Privacy Policy and user protection (18+ web game)

1. Nature of the service and age limit

Alleanza Criminale is a strategy web game set in a fictional mafia-themed story. Registration and use of the service are allowed only to users who are at least 18 years old. By registering, you declare under your own responsibility that you are of legal age.

If we detect, or receive a reliable report, that an account belongs to a minor, we may suspend or delete the account without notice and remove the related data.

2. Data we collect

• Account data: username, email, encrypted password.
• Technical data: access logs, request date and time, application errors and security metadata.
• Game data: progress, resources, houses, expeditions, statistics and leaderboard.
• Social login data (if you use OAuth): public identifier and the minimum information provided by the provider.
• Language preference: stored in a technical cookie to show the site in the language you chose.
• Browsing statistics, only if you consent: pages visited, visit duration, device and browser type, approximate geographic area, collected through Google Analytics with a random identifier (see section 11).

3. Purposes of processing

• Creating and managing your game account.
• Ensuring security and preventing abuse, fraud and unauthorised access.
• Providing multiplayer features (leaderboard, interactions and game mechanics).
• Complying with legal obligations and responding to requests from the competent authorities.
• Only with your consent: measuring site usage in aggregate form to improve it.

4. Legal basis

Data is processed to provide the service requested by the user, for our legitimate interest in keeping the platform secure and, where necessary, to comply with legal obligations (Art. 6(1)(b), (f) and (c) of Regulation (EU) 2016/679, GDPR).

Google Analytics statistics rely solely on your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code), which you can refuse or withdraw at any time with no effect on your use of the game.

5. Retention

We keep data for as long as needed for the purposes above. In case of prolonged inactivity or account closure, data may be deleted or anonymised, unless the law requires us to keep it.

6. Data sharing

We do not sell personal data. Data may be processed by technical providers (hosting, email, security) appointed as data processors and, when required, disclosed to public authorities.

If you consent to statistics, browsing data is processed by Google Ireland Ltd (Gordon House, Barrow Street, Dublin 4, Ireland) as data processor. Google may transfer it to the United States to Google LLC, certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023). The site's fonts and UI libraries are served from our own servers: without consent your browser does not contact any third-party service.

7. Your rights

You can request access, rectification, erasure, restriction, data portability or object to processing, within the limits set by law (Arts. 15-22 GDPR), and withdraw your consent to statistics at any time with the “Cookie preferences” button at the bottom of this page.

You also have the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country of residence.

For privacy requests: [email protected]

8. Security

We apply appropriate technical and organisational measures to protect data (e.g. encrypted passwords, access control, monitoring and application hardening), although absolute security on the Internet cannot be guaranteed.

9. Game content

The game contains fictional, playful references to crime and conflict. It does not promote or encourage illegal activities in the real world. Access is forbidden to anyone under 18.

10. Facebook User Data Deletion

For Facebook logins, automatic deletion requests can be sent to the following endpoint: /facebook/data-deletion (POST method with signed_request).

Request status callback URL: /facebook/data-deletion/status/{confirmation_code}. In the Facebook App Dashboard, configure the User Data Deletion section with the full public URL of your instance (e.g. https://your-domain/facebook/data-deletion), making sure it points to this endpoint.

11. Cookies and local storage

Technical cookies, needed for the site to work and therefore set without consent:

• JSESSIONID: game session after you log in; expires when you close the browser or log out.
• remember-me: only if you choose “Keep me signed in”; keeps you logged in for 30 days.
• lang: chosen language; lasts 365 days.
• analyticsConsent (browser local storage, not a cookie): remembers whether you accepted or declined statistics.

Third-party analytics cookies, set only after you click “Accept”:

• _ga and _ga_<ID> (Google Analytics 4): tell visits apart with a random identifier; they last up to 2 years. Advertising and ad personalisation features are turned off.

Until you choose, no analytics cookie is set and Google Analytics is not loaded. Declining is as easy as accepting and does not limit the game. If you withdraw consent the _ga cookies are deleted. More on how Google processes data: policies.google.com/privacy.