Privacy | Tracks of War

This website

tracksofwar.com is a static site. It sets no cookies, runs no analytics or advertising code, and loads nothing from other companies: fonts, images and scripts all come from this domain. There are no forms, so we never ask you for anything here.

The only thing the site keeps is your choice if you press Day or Night at the top: one word ("light" or "dark") in your browser's local storage, so the next page opens in the same colours. It is not a cookie, it is never sent to us or anyone else, and we keep it only because you asked us to remember this choice, which is strictly necessary for that. You can clear it in your browser settings or by picking your system's own setting again.

The site is hosted on Cloudflare Pages. To deliver the pages and protect them from abuse, Cloudflare processes your IP address and request details (such as the page you asked for and your browser type) under the Cloudflare privacy policy. We do not receive these logs and we do not keep any of our own.

Because there are no cookies and nothing tracks you, there is no cookie banner to click. Links to Discord, Reddit and Fandom take you to those services, where their own policies apply.

If you write to us by e-mail, we use your message and address only to answer you, and delete them when the conversation is over unless the law asks us to keep them. The game's list of what it does not collect, further down, is about the game; it does not cover mail you send us.

The game's privacy policy follows below.

The game

Effective date: 2026-10-12

Tracks of War ("the game") is made by Iron Compass Studios, which is the controller of the data described here. Contact: emrecapli@hotmail.com.

The short version

Single player runs on your phone. Nothing from it is sent to us.
There are no ads, no analytics or tracking SDKs, and no advertising ID. We do not sell data.
Online play can use an optional account, created with Google sign-in. We keep only what the online features need.
Only when you play online, send feedback or confirm a crash report does the game send data to our own server. This page lists exactly what.
You can delete your account at any time, in the game or on our web page.

What the game sends, and why

Nickname. The name you choose in Options. It is sent when you go online so other players can see you. It is shown in rooms and chat, and stored in match records, reports and the feedback you send. An account has one nickname, which you can change once every 30 days.
Session data (online). A random session token, the game version, build number and protocol version. Used to let you into the lobby and to refuse old versions. Kept in the server's memory only, and dropped after 10 minutes without activity.
Random player ID. The game creates a random 128-bit number on your device the first time you play online. It is sent with Quick Match so we can keep a hidden skill rating and pair players fairly. It is not linked to your phone, your Google account or any real identity. Other players see only a key derived from it, never the number itself. Uninstalling the app deletes it from your device.
Account (optional, Google sign-in). The game gets a signed sign-in token from Google and sends it to our server. The server checks the token against Google's published keys, derives a keyed hash (HMAC-SHA256) of your Google account ID from it, and keeps only that hash. The sign-in token is received, checked and discarded; the server stores none of its contents. Your account has a random public ID that is not derived from your Google ID. On your phone the account sign-in is stored encrypted. The server keeps only a hash of that sign-in token, and it expires after 180 days without use.
Ratings and results. Ranked and Quick Match: your skill rating, games, wins, losses, draws, season, rank and peak rank. A guest's hidden Quick Match rating is kept under the random player ID.
Friends. If you have an account: your friend list (accepted friends and pending requests). Friends can see whether you are online, in a lobby or in a match. Other players cannot.
Blocks. The players you block. Blocks of an account are kept on the server and follow the account; a guest's blocks stay on the device until you sign in, then they are uploaded to the account.
Reports. A report contains the reason (cheating, abusive chat, offensive name, griefing or other), an optional note, and the reported player's nickname and ID. The server adds the match ID and the last 50 chat lines of the room. Those lines are kept in server memory for 30 minutes after the room closes, and are copied into a report only when someone reports a player. You can report only players you shared a room with in the last 30 minutes.
Profile card. When another player in the same room asks, the game sends them your career statistics and your latest match summaries. It is passed through the server to that player and not stored.
Chat. Room and match chat is passed on to the players in the room. It is held in server memory for 30 minutes (for reports, see above), is not written to our logs, and is checked against our own list of blocked words, which are replaced with ***.
Match data. During an online match the server relays the players' commands. When the match ends we store one record: match ID, room, mode, map, how it ended, number of turns, each human player's nickname, player ID, team and nation, and the result each player reported (winner, scores, and a checksum used to detect cheating).
Crash reports (only if you confirm). After a crash the game asks whether to send a report. If you agree it sends: game version and build number, device model, Android version, graphics card name, language, what the game was doing (menu, match or training, the map, the number of players and the game's tick counter), start time, how long it ran, memory in use (game and graphics), total and free device RAM, graphics preset and frame-rate limit, frame rate and game-simulation time per step, the last errors and warnings from the game log (up to 20 lines), your optional note, and the last part of the game's log file (up to 12,000 characters). The log can contain technical details of your device. No contacts, photos, files or accounts are read.
Feedback (only if you send it). The text you write, plus game version, build number, language and your nickname.
IP address. Any internet connection reveals your IP address. The server uses it for abuse protection (rate limits, a cap of sessions per address) and keeps it in memory only while that is needed. Crash reports, feedback and logs keep only a shortened form (IPv4 to the first three numbers, IPv6 to the first 48 bits). We do not use it to find your location.

What we do not collect

Real name, e-mail address, phone number, precise or approximate location, contacts, photos, files, microphone or camera data, advertising ID, payment data, or anything about other apps on your phone. The sign-in token is received, checked and discarded; the server stores none of its contents. The game is free to play and has no ads. Ration Coupons are earned only by playing, cannot be bought and have no cash value. If paid cosmetic items are added later, they will be sold only through Google Play, which handles the payment (we never receive your payment details), and refunds follow Google Play's refund policy.

Who sees your data

Other players see your nickname, your chat and, on request, your profile card. Your friends also see whether you are online, in a lobby or in a match.
Every online session can see the public leaderboard: the top 100 players of the season with nickname, rank and number of games. It can also look up the profile of any account by its public ID: nickname, rank, season statistics and badges.
Google checks your sign-in under its own privacy policy. We receive only the result of that check.
We (Iron Compass Studios) can read crash reports, feedback, reports and match records. We read reports only to handle them.
We do not share data with advertisers, data brokers or analytics companies. The server runs on a cloud virtual machine that we rent (Oracle Cloud); it stores data for us and does not use it for itself. Database backups are made on that server, copied to our own computer, and kept in our cloud backup folder (Microsoft OneDrive). We may disclose data if the law requires it.

How long we keep it

Session data and IP addresses: in server memory only, for as long as the session lasts (at most about 10 minutes after the last activity).
Chat: in server memory for 30 minutes, then discarded. It is copied into a report only when someone reports a player.
Server logs: events only, with shortened IP addresses and no chat or tokens; the log files rotate automatically (3 files of 10 MB).
Crash reports and feedback: the newest 500 of each are kept and older ones are deleted automatically. We also delete them when the problem is fixed or when you ask.
Reports: until we handle them. Handled reports are deleted 180 days after handling.
Leave penalties (queue locks), warnings and bans: the penalty history is deleted 180 days after each entry, and your current penalty level fades with clean matches and time. A warning is deleted once it has been shown, or after 180 days. A temporary ban lasts until its end date, a permanent ban until we lift it.
Match logs (the relayed commands and the match record): 14 days for matches in rooms, 30 days for Quick Match and Ranked matches. Disputed, out-of-sync, reported matches and ranked matches ended by a player leaving are kept for 90 days.
Ratings, ranks and friend lists: while your account exists. Blocks and friend requests stay until you remove them or delete your account.
Sign-in tokens: 180 days after the last use, and at most five per account.
Database backups: the last 14 nightly backups. A deleted account is removed from the live database at once and drops out of the backups as they expire.
Data on your phone (settings, saves, statistics, player ID, account sign-in) stays there until you clear the app's data or uninstall it. Signing out removes the account sign-in from your phone.

Security

Everything between the game and our server is encrypted (HTTPS and secure WebSocket). Sign-in uses Google, so the game never handles a password. The server stores sign-in tokens and Google account IDs only as hashes, and the key used for those hashes is kept apart from the database and from the backups. The server limits how often one address can connect and accepts only small, checked messages. No system is perfectly secure, which is why we keep what we hold to a minimum.

Your choices and rights

Do not go online and nothing is sent. Single player works without a connection.
Crash reports and feedback are sent only when you confirm.
You can change your nickname in Options (accounts: once every 30 days).
Delete your account in the game (OPTIONS > ACCOUNT > DELETE ACCOUNT) or on the web at api.tracksofwar.com:8443/account/delete, which does not need the app. Deleting removes your account, ratings, friends, blocks and sign-in tokens.
Signing out in the game removes the account sign-in from that device only.
You can ask us for a copy of the data we hold about your account.
Guests have no account to delete: uninstalling the app removes the player ID from your device. To delete the ratings kept on our server, write to us.
You can ask us to delete, or to tell you, what we hold about you. Write to emrecapli@hotmail.com with your nickname and roughly when you played (the player ID is not shown in the game, so we find your records through these). You may also have rights under your local law (for example the GDPR in the EU or the KVKK in Turkey), such as access, correction, deletion and objection, and the right to complain to your data protection authority.

Children

The game is not meant for children under 13, and we do not knowingly collect data from them. If you think a child has sent us data, write to us and we will delete it.

Changes

If we change this policy we will update this page and its date. The current version is always available at this address and inside the game under Help, Privacy Policy.