Privacy Policy

1. What we collect

• Account — email address, hashed password (via Supabase Auth), Google OAuth identifier if you sign in with Google.
• Game state — your in-game handle, race, planet name, fleets, resources, battle history, alliance membership, sector chat messages.
• Push subscriptions— if you opt in to push, your browser's push endpoint URL and encryption keys.
• Operational logs — server logs may contain IP addresses for abuse prevention. Retained 30 days.

2. What we don't collect

• No third-party advertising trackers.
• No location data beyond the country-level inference an IP provides.
• No microphone, camera, or contacts access.

3. How we use it

Solely to run the game: authenticate you, render your cockpit, resolve combat, deliver push notifications you opted into, and prevent abuse. We don't sell, rent, or share your data with third parties for marketing.

4. Public visibility

By design, the following are visible to other players in the same game round:

• Your commander handle and race.
• Your planet name and coordinates.
• Combat reports involving your planet.
• Sector chat messages you send.
• Alliance membership (when you join one).

Your email address, password, and push subscription details are never visible to other players.

5. Your rights

You can delete your account at any time by contacting support@galaro.app. Account deletion removes your auth record, player record, planet, fleets, push subscriptions, and chat messages.

Under GDPR / UK GDPR you also have rights of access, rectification, objection, and data portability. Same email address handles all of these.

6. Data processors

• Supabase — Postgres, Auth, Realtime, Storage. EU and US regions.
• Vercel — application hosting + edge functions.
• Web Push providers — your browser's push service (Apple, Google, Mozilla). We send notifications via the standard Web Push protocol.

7. Contact

Questions: support@galaro.app.