KAMPUNG

KAMPUNG is a browser game. This policy describes exactly what it stores about you, why, who can see it, and how to have it removed. It covers the game at https://kampung.cyberjaya.pro and any development or test deployment of the same software.

What is collected, and why

• Your email address. Required to hold an account, so that an account can be told apart from another and recovered. It is never shown to other players.
• Your sign-in name and display name. The display name is public: it appears on the map, the leaderboards, battle reports, the war record and any letters you send.
• A password hash, if you registered with a password. Passwords are stored hashed with bcrypt and are never stored, logged or recoverable in plain text. An account created through Google has no password at all.
• Google account details, only if you choose to sign in with Google: the stable account identifier Google issues, whether Google considers your address verified, and your profile picture URL. The account is keyed on that identifier rather than on your email, which you are free to change at Google.
• Session records: when a session was created, when it expires, whether it was revoked, and the IP address and browser user-agent it was created from. This is what lets a session be ended and a suspicious sign-in be noticed.
• Everything you do in the game: your villages and what is built in them, troops, marches, battle reports, trades, clan membership, messages to your clan, letters to other players, and your standing in past rounds.
• Server logs containing IP addresses and request paths, kept to find faults and to enforce rate limits.

What is not collected

There is no advertising, no analytics service, no tracking pixel and no third-party script of any kind on these pages. Nothing about you is sold or shared for marketing. The game takes no payments, so it holds no payment details.

Cookies

The game uses no cookies at all in ordinary play — your session is held in your browser's local storage, not in a cookie. Two short-lived cookies exist and only if you use Google sign-in: one carries a random value for ten minutes to prevent a forged sign-in, and one carries your new session for sixty seconds and is erased the moment the app reads it. Both are httpOnly and neither is used to track anything.

Who can see your data

Other players see your display name, your villages and where they are, your population, clan and standing, and any letters you write to them. They never see your email address, your IP address or your sessions. Administrators of the deployment can see everything stored, including letters, because the same database holds it all — administrator actions are recorded in an audit table.

The only third parties involved are the ones needed to run the game: the hosting provider the server runs on, a network provider that proxies traffic to it, and — solely if you choose it — Google, for sign-in.

How long it is kept

• Account details are kept until the account is deleted.
• Game data belongs to a round. When a world ends it is archived and swept away: villages, armies, clans, offers and letters are deleted outright. What survives is a frozen record of where each player finished, and their renown.
• Database backups are taken nightly and the last fourteen are kept, so data can persist in a backup for up to fourteen days after it is deleted from the live game.

Removing your account

There is no self-service delete button yet, and it would be dishonest to imply otherwise. Write to nurayuze@cyberjaya.pro from the address on the account and it will be removed, along with its villages, letters and sessions. You may also ask for a copy of what is stored about you.

Security

Passwords are hashed, sessions can be revoked, the database is not reachable from the internet, and traffic is served over HTTPS. No system is perfect: please do not put anything in a letter or a village name that would matter if it were disclosed.

Children

The game is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has registered, write to the address above and the account will be removed.

Changes

This game is in active development and this policy will change with it. The date at the top is when it last did.

Contact

Nurayuze — nurayuze@cyberjaya.pro