1. Who we are
GeoTrainers (www.geotrainers.com) is an independent project published by Alessio M., an individual publisher based in France. For the purposes of the General Data Protection Regulation (GDPR), the publisher is the controller of the personal data described in this policy.
For any question about this policy or about your data, write to contact@geotrainers.com.
2. Playing without an account
Every game mode can be played without signing up. Most guest scores, sessions and settings stay only in your browser. Atlas Dominion battles are also stored on our server under a random secret kept by your browser so that you can reconnect, consult your history and create a replay link without an account.
An account is required only for features tied to a lasting identity, such as competitive leaderboards, friends and cross-device synchronisation. Atlas Dominion live rooms remain available to guests under the nickname they choose.
3. Data we collect
We collect only what a game account actually needs. We never buy data about you, and we never sell or rent your data.
| Category | What it includes |
|---|---|
| Account | Your email address, your display name, your password (stored only as an Argon2id hash — never in clear text), your optional country, your preferred language, whether your email is verified, and your registration date. |
| Google Sign-In | If you choose to sign in with Google, we receive your Google account identifier, your verified email address and your public name, which is used to suggest a display name. We never receive your Google password. |
| Gameplay | Scores, sessions, rounds played, cities found, Elo rating, daily challenge results, Atlas Dominion claims and territory timelines, and the statistics derived from them. |
| Atlas Dominion guest access | A random secret stored in your browser links you to your guest battles. We store only a one-way hash of that secret. It is not an account, email address or advertising identifier. |
| Social features | Friend requests and friendships, your online presence, multiplayer sessions you create or join, the messages you send in in-game chat, and the invitation or challenge links you generate. |
| Preferences | Your theme, your language, and whether your name is visible on public leaderboards. |
| Technical data | Your IP address, used to rate-limit sign-in and sign-up attempts, and standard server logs kept for security and troubleshooting. If you consent to Google Analytics, Google may also receive page URLs, approximate location, device and browser information, interaction data and Analytics identifiers. |
We do not collect any special category of data: no precise geolocation, biometric data or card details. Stripe handles payment information for optional contributions. We retain only the transaction references, status and amount needed for accounting and fraud handling, plus a public name only when a contributor explicitly asks to appear on the thank-you wall.
4. Why we use it, and on what legal basis
- Running your account and the game — creating your account, saving your progress, ranking you, letting you play with friends. Legal basis: performance of the contract you enter into by creating an account.
- Sending service emails — email verification and password resets. Legal basis: performance of the contract. We do not send marketing emails.
- Keeping the service secure and fair — rate-limiting authentication attempts, detecting cheating and abuse, moderating chat. Legal basis: our legitimate interest in protecting players and the service.
- Measuring how the site is used — our aggregated first-party counters rely on our legitimate interest in improving the game. Google Analytics is activated separately and only on the legal basis of your consent.
- Complying with the law — responding to a valid legal request. Legal basis: legal obligation.
6. Audience measurement
We use Google Analytics 4 (measurement ID G-5CQ79HGDDM) only after you explicitly accept it. Before acceptance, the Google Analytics script is not downloaded and no Analytics request is sent. Advertising storage, Google Signals and ad-personalisation signals are disabled.
For each day and each game mode we increment simple counters — page views, games started, sessions completed. To count unique visitors without identifying them, your IP address is turned into an irreversible salted hash; the hash is stored, the IP address is not. A country code may be derived from our network provider's header to show a rough geographical breakdown. None of this data is linked to your account or used to build a profile.
You can refuse or withdraw consent at any time. Refusing disables both Google Analytics and our first-party audience counters. It stores only your choice in the browser and removes accessible Google Analytics cookies. You can reopen the choice panel below. If you have any doubt, write to contact@geotrainers.com.
7. What other players can see
Some of the information attached to your account is visible to other people, because the features would not work otherwise:
- Your display name, your country flag and your score appear on public leaderboards.
- Your display name and your online status are visible to the players you have accepted as friends.
- In a multiplayer session, the other participants see your display name, your progress in the game and the messages you send in chat.
- An Atlas Dominion replay link is unlisted but can be opened by anyone who receives it. It shows the nicknames and results of every participant. Opening the link renews its expiry for six months, and its owner can revoke it from their history.
Your email address is never shown to other players. You can also hide your name from public leaderboards at any time from your account page: your score is then displayed anonymously.
8. Service providers and third parties
We do not sell your data and we do not share it with advertisers. A small number of technical providers are involved in delivering the game, and by the nature of a web request they receive your IP address:
- Our hosting provider, which runs the servers and the database in the European Union.
- Google, for the optional "Sign in with Google" feature, web fonts and Google Analytics 4. Analytics is contacted only after your consent; Google then acts as an analytics service provider under its own privacy and data-transfer safeguards.
- CARTO and OpenStreetMap, which supply the map tiles displayed in the game modes.
- jsDelivr, the content delivery network that serves the interface libraries.
- Our email provider, which delivers verification and password-reset messages over SMTP.
- Stripe, which securely processes optional contributions, recurring payments, cancellations and refunds under its own privacy safeguards.
Links to X or YouTube are ordinary external links: those platforms only receive data if you actually click through, and their own policies then apply. Stripe is contacted only when you choose to start or manage a contribution.
9. International transfers
Your account and gameplay data are stored in the European Union. Some of the providers listed above, in particular Google, may process technical data outside the European Union. Those transfers rely on the safeguards provided for by the GDPR, such as the European Commission's standard contractual clauses or an adequacy decision.
10. How long we keep your data
- Account and gameplay data: for as long as your account exists. Deleting your account deletes them.
- Finished multiplayer sessions and their chat messages: automatically purged a few weeks after the session ends.
- Atlas Dominion histories and replays: account battles are kept while the account exists. Guest-only battles and unlisted replay links expire after six months without renewed replay activity. Expired connection tickets and abandoned rooms are removed sooner.
- Rate-limiting records: kept for a short period, only as long as needed to block a burst of attempts.
- Verification and password-reset tokens: valid for a few hours, then expired and deleted.
- Aggregated audience counters: kept without time limit, as they contain no personal data.
- Google Analytics data: retained according to the retention settings of our GA4 property. Withdrawing consent stops future Analytics collection and removes accessible Analytics cookies from your browser.
- Contribution records: transaction references are retained for the period required for accounting, legal and dispute handling. A voluntarily published name remains visible for twelve months after a one-time contribution, or while monthly support is active, and can be hidden sooner on request.
Deleting your account is immediate and permanent: your profile, personal scores, friendships and messages are removed, and we cannot restore them afterwards. In a shared Atlas Dominion battle, the battle remains available to its other participants but your nickname is replaced with “Deleted player”. A leaderboard score may remain visible anonymously until the next refresh.
11. Security
Passwords are hashed with Argon2id and are never stored or transmitted in clear text. The whole site is served over HTTPS, sessions are protected against cross-site request forgery, sign-in attempts are rate-limited, and database queries are parameterised against injection. Access to the servers is restricted to the publisher.
No system is perfectly secure. If you believe you have found a vulnerability, please report it privately to contact@geotrainers.com rather than disclosing it publicly.
12. Your rights
Under the GDPR you have the right to access your data, correct it, erase it, restrict or object to its processing, and receive it in a portable format.
Several of these rights can be exercised directly and instantly from your account page: change your display name or country, adjust your leaderboard visibility, or delete your account entirely. For anything else, write to contact@geotrainers.com; we reply within one month at the latest, and we may need to verify your identity before acting on a request.
If you consider that your rights have not been respected, you can lodge a complaint with the French data protection authority, the CNIL — www.cnil.fr.
13. Children
GeoTrainers is suitable for all ages, but creating an account requires you to be at least 13 years old. In France, players under 15 need the consent of a parent or guardian, who may exercise the rights described above on their behalf. Optional contributions may be made only by an adult or with permission from a parent or legal guardian. If we learn that an account was created for a younger child without the required consent, we will delete it.
14. Changes to this policy
As the game evolves, this policy may be updated. The date at the top of the page always shows the latest version. If a change materially affects how we use your data, we will announce it on the site before it takes effect.
15. Contact
A question, a request about your data, or a doubt about something in this policy? Write to us — a human reads every message.