Privacy Policy

1. Information we collect

• Account information: your callsign, a hashed password, an optional recovery email (used only once you verify it), and a yes/no record that you confirmed you are 13 or older. We do not keep your date of birth.
• Gameplay data: saved games, match results, in-game statistics, settings, and membership status.
• Optional game tracking: if you turn on "Allow game tracking" before a match, we record your in-game orders, economy, army, configuration and results over time under a pseudonymous player ID. We keep a private link from that ID to your account, so this is account-linked personal data, not anonymous data. Match records do not include your name or email. We use these records to improve the game and its computer opponents. Tracking is off by default; stop future collection in the match menu or settings. This choice is independent of advertising consent.
• Email subscription: your email address, the page you subscribed from, and your confirmation status, if you join our mailing list.
• Payment information: handled entirely by Paddle, our merchant of record. We receive confirmation of your purchase, your Paddle customer ID, and the email associated with it. We never receive or store your full card number.
• Advertising measurement: only after you Accept, Google Ads receives technical data such as IP address, browser/device information, ad-click and cookie identifiers, and successful account-creation and new-match-start events to measure our ads and optimize them toward match starts. We do not send your callsign, email, password, or gameplay orders to Google Ads. Advertising consent is separate from optional game tracking.
• Support messages: what you send us when you contact support.

2. How we use it

To run the Service and save your progress; to process Membership through Paddle; to send transactional email (account verification, password resets, security notices, receipts); to understand how the Game is played and improve it; to detect cheating, abuse, and errors; and to comply with law. If you subscribe to our newsletter on the homepage, we use the address you give there to send occasional updates about the game, with an unsubscribe link in every message. This is separate from your account's recovery email, which we use only for account verification, password resets and security notices.

3. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you logged in and hold game data not yet uploaded. Every visitor is asked to Accept or Decline advertising measurement. Google Ads does not load until you Accept; unanswered or declined choices send no ad events, including cookieless events. We store your choice, its time, and the notice version locally on this browser, preserving acceptance evidence if you later withdraw. Use Cookie settings in the site footer to change or withdraw your choice; withdrawal stops our subsequent ad reporting and applies across open tabs. Previously sent data cannot be recalled, and existing Google cookies may remain until you clear them. If browser storage is unavailable, the choice lasts only for the current page visit. Ad clicks and impressions may still be counted by the ad platform without website tracking.

4. Who we share it with

Service providers who process data on our behalf: Paddle (payments and tax), our database and hosting provider, and Google Ads (consented advertising measurement and optimization). See https://business.safety.google/privacy/ for Google's use of data. Transactional email (account verification, password resets and security notices) is sent on our behalf by our hosting provider from notify.meridiancommandpro.com. These messages contain your callsign and the link you requested. We do not share recovery emails with Google Ads. We may disclose information if required by law or to protect the rights and safety of users or the public. We do not show third-party advertising inside the Game.

5. Data retention

Account data and saves are kept while your account is active. Detailed optional gameplay-tracking chunks are eligible for deletion 60 days after recording and are removed by the daily cleanup. Match configuration, result, tick totals, summary, report and comparison data, together with the private account-to-player-ID link, remain until you delete your account; they do not currently have an automatic expiry. Account deletion removes that link and its tracked matches, summaries, reports and dependent chunks as well as account data and saves. Failed deletion stops before removing your login so you can retry. Paddle may retain payment records for tax, accounting or legal requirements. Independent opt-in Google Ads data follows Google's retention settings; deleting your game account cannot recall data already sent to Google.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. Email support@cosmostarlabs.com and we will respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority. We do not discriminate against you for exercising these rights.

7. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it.

8. International users

We are based in the United States and process data there. If you use the Service from outside the US, you understand your data is transferred to and processed in the US.

9. Security

We use industry-standard measures, including encrypted connections and hashed passwords. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you as required by law.

10. Changes

We will post updates here with a new "Last updated" date and notify account holders of material changes.

11. Contact

Cosmo Star Labs LLC, 715 Belmont Bay Dr, Woodbridge, VA 22191, United States · support@cosmostarlabs.com.