PRIVACY POLICY

LAST UPDATED: October 14, 2026 — Policy version 1.7

1. Who we are

Kron Wars (“Kron Wars”, “we”, “us”) is operated by Alien Bulb Studios, Via Cassanese, 60, 20054 Segrate (MI), Italy, which is the data controller for the personal data described in this policy. Contact for privacy matters: [email protected].

This policy applies to the website kronwars.com, the Kron Wars game (browser and Steam), the Store, the newsletter and our support channels (together, the “Services”).

2. Data we collect

2.1 Account data — username, email address, password (stored hashed), display name and avatar; if you sign in with Steam, your Steam ID and public Steam profile name.

2.2 Gameplay data — ships, cargo, trades, KRON and NAVEX balances and movements, planets, combat logs, faction standings, missions, Spire Citadel progress.

2.3 Traceability ledger — KRON and NAVEX movements are recorded in an internal append-only ledger for auditability. It is not a cryptocurrency and is not public.

2.4 Purchase data — Store orders (product, price, currency, payment provider, order status, refunds and chargebacks). We do not receive or store your card or bank details: payments are handled by Steam or PayPal.

2.5 Technical and security data — IP address, the country and region derived from it, browser and operating system, device identifiers, login times and sessions.

2.6 Store activity — which Store products you view, open and click, time spent on product cards, and checkout outcomes. We use this for personalised offers only with your consent (Section 4).

2.7 Chat — messages you send are delivered to their recipients and kept for moderation. For marketing we only count messages and recognise topics in public sector chat. We never use the text of private messages for marketing.

2.8 Date of birth (optional) — only if you choose to provide it, used solely to check your age (Section 9).

2.9 Communications — messages you send us by email, Discord or support channels.

3. Why we use your data and on what legal basis

You can give or withdraw each consent at any time in Settings → Privacy & consents in the game. Withdrawing is as easy as giving consent and does not affect processing done before.

What is required — account data is required to create an account and provide the Game, and purchase data is required to complete a purchase. All other optional data (date of birth, consents) can be refused without consequences for your use of the Game.

Transactional messages — purchase receipts, account, security and verification emails, and in-game game notifications — are not marketing. They are always sent, whatever your marketing choices.

4. Personalised offers and profiling

With your consent, we build a customer profile from your Store activity, purchases and game activity (for example playtime, leaderboard or season position) and group players into segments. We use it to show you personalised prices or offers in the Store and to send campaign messages. Personalised offers are optional, never raise the price above the standard price, and have no legal or similarly significant effect on you. We never use profiling on players under 18. You can object to profiling at any time in Settings → Privacy & consents.

5. Who we share data with

We do not sell your personal data and we do not share it for cross-context behavioural advertising. We share data only with:

• Brevo (email delivery and newsletter) — France (EU);

• Steam (Valve) and PayPal — payment processing and account sign-in;

• Cloudflare — network security and delivery;

• OVHcloud — servers and databases, hosted in France (EU);

• law enforcement or authorities, when required by law;

• other players, only for what is visible in the game (public leaderboards, trade history, faction standings).

6. International transfers

Our servers (OVHcloud) and our email provider (Brevo) are located in France, inside the European Union. Some other providers may process data outside the European Economic Area: Valve (Steam), PayPal and Cloudflare, mainly in the United States. For these transfers we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

7. How long we keep data

8. Consent renewal and rewards (notice of financial incentive)

• Consent renewal — every 6 months we ask whether you want to renew your marketing and personalised-offer consents. Every player who answers, yes or no, receives an in-game reward (for example fighters). The reward is for answering and never depends on saying yes. If you do not answer, the consents expire.

• Date of birth — we may offer an in-game reward (fighters or shields) if you choose to provide your date of birth. It is optional, used only to check your age, and never used for marketing segments.

• Rewards have no real-world monetary value. We estimate the value of the data you provide at no more than €0.30 per player. We calculated it from the reward: 100 fighters, priced at 100 KRON each in the Game (10,000 KRON in total), which is the in-game value we give in exchange. KRON itself has no real-world monetary value. You can withdraw from these programmes at any time; rewards already granted are kept. (This section is our notice of financial incentive under the California Consumer Privacy Act.)*

9. Children

You must be at least 13 to use Kron Wars; players aged 13–18 need parental or guardian consent (see our Terms). We do not use marketing, profiling or personalised offers for anyone under 18, or for anyone who has not provided a date of birth. If we learn that we hold data of a child under 13, we delete it promptly.

10. Your rights

You have the right to access, correct, delete and port your data, to object to or restrict processing, to object to profiling, and to withdraw consent at any time. You can:

• manage consents and download your data in Settings → Privacy & consents;

• send other requests from the same page or to [email protected].

We may need to verify your identity. We answer within: 1 month in the EU/EEA and UK (extendable by 2 months for complex requests), 15 days in Brazil, 45 days in the US (extendable by 45 days). You can also complain to your data protection authority (in Italy: Garante per la protezione dei dati personali).

US residents — residents of California, Colorado, Connecticut, Utah, Virginia and other states with privacy laws have the rights to know, access, delete, correct and port their data, and to opt out of targeted advertising, sale and profiling. We do not sell or share data for targeted advertising. We honour Global Privacy Control (GPC) signals as an opt-out of profiling and marketing. If we refuse a request, residents of Colorado, Connecticut and Virginia can appeal by replying to our answer or writing to [email protected] with “Appeal” in the subject; we answer appeals within 45 days (Colorado) or 60 days (Connecticut, Virginia).

Brazil (LGPD) — you have the rights in art. 18 LGPD, including confirmation of processing, access, correction, anonymisation, portability, deletion, information about sharing and withdrawal of consent. Our contact channel for LGPD matters is [email protected].

11. Cookies

Our website uses essential cookies and, with your consent through our cookie banner, analytics cookies (Google Analytics). The game uses only the storage it needs to keep you signed in and to remember your settings.

12. Security

We use encryption in transit (TLS), hashed passwords, access controls and regular security reviews. No method of transmission or storage is 100% secure.

13. Attribution

IP geolocation data by DB-IP (https://db-ip.com), licensed under CC BY 4.0.

14. Changes

We will notify you of material changes in the game and on this page, and update the “Last updated” date and the policy version. Where a change affects a consent you gave, we will ask for it again.

15. Contact

[email protected] — Alien Bulb Studios, Via Cassanese, 60, 20054 Segrate (MI), Italy