art. 28 GDPR is part of Brevo’s terms. We send no newsletters or advertising.
Your data stays in the EU. We do not transfer it to other countries.
Our Discord server, YouTube channel and itch.io page are run by those companies under their own privacy policies; they are not connected to your Ironmelt account.
How long we keep it
- Your account data and cloud bots: until you delete your account. Deleting removes everything immediately and for good.
- Server backups may still contain your data for up to 14 days after deletion; they are then overwritten. Backups are used only to restore the server after a failure.
- Login sessions: 30 days after your last use. One-time codes: until used or expired.
- Accounts that have not been used for 3 years may be deleted after we notify you by email.
- If we shut down the online services, we will announce it in advance and then delete all account data.
Age
You need to be at least 14 years old to create an account (Art. 8 GDPR together with Art. 2-quinquies of the Italian Privacy Code). If you are younger, a parent or legal guardian must agree to the account for you.
Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format (Art. 15–21 GDPR). The fastest way: Download my data and Delete account on your account page. For anything else, write to ironmeltgame@gmail.com.
You also have the right to complain to a data protection authority, for example the Italian Garante per la protezione dei dati personali (garanteprivacy.it).
Security
Passwords are hashed with Argon2id, login tokens and one-time codes are stored only as hashes, all account traffic is encrypted (HTTPS), the database is not reachable from the internet, and repeated failed logins are slowed down. No system is perfectly secure; if we ever learn of a breach that affects your data, we will inform you and the authority as required by law.
Changes
If this policy changes in a way that matters for you, we will tell you in the game or by email before it applies. The version number at the top changes with every update.