BARONSPrivacy Policy
Effective date: 21 October 2026
Barons ("the game", "we", "us") is published by WPPF Development (sole proprietorship / eenmanszaak), Rompert Park 131, 5233 RL 's-Hertogenbosch, the Netherlands, Chamber of Commerce no. 80816770 ("we"). We are the controller of your personal data. Contact: support@playbarons.com.
1. What we collect and why
| Data | When | Why (purpose) | Legal basis (GDPR) |
|---|---|---|---|
| Account identifiers: an internal account id; your e-mail address and a hashed password if you register with e-mail; an Apple or Google account identifier (and the e-mail and name those services share) if you sign in with Apple or Google | When you create or link an account | To create your account, sign you in and keep your progress | Contract (art. 6(1)(b)) |
| Guest device identifier: a device identifier or a random id stored on your device | When you play as a guest | To let you keep playing on the same device without an account | Contract |
| Company name (display name) and company logo / business card choices | When you choose them | Shown to other players on rankings, rival lists, business cards and in-game events | Contract |
| Gameplay data: buildings, tiles, money, orders and trades, research, progress, achievements, last activity time | While you play | To run the game, the shared market and the rankings | Contract |
| Settings: language (en/nl), notification preferences, UI theme | When you change them | To respect your choices | Contract |
| Push token: device push token, platform, app version, language | When you allow notifications | To send the notifications you switched on | Consent (via the OS permission); you can switch them off any time |
| Purchase records: store, product, transaction id, purchase status and the receipt or transaction data the App Store or Google Play returns; what you are entitled to | When you buy something | To verify the purchase, deliver it and prevent fraud | Contract; legal obligation (bookkeeping) |
| Rewarded-ad callbacks (only once rewarded ads exist): ad network, transaction id, your account id | When you choose to watch an ad for a reward | To grant the reward once | Contract |
| Technical logs: server logs with timestamps and error details; IP addresses may appear in web-server and error logs and are used briefly for rate limiting | When you use the game | Security, abuse prevention, troubleshooting | Legitimate interest (art. 6(1)(f)) |
We do not collect your location, contacts, photos, microphone, health or financial data, and we do not ask for your date of birth. We do not sell personal data. The game currently contains no third-party advertising, analytics or crash-reporting SDKs.
Payment details are handled by Apple or Google. We never see your card or bank details.
2. What other players can see
Your company name, company logo, business card, rank, net worth and public gameplay (for example, that your company passed theirs) are visible to other players. Your e-mail address and sign-in details are never shown. Please do not put personal information in your company name.
Some companies in the world are run by the game itself ("living-world companies"). They are labelled as such.
3. Who processes data for us
| Recipient | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of servers, database and backups | Germany (EU) |
| Apple Inc. / Google LLC | Sign-in (if you use it), in-app purchases, push notification delivery | May transfer data outside the EU under their own safeguards (EU-US Data Privacy Framework / SCCs) |
4. How long we keep data
- Account and gameplay data: for as long as your account exists. Season results may be kept in anonymised form for rankings history.
- Guest accounts: kept until you delete them. You can delete your account at any time in Settings.
- Purchase records: for 7 years, because Dutch tax law requires it, even after you delete your account. They are kept in a minimised form.
- Push tokens: removed when you log out, switch notifications off or the token expires.
- Server logs: kept for a short time and rotated automatically. Backups: up to 14 days, after which deleted data also disappears from backups.
5. Your rights
You can ask us for access to your data, to correct it, to delete it, to restrict its processing, to port it, or you can object to it. You can withdraw consent at any time. Write to support@playbarons.com. You can also complain to your data-protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.
Deleting your account: in the game, go to Settings → Account → Delete account. You can also use the web form at https://api.playbarons.com/account/delete or write to support@playbarons.com. We delete your account and personal data within 30 days, except for the purchase records the law requires us to keep. (Owner: this feature does not exist yet. See account-deletion.md. It is a launch blocker.)
6. Children
The game is not directed at children under 13, or under 16 where the law sets that age for consent. We do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.
7. Security
All traffic between the game and our servers is encrypted with HTTPS/TLS. Passwords are stored only as hashes. Access to the admin tools is restricted and logged.
8. Changes
We will announce material changes in the game and update the date at the top.
9. Contact
WPPF Development (sole proprietorship / eenmanszaak) · Rompert Park 131, 5233 RL 's-Hertogenbosch, the Netherlands · support@playbarons.com