Privacy notice
Last updated 6 November 2026
DeeSighn / DSCloud9, Arnhem, the Netherlands, runs StellarAnvil and is responsible for your data (the “controller” under the GDPR). Questions or requests: privacy@stellaranvil.eu.
In short: we keep what the game needs, nothing more. No advertising, no analytics, no tracking, no third‑party scripts. Fonts and the sign‑up check run on our own server.
What we keep, why and for how long
| Data | Why (legal ground) | How long |
|---|---|---|
| Email address, commander name, password (only as a scrypt hash, never readable) | Your account: signing in, password reset (contract) | Until you delete your account |
| Profile: homeworld name, bio, chosen portrait and colours | Showing your profile in the game (contract) | Until you delete your account |
| Game data: planets, fleets, research, reports, notes, bookmarks, guild membership, daily standings | Playing the game (contract) | Until you delete your account |
| Messages and guild posts | Talking to other players (contract) | Inbox and sent messages 30 days; the Savebox until you empty it; guild posts until removed |
| Premium purchases: period, amount, VAT, date, the payment method and Mollie’s payment reference, the receipt | Delivering premium (contract) and keeping our books (legal obligation) | 7 years, as Dutch tax law requires, also after you delete your account |
| When and which version of the Terms you accepted | Being able to show that you did (legal obligation / legitimate interest) | Until you delete your account |
| Security log: IP address, browser (user agent), the account tried, the event (sign‑in, failed sign‑in, sign‑up, sign‑out, account deleted) | Keeping the game safe and fair: stopping password guessing and abuse, and spotting several accounts played by one person, for example accounts that use the same IP address (legitimate interest) | 90 days |
| Counters of failed attempts per IP address or account | Slowing down password guessing (legitimate interest) | At most about a day |
| Password reset: a hash of the link we mail you | Resetting your password (contract) | Until used or expired |
| Web server log: IP address, page, time, browser | Running and securing the server (legitimate interest) | 14 days |
| Backups of the database | Restoring the game after a failure (legitimate interest) | Daily copies 30 days, weekly 12 weeks, monthly 24 months |
Cookies and browser storage
One cookie, sf_session: it keeps you signed in, for at most 30 days or until you sign out. It is strictly necessary, so we do not ask for consent. The game also keeps a few interface choices in your browser’s local storage; they never leave your browser. The check on the sign‑up form (ALTCHA) runs on our own server and sets no cookie.
Who sees what
Other players see your commander name, your profile, your guild, your place in the rankings and what you do in the game world (for example fleets and battles). You can keep your name out of the galactic news on your profile. Other players never see your email address.
We do not sell or share your data. We use these processors, all in the EU:
- netcup GmbH, Nuremberg, Germany: the server the game runs on;
- Lettermint: sending our emails, such as a password reset or a receipt;
- Mollie B.V., Amsterdam, the Netherlands: handling premium payments. We never see your card or bank details; Mollie is also itself responsible for the payment data it processes (see Mollie’s own privacy statement);
- Hetzner Online GmbH, Germany: storing backups off site.
Backups are also kept on our own equipment in the Netherlands. Your data does not leave the EU.
When you delete your account
You can delete your account yourself on the Account page. Your account, profile and game data are deleted at once; your ships go to the Corsairs and your planets become free. What other players already received stays with them, without your name: messages you sent and posts in a guild. The security log keeps a record that the account was deleted, with its email address, for 90 days. Records of premium purchases stay for 7 years for the tax authorities. Backups made before the deletion still hold your data until they expire (at most 24 months); we only use them to restore the game, and after a restore we delete your account again.
Your rights
You may ask to see your data, to correct it, to delete it, to limit its use, to receive it in a common format, and you may object to its use on the ground of legitimate interest. Mail privacy@stellaranvil.eu from the address of your account; we answer within a month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Age
StellarAnvil is for players of 13 and older. If we learn that an account belongs to someone younger, we delete it.
Changes
When this notice changes, the date at the top changes too. Big changes are announced in the game. See also the Terms.