Privacy Notice

Last updated 10 September 2026

This privacy notice sets out how Fallen Marches collects, uses and protects your personal data. It is provided in a layered format so you can go straight to the section you need.

1. Important information and who we are

This privacy notice

This privacy notice tells you how Fallen Marches collects and uses your personal data when you visit our website, create an account, and play our games.

It does not apply to websites operated by anyone else that we may link to. See third-party links (paragraph 13).

Minimum age

Fallen Marches is for adults. You must be 18 or over to create an account, and the game is not intended for children. We do not knowingly collect personal data from anyone under 18.

Controller

Fallen Marches is the controller of, and responsible for, your personal data (referred to in this notice as "we", "us" or "our").

If you have any questions about this privacy notice, including any request to exercise your legal rights (paragraph 9), please contact us using the information in contact details (paragraph 10).

2. The types of personal data we collect about you

Personal data means any information about an individual from which that person can be identified.

We collect, use, store and transfer the following kinds of personal data about you, which we have grouped together as follows:

Identity Data includes the username you choose and the character name you create in the game.
Contact Data includes your email address. If we introduce paid services in future, it will also include the billing address you give us at that point.
Account Security Data includes a one-way cryptographic hash of your password (we never hold your password itself), the hashed sign-in, email-confirmation and password-reset tokens issued to your account, the date and time of your last sign-in, and the account's verified, banned and chat-muted status.
Technical Data includes your IP address, the browser type and version, operating system, device and platform you use, your time zone setting, and the records our servers keep of the requests your device makes to us and of your connections to the game server.
Usage Data includes information about how you use our website and the game, such as when you sign in and play and which pages you visit.
Communications Data includes the messages you send to other players through in-game chat, any reports you or others make to us about player behaviour, any appeal you make against a moderation decision, and any messages you send us by email.
Financial Data and Transaction Data. We do not currently sell anything, so at present we hold neither. If we introduce paid services, Transaction Data will include details of payments to and from you and of what you bought, and any payment card details will be entered into and processed by a third-party payment provider – we will not receive or store your full card details ourselves.

We also collect, use and share aggregated data, such as statistical data about how many players train a given skill. Aggregated data is not personal data, because it does not directly or indirectly reveal your identity. If we ever combine aggregated data with your personal data so that it can identify you, we treat the combined data as personal data.

Special category data

We do not ask for, and do not want, any special category personal data about you (for example data revealing your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, or genetic and biometric data). Please do not include such information in your username, character name or chat messages. We also do not collect any information about criminal convictions and offences.

If you do not provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you do not provide that data when asked, we may not be able to perform the contract – for example, we cannot create or maintain an account for you without an email address we can reach you at.

3. How is your personal data collected?

We use different methods to collect data from and about you, including through:

Your interactions with us. You give us Identity, Contact, Account Security and Communications Data when you create an account, confirm your email address, sign in, create a character, ask for a password reset, chat to other players, or contact us directly.
Automated technologies. As you use our website and the game, we automatically collect Technical Data about your device and connection, using strictly necessary cookies, browser storage and our own server logs. See cookies and local storage in paragraph 4.
Third parties. Our hosting, network security and email providers process this data on our behalf and generate technical records in doing so. If we introduce paid services, we will also receive Contact and Transaction Data from the payment provider that processes card payments.

4. How we use your personal data

Legal basis

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following:

Performance of a contract with you: where we need to perform the contract we are about to enter into, or have entered into, with you – that is, providing your account and the game.
Legitimate interests: where it is necessary to run and protect our business and our community, and to give you a secure and enjoyable game. We consider and balance any potential impact on you and your rights, both positive and negative, before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or permitted to by law. You can ask us for more information about this balancing exercise.
Legal obligation: where it is necessary to comply with a legal obligation we are subject to. We will identify the relevant obligation when we rely on this basis.
Consent: we rely on consent only where we have your active agreement to use your personal data for a specified purpose. You can withdraw consent at any time.

Purposes for which we will use your personal data

Below, in table format, is a description of the ways we use your personal data, the legal basis we rely on for each, and how long we keep the data. Where we rely on legitimate interests, we have said what those interests are.

Purpose/Use	Type of data	Legal basis and retention period
To create your account and confirm that the email address given belongs to you	Identity Contact Account Security	Performance of a contract with you Necessary for our legitimate interests (to confirm the address is reachable and genuine, which is our main defence against automated and abusive sign-ups) Retained for as long as your account is open. Confirmation links expire after 24 hours.
To run the game, create your character, and save and restore your progress between sessions	Identity Technical Usage	Performance of a contract with you Retained for as long as your account is open.
To sign you in, keep you signed in across sessions, and let you reset a forgotten password	Identity Contact Account Security Technical	Performance of a contract with you Necessary for our legitimate interests (to keep accounts secure and detect the reuse of stolen sign-in tokens) Sign-in tokens expire after 7 days, or after 30 days if you choose to stay signed in, and are deleted once expired. Password reset links expire after 60 minutes.
To show public leaderboards and to show your character to other players in the game world	Identity	Necessary for our legitimate interests (to run a shared, competitive online game, which players expect to include visible characters and public rankings) Shown for as long as your account is open. Removed from the leaderboards immediately when you delete your account.
To relay chat messages between players in the game world	Identity Communications	Performance of a contract with you Necessary for our legitimate interests (to provide a multiplayer game with player-to-player communication) Chat messages are passed between players in real time and are not stored on our servers.
To moderate the game, apply chat filters, and enforce our rules – including muting, suspending or banning accounts	Identity Communications Technical Usage	Necessary for our legitimate interests (to keep the game safe and fair, and to protect other players from abuse) Necessary to comply with a legal obligation (online safety) Moderation records are kept for as long as your account is open, and for up to 12 months after it closes where we need them to enforce a ban.
To keep the service secure and available – including rate limiting, logging requests, blocking automated abuse, diagnosing faults and taking backups	Identity Account Security Technical Usage	Necessary for our legitimate interests (network and information security, preventing fraud and abuse, and running the service) Necessary to comply with a legal obligation Server logs are kept for up to 30 days. Backups are kept for 30 days.
To manage our relationship with you, including answering your questions and telling you about changes to our terms or to this privacy notice	Identity Contact Communications	Performance of a contract with you Necessary to comply with a legal obligation Necessary for our legitimate interests (to keep our records up to date and to answer you properly) Correspondence is kept for up to 2 years after the matter is closed.
To fix problems and improve the game, using diagnostic information and aggregated statistics about how the game is played	Technical Usage	Necessary for our legitimate interests (to keep the game working, to balance it, and to develop it) Aggregated statistics are not personal data and may be kept indefinitely. The underlying personal data is kept only for the periods set out elsewhere in this table.
To take payment and deliver your order, if and when we introduce paid services – including managing payments and charges, and recovering money owed to us	Identity Contact Financial Transaction	Performance of a contract with you Necessary for our legitimate interests (to recover debts due to us) Necessary to comply with a legal obligation (tax and accounting records) Records of transactions are kept for 6 years from the end of the tax year they relate to. We do not process payments today; we will update this notice before we start.
To comply with our legal obligations, and to establish, exercise or defend legal claims	Any of the categories above, as relevant	Necessary to comply with a legal obligation Necessary for our legitimate interests (to protect our legal position) Retained for as long as needed for the obligation or claim, and then deleted.

Information other players can see

Fallen Marches is a shared online world, so some of what you do is deliberately public. Other players can see your username and character name, your character and where it is in the world, and any chat messages you send. Your username also appears on our public leaderboards at fallenmarches.com/leaderboard, alongside your character's levels and experience, which anyone can view without an account.

Please do not use your real name, email address or any other personal information as your username or character name, and do not share personal information in chat.

Direct marketing

We do not send direct marketing, and we will never sell or share your personal data with third parties for their own marketing purposes.

We do send service messages that are part of running your account – confirming your email address, resetting your password, telling you about important changes to our terms or to this notice, and answering you when you contact us. These are not marketing, and you cannot opt out of them while you hold an account, because we need them to provide the service.

Cookies and local storage

We use only strictly necessary cookies and browser storage. We do not use analytics, advertising or tracking cookies, and we do not track you across other websites, so we do not ask you for cookie consent.

tl_refresh – a cookie that keeps you signed in. It is httpOnly (so page scripts cannot read it), signed, restricted to our sign-in endpoints, and expires after 7 days, or after 30 days if you ask us to keep you signed in.
Browser local storage – the game stores your settings on your device.

You can delete cookies through your browser settings, but if you delete the sign-in cookie you will have to sign in again.

5. Disclosures of your personal data

We do not sell your personal data. We share it only where necessary, with the following parties, for the purposes set out in the table above:

Hosting and infrastructure. Our servers and database are hosted by a VPS located in the United Kingdom. Our encrypted backups are stored separately, in Gravelines, France.
Network, DNS and security. Our domains and traffic are served through Cloudflare, Inc., which provides DNS, TLS termination, caching and protection against attacks. This means Cloudflare processes the traffic between your device and us, including your IP address.
Email delivery. Our account emails – confirmation, password resets, and notices about your account – are sent through Resend (Plus Five Five, Inc.).
Payment providers, if and when we introduce paid services. We will name the provider in this notice before we do.
Professional advisers, including lawyers, accountants and insurers, where they need the data to advise us.
Regulators and law enforcement, including the Information Commissioner's Office, where we are required to report or disclose.
Buyers or sellers of our business. If we sell, transfer or merge parts of our business or assets, or acquire or merge with another business, the new owners may use your personal data in the same way as set out in this privacy notice. We will tell you before your data is transferred and becomes subject to a different privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes; they may only process it on our instructions and for the purposes we specify.

6. International transfers

Our servers and database are located in the United Kingdom. Our encrypted backups are stored in Gravelines, France, so that a failure affecting our servers cannot take the backups with it. France is covered by UK adequacy regulations.

Some of our service providers are based in, or may access data from, the United States. This applies to Cloudflare and to our email provider.

Whenever we transfer your personal data out of the UK to a country that is not covered by UK adequacy regulations, we make sure a similar degree of protection is given to it by using at least one of the following safeguards:

We transfer to countries the UK has decided provide an adequate level of protection for personal data.
We use the specific contract terms approved for use in the UK, which give transferred personal data the same protection as it has in the UK – the International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission's standard contractual clauses. To obtain a copy of these safeguards, please contact us (paragraph 10).
Where the receiving organisation in the United States is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on that certification.

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, or used or accessed in an unauthorised way, altered or disclosed. These include:

Passwords are stored only as salted one-way hashes, never in a form we or anyone else could read.
Sign-in, email-confirmation and password-reset tokens are stored as hashes, are single use, and expire. Reusing a spent sign-in token revokes that whole chain of sessions.
All traffic between your device and us is encrypted in transit using HTTPS.
The sign-in cookie is httpOnly, signed and restricted to our sign-in endpoints, and the site sets a strict content security policy, so a script injected into a page cannot read or steal your session.
Sign-in, registration and password-reset requests are rate limited, to make guessing and bulk automated abuse impractical.
Access to the live database and servers is limited to those who need it to run the service, and administrative functions in the game are restricted by role.

We limit access to your personal data to those employees, contractors and other third parties who have a business need to know. They process your personal data only on our instructions and are under a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach. We will notify the Information Commissioner's Office within 72 hours where we are legally required to do so, and we will notify you where the breach is likely to result in a high risk to your rights and freedoms.

8. Data retention

How long will you keep my personal data?

We keep your personal data only for as long as we reasonably need it for the purposes we collected it for, including to satisfy any legal, regulatory, tax, accounting or reporting requirements. The specific periods are set out in the table in paragraph 4. In summary:

Account data – kept for as long as your account is open.
Sign-in tokens – 7 days, or 30 days if you choose to stay signed in. Email confirmation links – 24 hours. Password reset links – 60 minutes.
Server logs – up to 30 days.
Backups – 30 days, after which they are overwritten.
Chat messages – not stored.
Correspondence with us, including any appeal against a moderation decision – up to 2 years after the matter is closed.
Records of transactions, if we introduce paid services – 6 years from the end of the tax year they relate to, because tax law requires it.

To decide the right retention period we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether we can achieve those purposes another way, and the applicable legal requirements.

We may keep your personal data for longer than the periods above if there is a complaint, or if we reasonably believe there is a prospect of litigation about our relationship with you.

Deleting your account

You can delete your account yourself at any time from your account dashboard. Deletion has a cooling off period of 14 days where you can prevent the deletion: once the cooling off period expires, your account and everything held with it – your email address, password hash, character, progress, inventory, storage chest, leaderboard entries and sign-in tokens – is erased from our live systems straight away, and you are signed out of the game.

Two things follow from that, and you should be aware of both before you delete: we cannot restore a deleted account or its character, and your username is released and may later be taken by someone else.

Copies of deleted data remain in our encrypted backups for up to 30 days, after which they are overwritten. During that period the data is not used for anything except restoring the service after a failure.

We may also anonymise your personal data, so that it can no longer be associated with you, for statistical purposes. We may use anonymised information indefinitely without further notice to you.

9. Your legal rights

You have a number of rights under data protection law in relation to your personal data. You have the right to:

Request access to your personal data, commonly known as a "subject access request". This lets you receive a copy of the personal data we hold about you and check that we are processing it lawfully.
Request correction of the personal data we hold about you. This lets you have any incomplete or inaccurate data corrected, though we may need to verify the accuracy of the new data you give us. You can change your email address by contacting us.
Request erasure of your personal data where there is no good reason for us to keep processing it, where you have successfully objected to processing, where we have processed it unlawfully, or where we must erase it to comply with the law. The quickest route is to delete your account yourself, as described in paragraph 8. We may not always be able to comply with an erasure request for specific legal reasons, which we will explain to you at the time.
Object to processing of your personal data where we rely on a legitimate interest and there is something about your particular situation that makes you want to object. In some cases we may show that we have compelling legitimate grounds that override your rights.
Object at any time to processing of your personal data for direct marketing. This is an absolute right. We do not carry out direct marketing, so in practice there should be nothing to object to.
Request restriction of processing of your personal data. This lets you ask us to suspend processing in one of the following situations:
- if you want us to establish the data's accuracy;
- where our use of the data is unlawful but you do not want us to erase it;
- where you need us to keep the data, even though we no longer need it, so that you can establish, exercise or defend a legal claim; or
- where you have objected to our use of your data and we are verifying whether we have overriding legitimate grounds to continue.
Request the transfer of your personal data to you or to a third party, in a structured, commonly used, machine-readable format. This right applies only to automated information that you first gave us by consent, or that we used to perform a contract with you.
Withdraw consent at any time where we rely on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdrew it. We do not currently rely on consent for anything, so this right is unlikely to arise.

You also have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. We do not make any such decisions. Automated systems do apply our chat filter and our rate limits, and can temporarily block requests, but a human decides any mute, suspension or ban.

How to exercise your rights

To exercise any of the rights above, please contact us using the details in contact details (paragraph 10). To delete your account, the fastest route is the delete option in your account dashboard.

No fee usually required

You will not have to pay a fee to access your personal data or to exercise any of your other rights. We may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive, or we may refuse to comply with it in those circumstances.

What we may need from you

We may need to ask you for specific information to confirm your identity and your right to access your personal data, or to exercise any of your other rights. This is a security measure to make sure personal data is not disclosed to anyone who has no right to receive it. We may also contact you for more information about your request, to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer if your request is particularly complex or you have made a number of requests. In that case we will tell you and keep you updated.

10. Contact details

If you have any questions about this privacy notice or about how we use your personal data, or you want to exercise your rights, please contact us:

Email address: [email protected]

We aim to acknowledge every message within 5 UK business days.

11. Complaints

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues, at www.ico.org.uk, on 0303 123 1113, or by writing to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us first (paragraph 10). The ICO will expect you to have done this before it reviews your complaint.

12. Changes to this privacy notice

We keep this privacy notice under regular review. This version was last updated on 10 September 2026 and replaces any earlier version.

13. Third-party links

Our website and the game may include links to third-party websites, plug-ins and applications. Clicking on those links, or enabling those connections, may allow third parties to collect or share data about you. We do not control those third-party websites and we are not responsible for their privacy notices. When you leave our website, we encourage you to read the privacy notice of every website you visit.