Privacy Policy

Last updated: 11 November 2026

This page explains which data the game Nordreich and this website process, why, for how long, and what rights you have.

1. Controller

Silverback Ecom GmbH
Begasstr. 3
16341 Panketal
Germany
Email: dpo@nordreich.eu

More details are in the legal notice.

2. Your save

On first start, our server creates a save with a player ID. The app stores a random identifier, a sign-in key and the player ID on your device. Your save includes everything you build and own in the game, as well as your player name and your settings. We also store which version of the Terms of Use you accepted and when, which version of this policy you were shown and when you confirmed a notice of a change to the game.

Purpose: to provide the game and to document the conclusion of the contract. Before you accept the Terms of Use, we process only the save. Legal basis: contract or steps prior to entering into the contract that you request by starting the app (Art. 6(1)(b) GDPR); for these records, our legitimate interest in being able to prove the conclusion of the contract and the receipt of these notices (Art. 6(1)(f) GDPR). Retention: until you delete your account. If you never accept, we delete the save 30 days after you last started the app.

3. Signing in with Game Center, Apple or Google

You can connect your save with Game Center or “Sign in with Apple” or Google Play Games to continue playing it on another device. If you are signed in to Game Center or Google Play Games on your device, the game connects your save to it by itself once you have accepted the Terms of Use. In doing so, we only receive a fixed identifier of your account. If you are signed in there, the app also reports your achievements and your scores for leaderboards; Apple or Google show them there according to your settings.

Legal basis: contract (Art. 6(1)(b) GDPR); we base the connection without a tap on our legitimate interest in protecting your save from loss (Art. 6(1)(f) GDPR). You can object to it (section 13). Retention: until you delete your account.

4. What other players see

Other players see your player name, your island, your power, your title, your places in rankings, your clan, battle reports you are part of, and what you write in chat; your clan also sees when you were last active, and your contributions. Players looking for a clan see how many of a clan’s members played in the last seven days. If you haven’t played for 21 days, we don’t show your island to others on the world map, among the targets or in the ranking by power until you play again. Legal basis: contract (Art. 6(1)(b) GDPR). So please don't choose a player name that identifies you in real life.

Inviting friends (“Call companions”): If someone follows your invite code, we store who followed whom, when and which way, how far the companion has got in the game and which rewards the two of you have received. You see your companions' names and progress, your companion sees your name. So that each account with Game Center or Google Play Games brings a reward only once, we keep an irreversible checksum of its identifier. Legal basis: contract (Art. 6(1)(b) GDPR); for the checksum after deletion, our legitimate interest in preventing abuse of the rewards (Art. 6(1)(f) GDPR). Retention: until you or your companion deletes the account; the checksum for three years after the deletion.

5. Chat and moderation

We store chat messages with sender, channel and time. A word filter masks forbidden words and, for clear insults, mutes the sender for 10 minutes. If you report a message, we store a copy with the reason and your player ID; the reported player does not learn who reported it. We store moderation decisions with the rule they are based on. If there is a suspicion of a criminal offence that threatens a person's life or safety, we pass the message and the details about the sender on to the competent authority (Art. 18 Digital Services Act).

Purpose: to provide chat, remove illegal content and protect players. Legal basis: contract (Art. 6(1)(b) GDPR), legal obligations under the Digital Services Act (Art. 6(1)(c) GDPR) and our legitimate interest in a respectful community (Art. 6(1)(f) GDPR). Retention: messages 30 days; reports 6 months after the decision, 12 months in the case of a mute or a reset name; while an appeal or proceedings are pending, until they are concluded. If you delete your account, we immediately delete your messages, your reports and reports about you.

6. Purchases

Purchases are handled by Apple or Google; we do not see your payment details. We receive the purchase data (transaction number, product, time, the country of your store account) and later renewals, cancellations and refunds. So that a purchase is credited to the right save, we give Apple or Google, with the purchase, an identifier of your save that reveals nothing about you.

Purpose: to credit purchases, reverse the credit of refunded purchases and prevent abuse. Legal basis: contract (Art. 6(1)(b) GDPR) and our legitimate interest in settling claims from purchases and in preventing double credits (Art. 6(1)(f) GDPR). Retention: as long as your save exists; after your account has been deleted, until the end of the third calendar year after the purchase (Sections 195, 199 BGB). After that, we keep only the transaction number and the date of a refund, so that no purchase is credited twice.

Offers that fit how your game is going

The shop suggests some offers to you at fitting moments, for example after you have reached a goal, after a lost battle or when you are short of weapons. For this, our server evaluates your save, not your spending; it checks whether you already own a product only so that it does not offer it to you again. Legal basis: our legitimate interest in showing you our offers (Art. 6(1)(f) GDPR); you can object at any time (section 13). Retention: which offers you have received is stored in your save until you delete your account.

7. Notifications (push)

If you switch notifications on in the game, we store your device's push token, on Android also the Firebase installation ID, with the platform, language and offset from UTC of your device, so that notifications arrive in your language and at a suitable time. You receive notifications about a change to the game even if you have switched notifications off in the game; you can switch them off in your device's settings. Notifications are delivered through Apple or Google (section 12).

Legal basis: contract (Art. 6(1)(b) GDPR); the app reads this information only when you switch notifications on (Section 25(2) no. 2 TDDDG). Retention: until you switch notifications off, the token becomes invalid, a newer device displaces it (at most five devices per save) or you delete your account. We delete the installation ID at Google as soon as the device no longer belongs to your save or the app is no longer installed there; Google then removes it within 180 days. Apple or Google discard notifications that could not be delivered after 28 days at most.

8. Our own key figures

Our server evaluates what the game sends to it anyway, for example when the game is played, which goals are reached, purchases with the country of the store account and what runes are spent on. We evaluate this only across many players and never to make decisions about you or to make you offers. We only record it once you have accepted the Terms of Use. Occasionally we compare two variants of the shop; each save is assigned to one of them at random, and we do not adjust prices to you personally.

Legal basis: our legitimate interest in running the game economically and improving it (Art. 6(1)(f) GDPR). Retention: 400 days; if you delete your account or object, we delete them immediately, except the records of purchases and refunds.

9. Operation and backups

When the app or your browser reaches our server, your IP address is processed to establish the connection and to keep operation stable; it is stored for one hour at most. The server's logs contain no IP address; some contain the player ID. Backups of the database contain your data so that we can restore it. Legal basis: our legitimate interest in stable operation (Art. 6(1)(f) GDPR). Retention: logs 14 days at most, backups 22 days at most.

10. This website

This website sets no cookies and loads nothing from other servers. Your IP address is only processed to deliver the page (Art. 6(1)(f) GDPR) and is not logged.

11. Support

If you write to us, we process your email address, your message and the details we need to help you. If you ask us to sign out devices that are not yours, we store which devices they were until your account is deleted. We record what we do concerning a save, for example warnings and terminations as well as access and deletion at your request, with the player ID and the time so that we can prove it. Legal basis: contract or request (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c) in conjunction with Art. 5(2) GDPR) and our legitimate interest in answering requests and proving what we have done (Art. 6(1)(f) GDPR). Retention: emails about purchases and refunds 6 years from the end of the year in which they were received or sent (Section 257 HGB, Section 147 AO); evidence of requests concerning your rights 3 years and other emails 12 months after they were dealt with; the records 12 months, also after your account has been deleted.

12. Recipients

• IONOS SE, Montabaur, Germany: runs our servers, the storage for backups and our email mailboxes in Germany as our processor (Art. 28 GDPR). IONOS may anonymise this data and use it in anonymous form to improve its products (Art. 6(4) GDPR).
• Apple (Apple Distribution International Ltd., Ireland, and Apple Inc., USA): App Store and purchases, sign-in, Game Center and the delivery of notifications; Apple is itself the controller for this (apple.com/legal/privacy).
• Google (Google Ireland Ltd., Ireland, and Google LLC, USA): Google Play and purchases as well as Google Play Games as its own controller; Firebase Cloud Messaging for notifications as our processor (Art. 28 GDPR). Google also uses information that arises from running Firebase as its own controller (policies.google.com/privacy).
• Moderators who handle reports on our behalf and according to our instructions.
• Authorities, where we are legally obliged to do so.

Apple and Google also process data in the USA and other countries outside the EU. The basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework, otherwise the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR); you can obtain a copy on request to dpo@nordreich.eu.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

You delete your account yourself in the game (Delete your account). For all other requests, write to dpo@nordreich.eu, preferably with your support code from the game's settings (“Account”), so that we know the save is yours.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in your country or with the one responsible for us: the Brandenburg Commissioner for Data Protection and the Right of Access to Files (Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg), www.lda.brandenburg.de.

14. Obligation to provide data

Nordreich cannot be played without a player ID, a save and a player name. Signing in with Apple or Google and notifications are optional.

15. Children and young people

Nordreich is meant for players aged 13 and over. If we learn that a younger child is playing, we delete their account. No processing is based on consent under the GDPR.

16. No automated decisions

We make no decisions under Art. 22 GDPR. Only the short mute by the word filter and the hiding of messages reported several times run automatically; an appeal against them is decided by a person.

17. Changes

If the data we process changes, we update this policy and point this out to you in the game.