Privacy Policy

1. Who we are

RiftArmada is run from Spain by Muhammed Erdem, trading as Cindaris Studios (“we”, “us”). We decide how your information is used, which makes us its controller under the GDPR. This policy covers the game, its servers and this website.

• Controller: Muhammed Erdem, trading as Cindaris Studios
• NIF (Spanish tax number): Z1331321V
• Postal address: Ctra. de Carmona, 40, Escalera B, 4B, 41008 Sevilla, Spain
• Email: contact@riftarmada.com

Write to that address about anything in this policy.

2. What we collect

• Account: your login name, your password stored only as a secure hash, an account id, and your email address if you gave one. If you link a sign-in from another service, the id that service gives us for you, never its password.
• Age check: we ask for your date of birth when you register, use it to check the minimum age in section 10, and then do not keep it. What we store is that the check passed, when it passed, and which minimum age was applied. We never hold your birthday.
• Agreement record: which version of our Terms you accepted, and when.
• Your pilots: each pilot’s nickname (other players see it), its id, faction, level, progress, ships, items, skins, titles and in-game currencies, with a ledger of every change to those currencies. Each pilot, with its currencies and progress, lives on one game server. They are kept on that server, not on your account.
• Chat: the messages you send on the global, faction, map, clan and squad channels, with the nickname that sent them, the channel, the time and, on map chat, the map. Our word filter hides some words from other players, but we keep what you actually typed so that a moderator can read it. RiftArmada has no private messages. The players you block are remembered on your own device, not by us.
• Clans: clan names, tags, descriptions and noticeboard posts, which are written by players and visible to others.
• Moderation: reports you file about other players and reports other players file about you, plus any mute or ban applied to your account, and the reason recorded for it.
• Sign-in history: each time the game signs you in, the IP address it came from, your operating system and device model, and the game version, with when we first and last saw that combination. We also record when each play session starts and ends. Only our support and moderation staff can see it. We use it to secure accounts and to spot abuse, such as a banned player coming back on a new account or one person running several accounts to cheat. We never use it for advertising.
• Daily activity: which days your account signed in, with the game version, and the daily totals of what each of your pilots earned. We use them to count how many players come back, and our staff use them to look into suspected cheating.
• Support and bug reports: the support tickets you open, and the bug reports you send from inside the game, which carry your text, your nickname, the server, the map, your level and a screenshot of the game.
• Crash reports: when the game or one of our servers fails, a report of what went wrong, with the game version, the device model and the operating system. We do not attach your account to them.
• Beta news: if you ask on this website to be told about the beta or launch, the email address you give. We keep it until you unsubscribe or the campaign ends.
• Technical: IP address, device and client information, and server logs, used to run and secure the service.

We do not collect your location, contacts, photos, microphone or camera, health data, or any advertising identifier, and the beta takes no payments. Nothing about you is used for advertising or to track you across other apps and websites.

2a. Cookies and visit counts

To know how many people visit and what they look at, this website uses Cloudflare Web Analytics, run by Cloudflare, which already hosts the site. When a page loads, it records the page, the site that linked you here, your country, your browser and type of device, and how fast the page loaded. It does not use cookies or your browser’s storage to recognise you, it does not follow you to other sites, and it gives us totals only, never a record of an individual visitor.

Apart from that, the website runs no advertising tags and no other third-party trackers, and it stores nothing in your browser while you read it. That is why you are not being asked to accept anything.

The home page opens in the language your browser asks for. If you pick a language yourself with the language switcher, we remember that choice in one cookie that holds only the language code (for example tr) for a year, so the site keeps your pick over your browser’s. It is set only when you pick, it says nothing else about you, and deleting it simply lets your browser decide again. It is strictly necessary for the choice you made, so no consent is required.

The other exception is the help centre. When you sign in there to open or read a support ticket, we set two cookies that hold your sign-in session. They exist only so the page can tell it is you, they are readable by our server and not by scripts in the page, they expire after 7 days, and signing out removes them at once. They are strictly necessary for the feature you asked for, so no consent is required, and we use them for nothing else.

The game client and the launcher are separate from this site. They keep a sign-in token on your own device so you do not have to log in every time, which is part of running the service rather than tracking you.

3. How we use your information

• To run the game and your account, and to keep you signed in.
• To keep accounts secure, and to stop cheating, fraud, ban evasion and abuse.
• To moderate chat, names and clans, and to act on reports, as our Terms describe.
• To answer support tickets, and to fix the bugs and crashes you and the game report.
• To send the email the service needs (verification, password reset, your data export, account deletion) and, if you asked for it, beta news. You can unsubscribe from the news at any time.
• To understand and improve gameplay, balance and performance, from our own figures.

4. Legal bases

Where the GDPR or a similar law applies, we rely on:

• our contract with you, to run your account and the game;
• our legitimate interests, for security, anti-cheat, moderation, crash reports and our own figures, which we weigh against your rights and which you can object to (section 9);
• legal obligations, where a law requires us to keep or hand over a record;
• your consent, for beta news, which you can withdraw at any time.

5. Who handles your data

We do not sell your information and we do not share it for advertising. These companies process it for us, only on our instructions and under a data processing agreement with each:

• OVH (OVH SAS, France) hosts our game servers and databases, in Frankfurt, Germany.
• Cloudflare (Cloudflare, Inc., United States) runs this website and its visit counts, delivers the game’s downloads and updates, runs our domain’s DNS, forwards the mail sent to our addresses, and stores our database backups in the EU.
• Resend (Resend, Inc., United States) sends our email and keeps the beta news list.
• Sentry (Functional Software, Inc., United States) receives crash reports and in-game bug reports. Our Sentry data is stored in its EU data centres, in Germany.

On phones, the game reaches you through Apple (TestFlight and the App Store) and Google (Google Play). They handle your download and your store account as controllers in their own right, under their own privacy policies. Apple shares with us the install and crash figures TestFlight gathers and any feedback you choose to send through it. If you join our Google Group to test the game on Google Play, we can see the email address of the Google account you joined with, and we use it only to run that test.

Our community Discord is run by Discord, under its own privacy policy. We disclose your information to anybody else only where the law requires it.

6. International transfers

Our servers, databases and backups are in the European Union, in Germany. Cloudflare, Resend and Sentry are US companies: Cloudflare serves this website and the game’s downloads from the data centre closest to you, wherever that is, and these providers may process or access data in the United States. When data leaves the European Economic Area, it is protected by the European Commission’s Standard Contractual Clauses or by the EU-US Data Privacy Framework, depending on the provider.

If you play from Türkiye, or from anywhere else outside the EU, what you send us is transferred to the EU to be stored and processed there.

7. How long we keep it

We keep your account and game state for as long as your account exists. Some data is deleted on a fixed schedule regardless of that, and these are the periods we actually run:

• Chat messages: 90 days, then deleted.
• Sign-in history and play sessions: 90 days after we last saw that address and device, or after the session started, then deleted.
• Password reset and email verification links: 30 days after they expire, kept that long so we can investigate a suspicious sign-in.
• Our copies of the email we send you: 30 days after delivery.
• Detailed gameplay events: 90 days. Aggregate figures that name nobody, such as daily totals for an economy, are kept for up to two years.
• Daily activity: for as long as your account exists.
• Crash and bug reports: at most 90 days, in Sentry.
• Support tickets: with your account. Deleting the account removes your email address from them.
• Reports and moderation records: kept while they are needed to enforce our Terms. A ban that can be evaded by deleting the record is not a ban.
• Beta news list: until you unsubscribe or the campaign ends.

Our database backups hold older copies of all this. We use them only to restore the service after a failure, never to bring back an account or data that was deleted.

8. When you delete your account

You can delete your account in the game (Settings, Account, Delete Account). If you cannot use the game, Delete your account explains the other ways. Deletion takes effect at once and cannot be undone. We do not erase every row: we delete or scramble everything that identifies you, and keep a few records that no longer name anybody.

• Deleted at once: your email address, login name and password, any linked sign-in, your language, your sign-in history (addresses and devices), your sign-in tokens and pending links, every email we queued or sent to you, and your email address on your support tickets. Each pilot’s nickname is replaced by “del-” and the pilot’s number, so the name is free for somebody else.
• Kept, no longer naming you: the record that you passed the age check and which version of the Terms you accepted and when; the currency ledger and reward history behind your pilots, with their game records; reports and moderation records; and your daily activity. Chat messages and play sessions stay until their 90 days run out.

We keep these because they are the proof that an account existed, was age-checked and accepted our Terms, and that in-game transactions happened, and we may need them to meet a legal obligation or to defend a claim.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing.

Two of those you can exercise yourself, without asking us. Delete your account in the game (Settings, Account, Delete Account), or follow these steps if you cannot use the game. Request a copy of your data from the same place (Settings, Account, Your data): we email you a link to a page on this website, and its Download my data button saves a JSON file. The link works once and expires after 48 hours, and it goes to your address rather than back to the game that asked, so a signed-in session somebody else is using cannot collect it.

The file holds your account (login name, email, language, sign-up, consent and age-check dates, and any linked sign-in), each of your pilots (server, nickname, faction, level, currencies, ships, items, skins, titles, clan and VIP), purchases made with real money, your wallet history, your chat messages, clan posts and support tickets, the reports you filed and those about you, any mute or ban, and your sign-in history and play sessions. It opens with why we keep your data, who we share it with, how long we keep it and your rights. It leaves out other players’ data, such as who reported you.

For anything else, or if a request needs a human, contact us at contact@riftarmada.com.

If you think we handle your data wrongly, you have the right to complain to a data protection authority. In Spain, where we operate, that is the Agencia Española de Protección de Datos (AEPD, www.aepd.es); you can also complain to the authority where you live. If you live in Türkiye, you can apply to the Personal Data Protection Board (KVKK, www.kvkk.gov.tr) after writing to us first.

10. Age

You must be at least 16 to register. We ask for your date of birth when you create an account and refuse registrations below that age. Sixteen is the highest age of digital consent in the European Union; if the minimum age where you live is higher, that higher age applies to you.

RiftArmada is not directed to children under that age and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will remove it.

11. Security

Passwords are stored only as salted hashes. This website, signing in, and every request to our account and game services travel over HTTPS, which is encrypted.

The game’s live connection is different. Flight, combat and chat travel to our game servers over UDP and are not encrypted today, so somebody who can watch your network, such as whoever runs a public Wi-Fi network, could read them. Your password never travels on that connection; the pass the game uses to join a server does, and it expires within minutes. Do not type anything in chat that you would not say in public.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. Changes

We may update this policy from time to time. We will post the new version here with its date and, for material changes, provide a more prominent notice.

13. Contact

Questions about this policy or your information: contact@riftarmada.com.