Privacy Policy

Last updated: 1 November 2026

This policy explains what personal data Territory Battle collects, why, where it is kept, for how long, and what you can do about it. It covers the website (the free demo, and the full game in your browser once you sign in with Steam), the game's app on Steam (Windows) and its demo app.

Some features described below are not open to every player yet: clans, player reports, the store, the count of tutorial steps and the vote on a game's mode. Their sections say so, and apply from the day the feature opens.

The short version

• You can play the free demo in your browser without signing in. Online play needs a Steam sign-in. We never see your Steam password, your email address or your payment details.
• When you sign in, our server keeps your Steam account number (SteamID) and an account key made from it, so that your profile, progress and purchases follow you.
• Other players see your Steam name, your cosmetics and what you do in a game. They never see your SteamID.
• Chat in a game is passed on to the other players, not stored. Clan chat is kept for 30 days at most.
• Usage statistics and crash reports are anonymous: no identifier, no cookie.
• No advertising, no ad trackers, no third-party scripts, and we never sell data.
• You can ask for your online data to be deleted from the game (your Profile) or by writing to contact@territorybattle.com.

1. Who we are

This policy is published by Territory Battle ("we", "us"), which decides how the data described here is used. For anything about your data, write to contact@territorybattle.com.

2. What we collect, and why

2.1 Playing without signing in

• The web demo (tutorial and solo games) runs in your browser. It sets no cookie and does not ask who you are. Your progress is saved on your device (2.13). It sends us only the anonymous reports of 2.9, and a bug report if you write one (2.10). Without a sign-in, other players would know you by a random name ("Player" and 4 characters) kept on your device.
• The Steam app's "Play offline" mode runs a copy of the game packaged with the app. It sends nothing at all.
• The Steam demo app signs you in through Steam automatically while Steam is running (2.2).

2.2 Signing in with Steam

Online play (online games, parties, shared replays, and clans once they open) is for players who own the game on Steam. On the website you sign in on Steam's own page; in the Steam app and the demo app, automatically through Steam.

• What Steam tells us: your SteamID; whether your Steam account holds a licence for the game, until when, and whether it is borrowed through Steam Family Sharing; your public Steam name and avatar. On a website sign-in we also ask Steam whether the account has game bans: the answer is used for that sign-in only and never stored. We never receive your password, email address, friends list or payment details.
• The licence is checked once, when you sign in.
• Your session: our server keeps a session record with your SteamID, your account key (below), when the session ends, your licence end date, the Family Sharing flag, your Steam name and your avatar address. A session lasts 12 hours on the website and 7 days in the Steam app, never past your licence end. Your name and avatar are read again at each sign-in, and at most once a day during a session. Your avatar reaches you through our server and your browser keeps it for one hour. The record is deleted when you sign out or when the session ends.
• The demo app: a separate demo session, kept 7 days, with your SteamID, your account key, whether your account owns the full game and your Steam name (read once per session, so that your screens and other players show it). It is deleted when the session ends.
• Your account key: a 32-character code our server computes from your SteamID with a secret only it holds. Your profile and game data are filed under this key. A private index on our server links each SteamID to its key, with when and how the account first signed in, so that the key never changes. It is kept until your data is erased. The game in your browser also receives a second one-way code made from the key, which names your save on your device.

Signing in sets these cookies. All are strictly necessary for the sign-in to work, limited to our site, sent only over HTTPS and unreadable by the page's scripts. None is used for advertising or tracking, so there is no cookie banner.

2.3 Your account profile

While you are signed in, our server keeps a profile under your account key:

• your SteamID and your key bindings, so they follow you to any device;
• the outfit you wear (your equipped items and your emote wheel, with when you last changed them), so that it is the same on the website and in the Steam app;
• your verified results: your last 50 verified games (date, score, place, number of players, length, win, experience earned), the totals and achievements worked out from them, the number of online games you finished, a list of your last 20 online games and daily experience counters, so that nothing is counted twice;
• your progression (experience, challenges, boosts, rewards claimed) and the items given to you;
• your purchases (2.8) and your clan membership and notices (2.6).

It is kept as long as your account exists, with no time limit today, until your data is erased (section 6).

2.4 Online games, parties and chat

• A game room keeps, for each seat, the account key, the Steam name, a code to rejoin, the cosmetics worn, and the moves and votes made. It is saved about once a second so that a game survives a restart of our server. The other players see your Steam name (a name our filter refuses is replaced by a neutral one), your cosmetics and your moves. Everything is deleted about two and a half minutes after the game ends, or two hours at most for a game that was abandoned or interrupted.
• Saves every 30 seconds: one player's game sends a save of the shared game, which our server checks against the other players' games, so that a game can be resumed on another device. With it comes a memo of your own screen (event feed, curves, what you have seen), sent back to you only. Both are deleted with the room.
• Choosing a server: when a game starts, it may move to a server near its players. For that, Cloudflare tells us a broad region (one of nine) from your connection. It is used in memory only, never stored or logged.
• One game at a time: while you hold a seat, our server notes your account key and that game's code. The note is deleted when you leave, after 3 hours at most.
• The public games list shows each game's code, name, mode, map and player counts, with no player data. Game names go through a filter.
• Parties (up to 4 friends): our server keeps the party code, its members' account keys and Steam names, and its leader. A member not seen for 3 minutes is dropped; an empty party is deleted.
• Chat: our server passes each message to the players who should get it, with your name, and does not log it. Once player reports open (2.7), each room keeps its last 30 chat lines in memory while it is open, so that a report can carry them. A player who floods the chat is muted, from 15 seconds up to 30 minutes; that count ends with the room. The game filters links and rude words. Muting a player from their card happens on your screen only.
• Clan wins (once clans open): at the end of a game, the winners' clans are credited, and each clan keeps a short digest of the game for 3 days so that it is counted once.

2.5 Match recordings

A recording is the list of moves, turn by turn, with the map and the game settings: enough to replay the match. It holds no name, no id, no IP address and no chat. Players are seat numbers.

• A recording stays on our server 1 hour (up to 1 hour 15 minutes). Opening a shared replay requires a Steam sign-in with the full game.
• Your game also keeps your last 30 games on your device (64 MB at most). That copy never leaves it.

2.6 Clans (not yet open)

• A clan has up to 100 members. For each member: account key, Steam name, role, join date, last seen, weekly wins and any banner lent to the clan. Members see each other online or away.
• Join requests (with their message) and invitations last 7 days, invite codes 30 days, and blocks (with their reason) 30 days.
• Clan chat is stored for the members: the last 500 lines, never older than 30 days. A deleted line has its text removed.
• The clan's chronicle names players and keeps 30 days or 300 entries.
• A clan's page shows its members' names, roles and join dates to any signed-in player.
• A reported clan chat sends up to 50 lines to our team, kept 90 days.
• A member who leaves stays in the clan's records for 30 days.

2.7 Player reports and suspensions (reports not yet open)

• You can report a player from their card, for one of 4 reasons: 3 reports per game, one per player, 10 per day.
• A report keeps the game and room code, the turn, the reason, both players' names as shown, the chat lines the reporter could see, and one-way codes for both players. No account key, no SteamID. Reports are kept 90 days (2,000 at most).
• Our team may suspend online play for 1, 7 or 30 days, with a reason. The log of suspensions (who decided, when, why, the name shown and a reference) is kept 365 days. Our team may also bar a player from founding, joining or leading a clan for 30 or 90 days (the bar is kept in their profile), and may disband a clan or remove its tag. Permanent bans are Steam bans, checked at sign-in.

2.8 Purchases (store not yet open)

• Items are sold only in the Steam app, through Steam. Valve handles the payment: we never see your card or payment details.
• For each order we keep: its number, your account key, the items and amounts, the currency and total, its state, the Steam transaction number, the times, any error code from Steam, when the items were delivered, any refund or chargeback, and which version of the purchase terms you accepted. For each account we also keep its currency and Steam purchase status, refreshed every 6 hours.
• To start a purchase, our server sends your SteamID to Steam. It is not stored with the order, and we do not keep your country.
• A refund or chargeback reported by Steam takes back exactly the items it covers.
• Purchase records are kept while you own the items, and at least as long as accounting and tax rules require, including after an erasure (section 6). None is deleted automatically today.

2.9 Anonymous usage statistics and crash reports

• The game reports when a page opens; when a solo game, a tutorial or a replay starts and ends (mode, map size, number of players and humans, length, how it ended, whether you could keep playing after the result) and whether you then chose Keep playing; a signal once a minute while the game is open, so that we know how many players are connected (it names the mode during a solo game or the tutorial; a page hidden for 5 minutes sends none, unless it is in an online room or match); and crashes (the kind and type of error, the place in the game's own code where it happened and a short code, never the error's text, 5 reports at most per visit). The Steam app reports its own crashes the same way. Every report carries the game version, the platform (web or Steam) and the family of system the game runs on (Windows, macOS, Linux or other), nothing finer.
• Once a day, the "page opened" report also says how many days ago you first played on this device, on how many days you have played there and how many days have passed since your last visit, with no identifier, so that we know whether players come back.
• These reports hold no identifier and no cookie: two reports cannot be linked to each other or to you. From the "page opened" report only, we keep your country (two letters, from Cloudflare).
• Online games send no game report, only that signal: our server counts each game once (mode, players, humans, length, how it ended, clan and knocked-out counts, how many players could keep playing after the result and how many did).
• Count of tutorial steps (not yet open): visit, tutorial started, step reached, finished or skipped, first game, game finished, wishlist button pressed (and where), full game. Anonymous like the rest; your device keeps two flags (first game, first finish) that are never sent.
• When games fall out of step in an online match, our server notes the recording number, room code, mode, turn, which part differed, how many players reported it, the version and whether the game recovered. Never who.
• We keep daily totals only: 60 days for most, 184 days for a few economy and timing totals. Desync notes: 60 days. Counts of Steam sign-ins and sign-in failures: 7 days. Server error counts: 2 days.

2.10 Bug reports and feedback

• The "Report a bug · Send feedback" form sends the kind of report, your message (3 to 2,000 characters) and, only if you fill it in, a way to reach you (an email address or a Discord name).
• If "Include technical details" is ticked (the default for a bug), it adds the game version, the screen, the game mode and clock, your window size, your browser family and system (never the full browser string) up to 10 recent error lines (300 characters each, web addresses cut to their last part) and how the start of your last online match went: six counts and durations (the wait for the first turn, the longest pause between turns, how far behind your screen was).
• A report is sent without cookies and is not linked to your account. We keep the country Cloudflare gives (two letters), never your IP address. Our team may add a note to it.
• The form shows a reference: to have a report deleted, write to us with it.
• Spam is deleted after 30 days, handled reports after 180 days; others are kept until we handle them.
• Performance profiles: if a game runs slowly, you can record about 20 seconds of it (Settings, Graphics, or F4). Nothing is sent unless you press Send. A profile holds frame timings, the game version and settings, the size of the map and how many things were on it, and your computer's graphics card name, number of processor threads, rounded amount of memory, system and browser family, screen size and refresh rate. It holds no name, no account key, no SteamID and no chat. You get a short code to give our team, which reads the profile with it. Profiles are deleted after 30 days. You can also save it as a file on your device instead; that copy never leaves it.
• Vote on the mode (not yet open): at the end of a game, you can say whether you liked its mode and, if you wish, add a comment. The vote is sent with that game's facts (its mode, map, number of players, length, your result and place, the edition, the language and the game version), with no name, no account key, no SteamID and no IP address. To limit how many votes one sender leaves a day, our server keeps a one-way code worked out from your session or your connection for 48 hours, then erases it. Please do not write personal information in the comment: e-mail addresses, links and long numbers are masked automatically, and our team deletes a comment that still carries personal data. Votes and comments are kept 12 months.

2.11 Security, abuse prevention and logs

• To stop floods, our limits count requests under a keyed code made from your IP address (or its network, for IPv6) and the day, in Cloudflare's counters that reset every minute, and in memory counters that last 10 minutes at most. Your IP address is never written to our storage.
• Our host's automatic request logs, which would record IP addresses, are switched off. Our own technical logs hold room codes, recording numbers and, for our team's actions, a one-way account reference. No IP address, no SteamID, no chat. They are kept a few days, as our hosting plan sets.
• Alerts sent to our team carry counts only.

2.12 Backups

• We copy the SteamID index and the account profiles (with SteamIDs and purchase records) to private storage, up to once a day. Each copy is kept 30 days.
• Cloudflare also keeps 30 days of history of our databases (profiles, results, clans, reports, store), so that they can be restored after an incident.
• After an erasure, your account leaves the next copy and stays in older copies and in that history for 30 days at most. It is never restored from the copies: a note of the erasure is kept 35 days for that. If a database must be rolled back after an incident, the accounts erased since the point it goes back to are erased again, and a deletion request sent after that point may have to be sent again.

2.13 Data on your device

The game saves the following in your browser's storage, or in the Steam app's folder on your PC. It stays on your device.

• your local progress: tutorial, solo games, career, match history, achievements, progression, challenges and equipped cosmetics, with a separate save for each signed-in account that also holds a copy of your server profile;
• your settings: game options, comfort and accessibility, HUD layout, key bindings, language, hints and notices seen, a few clan and calendar reminders;
• your name (the random guest name, or your Steam name);
• the day you first played on this device, how many days you have played and the last one (2.9);
• the recordings of your last 30 games, and the content the game downloaded;
• the six numbers on the start of your last online match, sent only in a bug report (2.10);
• for the current tab only: your party code, the game you are in and the last one you left.

The Steam app also keeps its window and language settings, and an offline-play file holding a random key and coded checks, never your SteamID. The demo app uses its own folder, and names its save with a one-way code of your SteamID worked out on your PC. The app deletes its sign-in cookies before each sign-in.

You can erase all of this by clearing this site's data in your browser, or by uninstalling the app and deleting its folder. This erases only your local copy; for our server, see section 6.

2.14 Steam features

• In the Steam app, the achievements you unlock and 6 stats (wins, games played, map sizes played and won, career level, knockouts; the demo has 3 of its own) are recorded on your Steam account by Valve. Who sees them depends on your Steam privacy settings. Deleting your data with us does not reset them.
• Your Steam friends can see what you are doing in the game: the screen, the mode and your party size, plus a one-way code that groups your party in their list; never room or party codes, names or Steam ids.
• "Invite Steam friends" opens a friends-only Steam lobby, run by Valve.

2.15 Links to other sites

The "Wishlist on Steam" buttons open the game's Steam page with tags that say which button was pressed (such as utm_source=webdemo); they hold no personal data. The game also links to our Discord server and, in its credits, to GitHub, Google Fonts, Creative Commons and the SIL Open Font License. Those sites' own privacy policies apply there. Our pages load nothing from other sites: even the fonts come from ours.

3. What we never do

• No advertising, no ad networks, no tracking across sites, no analytics or third-party scripts.
• We never sell or rent data, and never share it for marketing.
• No automated decision with legal or similar effects on you.

4. Why we may use your data (legal bases)

The cookies and device storage above are strictly necessary for the service you ask for, so they need no consent.

5. Who receives your data

• Cloudflare, Inc. (United States) hosts the website and the game server for us, as our processor: it runs the server, stores the data described here, counts requests for the flood limits and keeps our logs. Like any host, it handles IP addresses to deliver and protect the service.
• Valve Corporation (Steam, United States) runs the Steam sign-in, licences, Family Sharing, bans, names and avatars, achievements and stats, friends' presence, lobbies and payments, under its own privacy policy.
• Other players see what sections 2.4 to 2.7 say they see.
• Our team reaches our operator tools by signing in with Steam, or with an operator key.
• Nobody else, unless the law requires it (for example a court order).

6. Your rights, and how to have your data deleted

You can ask to access your data, have it corrected or deleted, restrict or object to its use, or receive a copy of it. You can withdraw a consent at any time.

Deletion: sign in, open your Profile and press Request deletion of my online data (Settings, Account says where). A person on our team checks each request, then erases. The panel shows where your request stands, and you can cancel it while it waits. If you cannot sign in (a banned account, or the demo only), write to contact@territorybattle.com. We answer within one month.

An erasure deletes your profile (SteamID, key bindings, outfit, history, totals, achievements, progression, items given to you), your results, your current game note, your clan membership, chat lines and mutes, your store status and, last, your entry in the SteamID index. In reports, suspension logs and clan chronicles your name becomes "Deleted player".

What stays, and why:

• our records of your purchases, for accounting: what you bought stays yours, but online games will only show the items you buy after the deletion;
• your account key inside the reset profile, and any clan bar or clan creation delay, so they cannot be escaped by an erasure;
• a one-way fingerprint of your account for 7 days, so that a game still being verified adds no result;
• your sign-in session until it ends, and a game in progress until it closes (2 hours at most);
• the backups and recovery history, 30 days at most (2.12);
• your request itself: your account key is removed from it once it is closed, and closed requests are deleted after 90 days;
• what Steam holds (achievements, stats) and what is on your device, until you clear it.

For anything else, write to us. We may ask you to send the request from the game, so that we know it comes from the account's owner. If you think we have not handled your data properly, you can complain to the data protection authority of the country where you live or work.

7. Transfers outside Europe

Cloudflare and Valve are based in the United States. Cloudflare may serve you, and run a game, from data centres around the world, including North America and Asia-Pacific. These transfers rely on the safeguards these companies offer under the GDPR, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

8. How long we keep it

9. Children

Online play needs a Steam account, and Steam accounts are for people aged 13 and over. The free demo needs no account and asks no age. We do not knowingly collect personal data from children below the age at which they can consent in their country. If you are below it, please do not leave a contact in a bug report without a parent's permission. A parent who thinks their child sent us personal data can write to us, and we will delete it.

10. Security

All traffic is encrypted (HTTPS). Sign-in cookies are signed, limited to our site and unreadable by the page's scripts. Your SteamID is kept only in session records, the private SteamID index, your profile and the backups; everything else uses your account key or a one-way code. We never receive a password. Only our team can reach our operator tools, and only one of them can erase an account.

11. Changes to this policy

We publish any change on this page with a new date. If a change affects what we collect or why, we also say so in the game's update notes.

12. Contact

Territory Battle: contact@territorybattle.com