Privacy policy
Who we are
TrainWars is run by a sole trader in Sweden (name at the bottom of this page). We decide why and how your personal data is used, so we are the "controller" under the EU data protection law (GDPR). Contact: support@trainwars.com.
What we collect
| Data | Why | Legal basis |
|---|---|---|
| Your email address and writer name | Sign in with an email link; show your name in the game | Contract (providing the game) |
| Your paintings, blackbook pages and photos | Save them to your account so you can reopen them on any device | Contract |
| Purchase record (that you own the Full Game, and the Stripe payment reference) | Unlock the Full Game; handle refunds | Contract; legal duty (bookkeeping) |
| Community posts: the photo, its title, your writer tag, likes and reports you make | Show your post on the public community wall; count likes; handle reports | Contract (you choose to post) |
| Room reports: who you reported and in which room, the reason, your note, the screenshot you attach and the reported player's recent chat lines as you saw them | Review reports; remove players from a room after reports from two players; keep online rooms safe | Legitimate interest (safety of other players) |
| Your invite link (a random code) and whether anyone opened it | Unlock the Warsaw map for you when a friend opens your link | Contract (providing the game) |
| Technical data (IP address, browser) in server logs | Keep the service running and secure | Legitimate interest |
| Pages visited and browser information, if you allow analytics cookies | Understand how visitors use TrainWars through Google Analytics | Consent |
You can play without an account. Your painting then stays in your own browser (local storage). Google Analytics loads only if you choose “Allow analytics”; if you decline, no Analytics data is sent. We do not use advertising cookies or sell your data. You can change your choice at any time with .
Who else handles your data
- Supabase – database, sign-in and file storage. Our project is hosted in the EU (Ireland).
- Vercel – hosts the website. May process your IP address in the US and elsewhere.
- Stripe – takes payments. Your card details go to Stripe, never to us.
- Resend – sends the sign-in emails.
- Cloudflare – domain name system.
- Google Analytics – measures visits if you allow analytics cookies.
- Google Fonts – the page loads fonts from Google, so Google sees your IP address.
Where data goes outside the EU/EEA, these providers rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
- Account, paintings, blackbook and photos: until you delete them or ask us to delete your account.
- Community posts: until you delete the post or your account. Your writer tag and posts are public while they are up.
- Purchase and payment records: 7 years, as Swedish bookkeeping law requires.
- Invite link: until you delete your account. It holds no one else’s details: we do not see who opens it.
- Server logs: a short time set by the provider, normally under 30 days.
Your rights
You can ask us to show you your data, correct it, delete it, limit its use, or give you a copy. You can object to use based on legitimate interest. To use a right, email us. We answer within one month. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or your local authority.
Children
TrainWars is for people aged 13 and over. If you are under 13, do not create an account.
Changes
If we change this policy in a way that matters, we will change the date above and tell signed-in players in the game.
Controller: Albin Herbst, sole trader, Sweden.