Core Directive: Empire
A game by NorseByte
Privacy Policy
Last updated:
Who we are
NorseByte (Håkon Skrindo), an independent developer in Norway, makes and runs Core Directive: Empire, a strategy game for iOS and Android, and the servers that host its game worlds. We are the data controller for the personal data described here.
Contact: contact@norsebyte.com
This policy covers the game apps and our game servers. Apple's App Store and Google Play handle your purchases and store accounts under their own privacy policies.
Data we collect
You can play without giving us your name, email or phone number. On first launch the game creates a guest account with a random ID and a random player name (for example "Commander-7QX2").
| Category | What exactly | Where it comes from |
|---|---|---|
| Account | Random player ID, player name and the names it had before (when each changed, and whether you or a moderator changed it), when the account was created, number of worlds played | Created by us |
| Sign-in sessions | Session IDs, when each session started and was last used, and when it was ended, and an identifier of the phone it was last used on (on Android, the device ID Android gives the app; on iOS, a random ID the app keeps on the phone), stored only as a keyed one-way hash. Sign-in tokens are stored only as one-way hashes. | Created when you sign in on a device |
| Linked Apple or Google account | That provider's account ID for you, and the email address the provider shares with us (with Apple this may be a private relay address) | Apple or Google, only if you choose to link the account |
| Purchases | Which token pack you bought, the store (Apple or Google), the store's transaction or order ID, and any refund the store reports | Apple App Store or Google Play |
| Tokens | Your token balance and a record of every token credit and spend | Created by us as you play |
| Gameplay | Territory, armies, orders, research, Generals, cosmetics, alliances, saved directives, world rank and score, and messages you post to a world with the in-game broadcast | Created by you as you play |
| Chat | Messages you post in world chat and alliance chat, messages and alliance names you report (we keep a copy of each reported message or name), and the players you block | Created by you as you play |
| Moderation | Mutes and suspensions on your account (the reason, when and for how long), whether moderators upheld or dismissed reports of your messages and reports you made, and a record of each moderator action (which moderator, what they did, to which account, and when) | Created by our moderators, and by the game when several players report a message |
| Push notifications | A push token for each phone that receives notifications (a random ID the push service gives the app), whether it is Android or iOS, your notification settings, and, if you set quiet hours, your phone's time zone | Your phone, when you allow notifications |
| Network address | Your IP address, used briefly to limit how many accounts one address can create per hour | Your device's connection |
We don't receive your card or payment details; the store handles payment. The game doesn't access your location, contacts, photos, camera or microphone. It contains no advertising and no analytics or tracking SDKs. The Android app includes Google's Firebase Cloud Messaging only to deliver notifications; it creates a Firebase installation ID on the phone for that purpose.
How we use your data
We use your data only to run the game. We don't sell it, profile you for advertising or use it to train AI models.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Run your account and keep you signed in across devices | Account, sessions, linked Apple/Google account | Contract (Art. 6(1)(b)) |
| Run the game worlds, resolve battles and show rankings | Gameplay, account | Contract (Art. 6(1)(b)) |
| Deliver tokens you buy and handle store refunds | Purchases, tokens | Contract (Art. 6(1)(b)) |
| Run world and alliance chat, mask offensive words, and act on reports and blocks | Chat, account | Contract (Art. 6(1)(b)) for chat; legitimate interests (Art. 6(1)(f)) for moderation: keeping chat safe |
| Moderate the game: hide a message once several players report it, until a moderator reviews it; let moderators remove messages, mute or suspend players who break the rules, and rename offensive player and alliance names; keep a suspended player from coming back on the same phone with a new account; tell you the outcome; and keep a record of what moderators do | Moderation, chat, account, alliances, sign-in sessions | Legitimate interests (Art. 6(1)(f)): keeping the game safe for players and holding moderators accountable |
| Send the push notifications you choose (attacks on you or your allies, alliance news, finished training and research) | Push tokens, notification settings, time zone, gameplay | Contract (Art. 6(1)(b)); you can turn them off at any time |
| Keep accounting records of sales | Purchases, tokens | Legal obligation (Art. 6(1)(c)) |
| Prevent abuse: mass account creation, stolen sign-in tokens, cheating | Network address, sessions, gameplay | Legitimate interests (Art. 6(1)(f)): keeping the game fair and secure |
| Answer support requests | What you send us, plus the account data needed to help | Contract, or legitimate interests |
You decide which notifications reach your phone. In the game, Account → Notifications has a switch that turns them all off, a switch for each kind, and optional quiet hours with no notifications. Your phone's settings can turn them off as well. Turned off, nothing is sent; the game's own log still shows what happened.
What other players can see
The game is multiplayer, so other players in your world can see:
- your player name
- the territory you hold and your armies on the map
- your alliance, rank and score
- messages you post in world chat (everyone in your world) and alliance chat (your alliance)
- broadcasts you post and monuments you place
Other players never see your linked Apple or Google account, your email address, your purchases, your token balance, whom you block or report, any mute or suspension on your account, or your notification settings. Don't put personal information in chat or broadcasts: everyone in the world can read world chat and broadcasts.
Moderation
Moderators we appoint review reported messages and act on them. They see the reported message, the player names of its author and of the players who reported it, and each player's moderation history: earlier reports, their outcomes, past mutes and suspensions, and the player names they had before. They don't see your linked Apple or Google account, your email address or your purchases.
A message several players report is hidden automatically until a moderator looks at it; a moderator, not the game, decides whether it stays hidden. A moderator may remove messages, change an offensive player name (yours becomes one they choose or a random one, and you're told why), rename an alliance with an offensive name, mute you in chat, or suspend your account for a time or permanently. You're told in the game when you're muted, and why. A suspended account can't sign in or join a world, and it leaves its current world: its armies and territory go, as when an account is deleted. While a suspension lasts, it also covers the phones the account was used on in the 30 days before it: they can't create a new account or sign in to any account. Players can also report an alliance's name; a moderator then keeps it or renames the alliance. If you think a decision was wrong, email contact@norsebyte.com.
Who we share data with
We share data only where it's needed to run the game:
| Recipient | Why | What they receive |
|---|---|---|
| Apple | Sign in with Apple; verifying App Store purchases and refunds | Sign-in tokens and transaction data your device sends us to check |
| Google sign-in; verifying Google Play purchases and refunds; delivering push notifications to Android phones (Firebase Cloud Messaging) | Sign-in tokens, purchase tokens and order IDs; for notifications, the phone's push token and the notification's text and sector number (for example "Vex is marching on your sector 31") | |
| [Hosting provider] (data processor) | Runs our servers and database in [region] | All game data, stored on our behalf under a data processing agreement |
We may also share data when the law requires it, or to protect players or the game from fraud or abuse. If the game is sold or transferred, the buyer takes over this policy.
How long we keep data
| Data | Kept for |
|---|---|
| Account, progress, Generals, cosmetics, tokens | Until you delete your account |
| World state (map, armies, territory) | Until the world's season ends; then the world is wiped. Your final rank and score stay with your account. |
| Sign-in sessions | Until you sign out or delete your account. Ended sessions are kept [N months] as a security record. |
| Chat messages | The last 200 messages of each channel, until the world's season ends. An alliance's chat goes when it disbands; your messages go when you leave the world or delete your account. |
| Chat reports and blocks | Reports (of messages and of alliance names): [N months] after they are reviewed. Blocks: until you unblock the player. Both are removed when you delete your account. |
| Earlier player names | Until you delete your account, so moderators can see who a player was before |
| Mutes and suspensions | Until you delete your account, so moderators can see repeated rule-breaking; an ended mute or suspension stays on record. A suspension still running when the account is deleted is kept, with the phone identifiers it covers, until it ends. |
| Record of moderator actions | [N years]; once the account is deleted, linked only to its anonymous ID |
| Push tokens and notification settings | A phone's token until you sign out on it, the push service tells us it is no longer valid, or another account signs in on that phone. Settings until you delete your account. |
| IP address for rate limits | In server memory for up to one hour; not written to the database |
| Purchase and token records | [5 years] after the end of the accounting year, as Norwegian bookkeeping law requires, linked only to an anonymous ID once the account is deleted |
| Server logs | [N days] |
| Unused guest accounts | Deleted after 12 months without a sign-in |
Your rights and deleting your account
You can delete your account in the game's settings by typing your player name to confirm. Deletion takes effect immediately and can't be undone:
- Your player name is replaced with a random placeholder, the names you had before are deleted, and every sign-in session ends.
- Your linked Apple and Google accounts and their email addresses are removed. Signing in with them again creates a new, empty account.
- Your phones stop receiving notifications: their push tokens and your notification settings are deleted.
- Your chat blocks and reports, reports others made of your messages, and any mutes or suspensions on your account are deleted, except a suspension still running, which is kept until it ends so it still applies to the phones it covers. The record of moderator actions keeps only the anonymous ID.
- If you're in a live world, you leave it: your armies are removed, your territory is freed and your chat messages are deleted on the next game tick.
- Your remaining tokens are forfeited.
- Purchase records stay, under the anonymous ID only, for accounting and refunds.
If you can't open the game, or your account is suspended, email contact@norsebyte.com to delete your account. We'll ask you to prove that the account is yours.
Under the GDPR you can also ask us to access, correct, export or restrict your data, or object to our processing. Email contact@norsebyte.com and we'll reply within one month. You may complain to the Norwegian Data Protection Authority (Datatilsynet) or the authority where you live.
Children, security and transfers
Children. The game is not directed at children under 13. We don't knowingly collect data from them. If you believe a child under 13 has an account, email us and we'll delete it. Purchases go through Apple's and Google's parental controls.
Security. Connections to our servers are encrypted. On your device, the app keeps your sign-in in the iOS Keychain or Android Keystore. On our servers, sign-in tokens are stored only as hashes, so a database leak would expose no usable token. Reusing an old sign-in token ends the whole session, which protects you if a token is stolen.
International transfers. Our servers are in [EEA region]. Apple and Google may process data outside the EEA under their own safeguards, such as the EU–US Data Privacy Framework or standard contractual clauses.
Changes and contact
When we change this policy, we'll update the date at the top. If a change materially affects how we use your data, we'll tell you in the game before it takes effect.
You can send questions or requests about your data to contact@norsebyte.com.