Occupier ("the Game", "we", "us") is operated by Maziar Asadicordshooli, who is the controller of your personal data under the EU General Data Protection Regulation (GDPR). Postal address: Schulstr. 5, Kaiserslautern 67655, Germany Email: maziarrasadii@gmail.com This policy explains what personal data we collect when you visit occupier.online or play the Game, why we collect it, who we share it with, and the rights you have over it.

- Account data: when you sign in, our sign-in service shares your email address and a user identifier. You also choose a username, and optionally a display name and a profile image. - Gameplay data: your sessions, worlds, maps, armies and moves, snapshots of each game's state, results, in-game items and currency, and when you last opened your profile page. - Technical data: our servers process your IP address and browser details to deliver the site and keep it secure. We do not store your IP address in our database. - Usage statistics: if you consent, Google Analytics collects information about how you use the site, such as the pages you visit, how long you stay, your device, browser and approximate location (see section 5). - Advertising data: if you consent, Google collects cookie and device identifiers, your IP address and information about your visit to show and measure ads (see section 4). We do not collect payment card details: in-game items are bought only with in-game currency.

- To create and run your account, host your games and save your progress — necessary to provide the Game you asked for (GDPR Art. 6(1)(b), contract). - To keep the Game secure, prevent cheating and abuse, and fix problems — our legitimate interest in a safe, working service (Art. 6(1)(f)). - To understand how the site is used and improve it (Google Analytics) — only with your consent, given in our cookie banner (Art. 6(1)(a) and § 25 TDDDG). You can withdraw it at any time via "Privacy settings". - To show ads, including personalised ads — only with your consent (Art. 6(1)(a) and the ePrivacy rules on cookies). You can withdraw it at any time. - To answer your messages and requests — our legitimate interest, or to meet a legal obligation (Art. 6(1)(c)) when you exercise your rights. Providing account data is required to play; without it we cannot create your account. Analytics and advertising are optional.

We show ads through Google AdSense. In the EEA, the UK and Switzerland, we ask for your consent through a consent message before advertising cookies are used, and you can change your choice at any time with the "Privacy settings" link at the bottom of every page. - Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. - Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet. - You may opt out of personalised advertising by visiting Google Ads Settings, or opt out of some third-party vendors' use of cookies for personalised advertising at aboutads.info or youronlinechoices.eu. - If you do not consent, Google may still show non-personalised ads, which use cookies only for purposes such as frequency capping, fraud prevention and aggregated reporting. Google acts as an independent controller for this data. Learn more in How Google uses information from sites that use its services.

Strictly necessary (no consent needed): - Sign-in cookie: an encrypted, HTTP-only cookie set by our sign-in service (Logto) that keeps you signed in. Deleted when you sign out or it expires. - Local storage "x-token" and "redirected-path": keep your session and return you to the page you were on after signing in. - Local storage "occupier-consent": remembers your cookie banner choice and when you made it, so we don't ask on every visit. Preferences (no consent needed, set only when you use the feature): - Local storage "pmlm-dark-theme": remembers your light/dark theme choice. Analytics (only with your consent, for all visitors — asked in our cookie banner): - Google Analytics cookies _ga and _ga_<ID>, used to tell visits apart and measure how the site is used. Kept for up to 2 years. Google Analytics does not log or store IP addresses. Advertising (only with consent in the EEA, UK and Switzerland): - Google advertising cookies such as __gads, __gpi and IDE, used to serve, personalise and measure ads (see section 4).

We do not sell your personal data. We share it only with: - DigitalOcean — hosts our servers, including our self-hosted sign-in service (Logto). - Neon — hosts our Postgres database. - Google — serves ads on the site, as described in section 4, and, with your consent, provides usage statistics through Google Analytics, on our behalf under Google's data processing terms. - Other players — your username, display name, profile image and game results are visible to other players. Your email address is never shown to them. - Authorities — only where the law requires it. DigitalOcean and Neon process data only on our instructions, under data processing agreements.

Some of our providers store or process data outside the European Economic Area, including in the United States (our database is hosted in the US). Where this happens, the transfer is protected by the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. Contact us for a copy of the relevant safeguards.

- Account and gameplay data: for as long as your account exists. When you ask us to delete your account, we delete it within 30 days; copies in database backups expire within a further 30 days. - Messages you send us: for as long as needed to handle your request, and up to 2 years after. - Google Analytics data: kept for 14 months, then deleted automatically. - Advertising cookies: set and kept by Google for the periods described in its policies; you can delete them in your browser at any time.

If you are in the EEA, the UK or Switzerland, you have the right to: - access the personal data we hold about you and get a copy of it; - have inaccurate data corrected; - have your data deleted; - restrict or object to our processing, including processing based on our legitimate interests; - receive your data in a portable, machine-readable format; - withdraw your consent at any time (for ads, through "Privacy settings"), without affecting processing that happened before. To exercise any of these rights, email maziarrasadii@gmail.com from the address on your account. We answer within one month. You also have the right to lodge a complaint with the data protection authority in the country where you live or work, or where you believe your rights were infringed.

You must be at least 16 years old to create an account if you live in the EEA, the UK or Switzerland, and at least 13 elsewhere. The Game is not directed at children below these ages, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

Data is encrypted in transit (HTTPS), sign-in is handled by a dedicated identity service, and access to our database is restricted to the Game's servers. No system is perfectly secure, but if a breach affecting your data occurs, we will notify the authorities and you where the law requires it.

We may update this policy as the Game changes. The date at the top shows when it was last updated. If we make significant changes, we will tell you on the site or by email before they take effect, and ask for your consent again where the law requires it.

Questions about this policy or your data can be sent to maziarrasadii@gmail.com.