Privacy Policy

AFTERBLOOM is a real-time strategy game you play in your browser, made and run by the AFTERBLOOM team (“we”, “us”). We decide what personal data the game keeps and why, which makes us the controller of that data under the EU General Data Protection Regulation (GDPR).

For anything about your data, write to privacy@playafterbloom.com. We answer within one month.

Your account. Your username (it is your name in the game), your email address if your account has one, your role (player or admin), and when the account was made and last changed. A password account stores your password only as a salted hash: nobody, us included, can read it. An account an admin made for you without an email gets a placeholder address that is never used to write to you.

Signing in with Google. If you sign in with Google, Google tells us your name, email address and profile picture, and gives us the tokens it issues for that sign-in, which we store with your account. We ask Google for nothing else.

Your sessions. While you are signed in, we keep a session for each browser: a random token, when it expires, and the IP address and browser (user agent) it signed in from. To slow down anyone guessing passwords, we also count recent sign-in attempts per IP address for a minute.

Your saved games. Saves are kept on your account so you can play on from any computer: each one’s name, the mission, the game time, when it was saved and the state of the match.

The newsletter, if you sign up. The address you gave (it can differ from your account’s), the account that signed it up, where you signed up (your profile or a victory screen), when, and, if you leave, when you left.

We do not use analytics, advertising or tracking of any kind, and we do not sell or rent your data to anyone.

• To give you the game you signed in to (your account, sessions and saves): this is what you asked for, so the legal basis is performing our agreement with you (GDPR Article 6(1)(b)).
• To keep the game and your account safe (IP addresses, browser, sign-in attempt counts, suspensions): our legitimate interest in stopping abuse and break-ins (Article 6(1)(f)).
• To send you the newsletter: your consent, given when you press Sign me up or Subscribe (Article 6(1)(a)). You can take it back at any time, as easily as you gave it.

We set one kind of cookie: the session cookie that keeps you signed in. It is strictly necessary for the game to know who you are, so it needs no consent banner, and it is gone when you sign out or the session expires.

The game also remembers a few things in your browser’s own storage, which never leave your computer unless you play: your sound settings, the last world you played, whether the performance monitor is open, and your saves waiting to upload to your account when you are offline. Clearing your browser’s site data removes them.

Your data is kept in a Postgres database run for us by Neon in Frankfurt, Germany, inside the EU. The company that hosts the game’s website processes requests to it, and so sees your IP address. If you sign in with Google, Google handles that sign-in under its own privacy policy.

These providers work only on our instructions, under data processing agreements. Where a provider is based outside the EU, transfers rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

Within the game, the admins who run it can see the accounts list (usernames, email addresses, roles) and the newsletter list, to manage accounts and answer requests. Nobody else does.

• Your account, its saves and its newsletter sign-ups: until the account is deleted. Deleting an account deletes all of them.
• Sessions: until you sign out or they expire, a week after you last played.
• Sign-in attempt counts: a minute.
• The newsletter: until you leave. After that we keep only the address and when you left, so we never write to you again by mistake; ask us and we delete that too.

Under the GDPR you can ask us to:

• show you the data we keep about you, and give you a copy (access and portability);
• correct it (you can change your username and password yourself, in your profile);
• delete it, your whole account included;
• restrict how we use it, or object to our use of it for security;
• stop the newsletter: from your profile, from the link in any email, or by writing to us.

Write to privacy@playafterbloom.com from the address on your account, or tell us your username. If you think we have handled your data wrongly, you can also complain to the data protection authority where you live.

AFTERBLOOM is not meant for children under 16. If you are younger, you need a parent’s permission to have an account. If we learn that a child has an account without it, we delete it.

When we change what we keep or why, we update this page and its date. If a change matters to you, for example a new kind of data or a new provider, we tell you in the game or by email before it applies. The Terms of Service say how you may use the game.