Privacy policy

What the game collects, why, how long it keeps it and what you can do about it.

§1 Who we are

Garden Wars (the "Game"), played at garden-wars.io, in its desktop app and in its iOS app, is run by Aleksander Błaszkiewicz, NIP 9571167927, REGON 527410431, ul. Rakoczego 19 lok. 4, 80-288 Gdańsk, Poland (the "Controller").

This policy follows the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"). You can reach the Controller by letter to the address above, with the Feedback key in the game (it comes with your account, so we know whose data you mean) or on our Discord server.

§2 What we collect

• Your account: the name you pick, an account id, your stats, ratings, friends, cosmetics, seeds and season progress. If you save your account, a login and a password (kept only as a one-way hash). If you sign in with or link Discord or Twitch, that account's id, login and display name. We never ask for your e-mail address, real name or phone number.
• Your age bracket: we ask your birth month and year once and keep only a bracket (13‑15, 16‑17 or 18+).
• What you play: your rounds and their results, to show your stats and ranks, fix bugs and keep games fair.
• Chat and feedback: messages between friends, and the feedback you send from the game, with the game's state at the time.
• Where you came from: when you first open the game, the host of the site that linked you, the link's campaign tags, and the invite or access code in your link.
• Diagnostics: frame rate, graphics card, screen size and errors, not tied to your account.
• Your IP address is used only in memory, to stop abuse (rate limits), and never stored.

The Game uses no cookies. It keeps your sign-in token and your settings in your device's local storage.

§3 Why, and on what basis

• To run your account and your games and match you with other players: the performance of our agreement (Article 6(1)(b) GDPR).
• To keep the Game secure and fair, fix bugs and understand which modes and features are played (product analytics): our legitimate interests (Article 6(1)(f) GDPR).
• To meet our legal obligations (Article 6(1)(c) GDPR).

The Game shows no ads, and we never sell, rent or lend your data. We make no decision about you with legal or similarly significant effects by automated means alone.

§4 Who processes it for us

• Cloudflare: the website and file storage.
• MongoDB Atlas: the database.
• Our game servers in Germany (Europe's games) and the United States (North America's games).
• PostHog (EU): product analytics, sent from our server, keyed by your account id, never your name or IP address.
• Discord and Twitch: only if you sign in with or link them.
• Apple: distributing the iOS app.

Your data may also be disclosed to authorised state authorities when the law requires it.

§5 Transfers outside the EEA

Some of these providers, and North America's game servers, process data outside the European Economic Area. There we rely on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or on the Standard Contractual Clauses it approved. Ask us for details.

§6 How long we keep it

• Your account: until you delete it.
• Rounds and chat messages: 90 days.
• Feedback: as long as we need it to act on it.
• Encrypted backups of the database: up to 90 days.

Deleting your account removes it with its chats and feedback; its rounds keep only an anonymous entry, and its analytics events an id that no longer leads to anyone.

§7 Your rights

You have the right to access your data and get a copy of it, to have it corrected, erased or restricted, to take it with you (portability), to object to processing based on our legitimate interests, and to withdraw any consent you gave.

Delete your account yourself in the game: PROFILE → Account → Delete Account. For anything else, contact us as in §1, saying which right you want to use and which data it is about. We answer within one month; when a request is complex or there are many, that can be extended by two more months, and we tell you so.

If you think we process your data unlawfully, you can complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in Poland, or to the authority where you live.

§8 Children

Players under 13 play offline only: nothing online opens for them, signing in included. An account found to belong to someone under 13 is deleted.

§9 Security

Only the people who run the Game can reach your data, and only as far as their work needs. Passwords are hashed, connections are encrypted, and our providers are bound to protect what they process for us.

§10 Changes

We update this policy when what we collect or why changes, with a new date below. Earlier versions are available on request.

Last updated 9 October 2026