Privacy policy

Effective from: 26 October 2026

In short

Wandalor does not track you and does not sell data. We count visits to the home page with our own cookie-free measurement — no IP addresses are stored. Ads may appear later; if they used cookies or identifiers, only with your consent.
Your GPS position stays on your device: we do not record your routes. Only what you achieve in the game reaches the server (for example which castle you captured, and when).
An account needs your e-mail address, player name and password — the password is stored only in a form that cannot be reversed. Instead of a password, you can also sign in with your Google account or your Apple account.
You can delete your account in the game at any time (Settings → "Delete account"); for a copy of your data, write to info@wandalor.com.

1. Who is responsible for your data?

The data controller:

Vass Felicián e.v. (Hungarian sole proprietor)
E-mail: info@wandalor.com

Further details of the business (registered address, registration and tax numbers) are in the Legal notice.

The law does not require a data protection officer for processing of this size, so there is none; you can contact me directly at the address above with any data protection question.

This policy follows the GDPR (Regulation (EU) 2016/679) and the applicable Hungarian laws: Act CXII of 2011 on informational self-determination (Infotv.), Act C of 2003 on electronic communications (Eht.) and Act CVIII of 2001 on electronic commerce services (Ekertv.). The Hungarian version prevails in case of any difference.

2. What data, why, on what legal basis and for how long?

2.1. Visiting the website and the game — every visitor

Data: IP address, time of the request, the requested address (URL), browser type. These are logged automatically by the web host and by the map download server (see 5).
Purpose: Running the service, fending off attacks, investigating errors.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)): providing a secure, working service.
Retention: The providers' systems delete these logs automatically after a short time. No profiles are built from them; I look at them only to investigate an error or a security incident.

2.2. Registration and account

Data: E-mail address, player name, password (only as an irreversible hash), the account language (your e-mails come in it, and the game switches to it when you log in), the time of registration, of confirming the e-mail address and of the last login. If we suspend the account for breaking the rules of the game, also the time and reason of the suspension — we delete these when the suspension is lifted. At registration you also answer a simple arithmetic question — that is not personal data. If you register or sign in with Google: your Google account's identifier (a number) and e-mail address; the name in your Google account is only used to suggest a player name (it is not kept if you choose another). Such an account has no password — you can set one later with the “Forgot your password?” e-mail. If you register or sign in with Apple: your Apple account’s identifier and the e-mail address Apple passes on — if you hide your address, this is Apple’s relay address (…@privaterelay.appleid.com), from which Apple forwards our e-mails to your real address; the name Apple passes on at the first sign-in is only used to suggest a player name (it is not kept). Such an account has no password either.
Purpose: Creating and managing your account, logging in, keeping your game progress and syncing it across devices, and protecting fair play (suspending accounts that break the rules).
Legal basis: Providing the service, i.e. performance of the contract with you (GDPR Art. 6(1)(b)).
Retention: Until the account is deleted (at any time with Settings → "Delete account").

2.3. Service e-mails and notifications: confirming your address, resetting your password, news about your holdings

Data: E-mail address, a single-use code (stored on the server only in irreversible form), the IP address and time of the request. For notifications: your notification settings (e-mail, push — on or off); the list of devices logged in to your account (a random identifier the game creates on the device, the platform — browser, iPhone, Android —, the app version, the time of last use); in the mobile app, if you allow notifications, the device's notification token (Firebase Cloud Messaging); and a log of the notifications sent (when, about which event, on which channel, whether it succeeded — the text of the e-mail is not kept).
Purpose: Checking that the address is yours; replacing a forgotten password; letting you know when someone begins a siege of one of your holdings, or takes it. You can switch the notifications off in the game under Settings, or with one click at the bottom of the e-mail. I send no newsletters or marketing e-mails.
Legal basis: Performance of the contract (GDPR Art. 6(1)(b)); for protecting the account, legitimate interest (point (f)).
Retention: The confirmation code is valid for 48 hours, the password reset code for 1 hour; the record is deleted 7 days after it expires or is used. A device is removed from the list when you log out on it; deleting the account deletes all devices and settings. The notification log is deleted after 90 days.

2.4. Staying logged in (session)

Data: A session identifier (stored on the server only in irreversible form), the IP address of the login, the browser's identification string ("user agent"), timestamps.
Purpose: So that you do not have to log in every time; protecting the account (an account is active on one device at a time, and changing the password logs out the other devices).
Legal basis: Performance of the contract and legitimate interest (GDPR Art. 6(1)(b) and (f)).
Retention: At most 60 days; after expiry the record is deleted automatically.

2.5. Protection against abuse

Data: For a failed login: the IP address, the e-mail address or player name entered, and the time. For registration: an irreversible key derived from the IP address (not the address itself).
Purpose: Preventing password guessing and mass automated sign-ups.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)): the security of the accounts and the service.
Retention: Deleted at the next automatic clean-up after the protection window (15 minutes – 1 hour) has passed.

2.6. The game

Data: Level, experience, gold coins, health, elixir, daily gift, the day of the Sunday blessing (so it is given only once a day — we do not store which church; deleted after a week), collected items, guards; your chronicle (which places you visited, what you captured, when, the place's coordinates, against whom); your holdings; the game's notifications ("messages"); your profile picture if you upload one (or the built-in picture you chose).
Purpose: Running the game, keeping your progress, the shared map (who holds which place), the leaderboard.
Legal basis: Performance of the contract (GDPR Art. 6(1)(b)).
Retention: Until the account is deleted, or until you delete it yourself in the game with "Delete all my data". Read notifications are deleted automatically after 60 days.

2.7. If you write to me

Data: Your e-mail address, your name (if you give it) and your message.
Purpose: Replying and handling your request.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)); when you exercise a data protection right, legal obligation (point (c)).
Retention: 1 year after the matter is closed.

2.8. Visits to the home page

Data: Which page you viewed, on which day, where you came from (only the name of the referring site, for example google.com — not the full address or search terms), the page language and the device type (phone, tablet, computer). A daily visitor code is derived from your IP address and your browser's identification string using a secret value that changes every day — this is how daily unique visitors are counted. The IP address and the browser identification string themselves are not stored; the secret value is deleted the next day, and from then on the code cannot be linked to anyone.
Purpose: To see how many people arrive, from where, and which language page is needed — in aggregate, not per person. Only I see the totals.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)): improving the service. The measurement runs on our own server (see 5); there is no external analytics provider, and it uses no cookies and no identifier stored on your device. If your browser sends a "Do Not Track" or GPC signal, we do not measure.
Retention: The daily totals are kept for 24 months and then deleted automatically.

2.9. Advertising (in the future)

Data: There is no advertising at the moment. In the future, ads may appear in the game or on the website. If an external provider shows them and it would use cookies or other identifiers (for example for personalised ads or measurement), it may do so only with your prior consent — a banner will ask for it, and you can withdraw your consent at any time.
Purpose: Covering the costs of the service.
Legal basis: For cookies and personalised advertising, your consent (GDPR Art. 6(1)(a); Eht. Section 155(4), implementing Art. 5(3) of the ePrivacy Directive).
Retention: Before ads are introduced, I will add the provider's name, the data it processes and its retention periods to this policy.

2.10. Error reports from the game

Data: If an error occurs in the game on your device (for example, a screen crashes), the game sends the error message, the name of the program file and the line, the game version and the platform (browser, Android, iOS). It does not send your account, your device identifier or your location; the IP address is not stored, and the server removes anything that might be personal from the error text (e-mail addresses, link parameters, long numbers).
Purpose: To see and fix errors — as daily totals (which error occurred how many times), not per person. Only I see the totals.
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)): keeping the service working. The report goes to our own server (see 5); there is no external provider.
Retention: 90 days, then it is deleted automatically.

3. About location data in particular

Wandalor is a location-based game: with your browser's permission it uses your phone's GPS position. The position stays on your device — it is not sent to the server, and no routes are recorded.
The coordinates and time of the places you reach in the game (for example a castle, a forest, a lake) are sent to the server — they show when you were there. This is part of your chronicle (2.6).
When loading the holdings (flags) nearby, the game sends the bounds of the currently visible map rectangle. This is not stored, but it may appear in the server log (2.1) as part of the request address.
For the weather, your device sends your position, roughly rounded to about 10 km, to our own server. From this, the server only picks an area of about 30 km and returns its weather; it does not store your position (it may appear in the server log, 2.1, as part of the request address). Nothing about you reaches the weather provider (see 5).
You can withdraw location access at any time in your phone or browser settings; the location-based part of the game then does not work.

4. What do other players see of you?

Your player name: on the places you hold on the map, on the leaderboard (with the number of your holdings), and in the notification and chronicle of the player from whom you captured a place.
No other player sees your e-mail address, your profile picture or your position.
Tip: choose a nickname as your player name, not your real name — from your holdings others can see where you tend to go.
After your account is deleted, your name disappears from the map and the leaderboard. It may remain in earlier entries of other players' own chronicles (for example "X captured your castle"), as that is their game history; on request I make it unrecognisable there too.

5. Who has access to the data?

Besides me, only the systems of the following providers have access to the data, and only as far as their task requires:

RackForest Zrt. — hosting (processor)

Serves the website, the game and the database, sends the service e-mails, and runs the home page visit measurement (2.8) and the game's error reports (2.10). The data is stored in Hungary, on the provider's servers.
RackForest Informatikai Kereskedelmi Szolgáltató és Tanácsadó Zrt., Victor Hugo utca 11., 5th floor B05001, 1132 Budapest, Hungary; company reg. no.: 01-10-142004; tax no.: 32056842-2-41; rackforest.com

BunnyWay d.o.o. — map file downloads (processor)

The downloadable maps are served by a content delivery network (CDN); when you download, your IP address and the request details reach it. The download comes from the server closest to you.
BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia; bunny.net

Google Ireland Limited — push notifications in the mobile app (processor)

If you allow push notifications in the mobile app, notifications about your holdings are delivered to your phone by Firebase Cloud Messaging: it receives your device's notification token and the text of the notification (for example, who started besieging which of your holdings). On an iPhone, the last step is done by Apple's notification service (APNs). The data may also be transferred to the United States; Google is a certified participant in the EU–US Data Privacy Framework. You can switch push off at any time in the game's Settings.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; firebase.google.com

Google Ireland Limited — sign-in with Google (independent controller)

If you choose the “Continue with Google” button, Google handles the sign-in: it verifies your Google account and gives the game a signed confirmation of your account’s identifier, e-mail address and name (of these, under 2.2, only the identifier and the e-mail address are kept). Google does this as an independent controller, under its own privacy policy. In the browser, the button is loaded from Google’s server when the login or registration window opens: Google then receives your browser’s usual data (IP address, browser type) and may use its own cookies — even if you do not end up choosing the Google button. In the Android app, the phone’s own Google account picker appears. The data may also be transferred to the United States; Google is a certified participant in the EU–US Data Privacy Framework.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; policies.google.com

Apple Distribution International Ltd. — sign-in with Apple (independent controller)

If you choose the “Continue with Apple” button, Apple handles the sign-in: it verifies your Apple account and gives the game a signed confirmation of your account’s identifier and e-mail address (if you hide your address, of a relay address), and at the first sign-in it also passes on your name (of these, under 2.2, only the identifier and the e-mail address are kept). Apple does this as an independent controller, under its own privacy policy. In the iPhone app, the phone’s own Apple sign-in appears; in the browser, the game loads Apple’s script from Apple’s server when the login or registration window opens (Apple then receives your browser’s usual data: IP address, browser type), and tapping the button opens Apple’s window. If you delete your account, the game also revokes the sign-in permission at Apple; if you disconnect the game in your Apple account or delete your Apple account, Apple notifies the game — the game then signs you out everywhere and, if your account cannot be accessed in any other way, deletes it. The data may also be transferred to the United States; Apple is a certified participant in the EU–US Data Privacy Framework.
Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; apple.com/legal/privacy

OpenMeteo GmbH — weather (receives no personal data)

Our server requests the weather from it for the centre of an area of about 30 km and stores it for an hour, so that everyone playing in the area gets the same. Neither your IP address nor your position reaches the provider — only the centre of the area and our server's address.
OpenMeteo GmbH, Hintere Schilligmatte 6, 6463 Bürglen (UR), Switzerland; open-meteo.com

I do not sell your data to anyone, do not use it for advertising and do not pass it on — to an authority only if the law obliges me to.

6. Cookies and storage on your device

Wandalor currently uses no cookies, advertising, social media buttons or external tracking tools — that is why there is no cookie banner now. Visits to the home page are counted with our own cookie-free measurement (2.8).
The exception is the Google sign-in button: in the browser it is loaded from Google’s server when the login or registration window opens, and Google may then use its own cookies (see 5). They are needed for signing in with Google; the game itself does not place cookies on your device.
Sign-in with Apple is also an exception: in the browser, Apple’s script is loaded from Apple’s server when the login or registration window opens, and its window opens on Apple’s site, where Apple may use its own cookies (see 5). They are needed for signing in with Apple.
If advertising is introduced and it would use cookies or identifiers, a banner will ask for your consent first (2.9) — until then, nothing of the kind is placed on your device.
The game keeps in your device's storage (the browser's local storage and cache): your login, your settings, your game progress, the downloaded map, a copy of the game that runs without internet, and the latest weather data. The home page remembers only the language you chose.
These are strictly necessary for the service, so under the law (Eht. Section 155(4), implementing Art. 5(3) of the ePrivacy Directive) no separate consent is required.
You can delete them in your browser settings (by clearing the site's data), and the game data in the game with "Delete all my data".

7. How do I protect your data?

Every connection is encrypted (HTTPS).
Passwords, session identifiers and codes sent by e-mail are stored only in irreversible form.
The number of login attempts and registrations is limited.
Only I have access to the database; the servers are in the European Union.
Should a security incident affect your data, I will report it to the authority within 72 hours as the law requires, and if it poses a high risk to you, I will notify you as well.

8. What are your rights?

Access (GDPR Art. 15): you can ask what data I hold about you and request a copy.
Rectification (Art. 16): you can change your player name and e-mail address in the game yourself; anything else you can request by e-mail.
Erasure (Art. 17): you can delete your whole account yourself in the game under Settings → "Delete account" (by entering your password); all data belonging to the account is then deleted immediately from the server and from your device, and your holdings become ownerless. If you only want to start the game over, My Profile → "Delete all my data" deletes the game data and keeps the account. You can also request either by e-mail.
Restriction (Art. 18): in case of a dispute you can ask me to only store your data in the meantime.
Data portability (Art. 20): I provide the data belonging to your account in a machine-readable format (JSON).
Objection (Art. 21): you can object to processing based on legitimate interest; you can opt out of the visit measurement (2.8) yourself with your browser's "Do Not Track" setting.

Send your request to info@wandalor.com, preferably from the e-mail address of your account — that way I can check that it really comes from you. I reply within one month at the latest (in complex cases this may be extended by two months; I will let you know). Requests are free of charge.

There is no automated decision-making or profiling.

9. If you have a complaint

Please write to me first — most questions can be solved quickly. If that does not help, or you would rather not contact me:

you can lodge a complaint with the Hungarian data protection authority, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH; Falk Miksa utca 9–11., 1055 Budapest, Hungary; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; e-mail: ugyfelszolgalat@naih.hu; naih.hu), or with the data protection authority of the EU country where you live;
you can go to court; in Hungary you may also bring the case before the regional court (törvényszék) of your place of residence.

10. Children

Children may play Wandalor too. From the age of 14 you can register on your own; under 14, registration requires the consent of your parent or legal guardian — ideally you create the account together, using the parent's e-mail address.

For parents: the game is played outdoors, at real places, and the player name is visible to other players on the map (4). So for a child it is especially important that the player name is a nickname, not their real name. A parent may exercise all rights regarding the child's data (access, erasure); if the account of a child under 14 was created without consent, I delete it at the parent's request.

11. Changes to this policy

If the game's data processing changes, I update this policy as well; the current version is always available at this address, with its effective date at the top of the page. I announce significant changes in the game or on the home page too.