Privacy policy
DRAFT. Have this checked before launch.
Who we are
TrainWars is run by Albin Herbst, a sole trader (enskild firma) in Sweden. We decide why and how your personal data is used, so we are the "controller" under the EU data protection law (GDPR). Contact: support@trainwars.com.
What we collect
| Data | Why | Legal basis |
|---|---|---|
| Your email address and writer name | Sign in with an email link; show your name in the game | Contract (providing the game) |
| Your paintings, blackbook pages and photos | Save them to your account so you can reopen them on any device | Contract |
| Purchase record (that you own the Full Game, and the Stripe payment reference) | Unlock the Full Game; handle refunds | Contract; legal duty (bookkeeping) |
| Technical data (IP address, browser) in server logs | Keep the service running and secure | Legitimate interest |
You can play without an account. Then your painting stays only in your own browser (local storage) and we receive nothing. We do not use advertising or analytics cookies. We do not sell your data.
Who else handles your data
- Supabase – database, sign-in and file storage. Our project is hosted in the EU (Ireland).
- Vercel – hosts the website. May process your IP address in the US and elsewhere.
- Stripe – takes payments. Your card details go to Stripe, never to us.
- Resend – sends the sign-in emails.
- Cloudflare – domain name system.
- Google Fonts – the page loads fonts from Google, so Google sees your IP address.
Where data goes outside the EU/EEA, these providers rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
- Account, paintings, blackbook and photos: until you delete them or ask us to delete your account.
- Purchase and payment records: 7 years, as Swedish bookkeeping law requires.
- Server logs: a short time set by the provider, normally under 30 days.
Your rights
You can ask us to show you your data, correct it, delete it, limit its use, or give you a copy. You can object to use based on legitimate interest. To use a right, email us. We answer within one month. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or your local authority.
Children
TrainWars is for people aged 13 and over. If you are under 13, do not create an account.
Changes
If we change this policy in a way that matters, we will change the date above and tell signed-in players in the game.