Privacy

Who answers for your data

The owner of StakeOut. Their contact address will appear here.

What we keep

• Your account: your email, your callsign, the hash of your password (scrypt; the password itself is never stored), your language, when you signed up, the last time you played (to the minute) and whether you want emails.
• Your games: your orders (up to 50), your after-action reports (the last 200), your contracts, your credit box and its ledger (the last 100 entries), your rank and your decorations.
• Your agent: the keys and connectors you make for it, with their name and last use. Only a hash of each key is kept, except your agent link’s, which is kept as is so it can be shown to you again.
• Technical data: your IP address is used on the spot to stop abuse (how many tries a minute) and is not kept, except in the server log of a request that fails, is refused for excess or takes too long. If the site breaks in your browser, we get the error, the page’s address and your browser (user agent).

What others see

Your callsign (never your email) is seen by the commanders you play contracts with and on the ladder. A battle is seen by whoever has its link: if you share it, your callsign goes with it, and if it was a training battle, whoever opens it can fight the plan that fought it, without seeing its minds.

What for, and on what basis

• Giving you the game you ask for (account, games, contracts, emails about your contracts and sessions): that is what you sign up for (GDPR article 6.1.b). The emails turn off with one click from the email itself or in Settings.
• Keeping the site safe and fixing faults (rate limits, error logs): our legitimate interest in a service that works and is not abused (article 6.1.f).
• No ads, no profiling, and no automated decisions about you beyond the game’s own (who wins a battle).

Who else handles it

• Resend sends the emails (confirmation, password and notices): it gets your email address and the message.
• Anthropic (Claude) turns what you dictate over the radio into orders: it gets only that text and the order on the Order Table, not your email or callsign.
• Cloudflare protects and serves the site: every request passes through its network, with your IP address.
• The server provider where the site and its database run.
• Resend, Anthropic and Cloudflare are US companies, so your data may be handled outside the European Economic Area, with the safeguards the GDPR requires for such transfers. We don’t sell or give your data to anyone else.

Cookies

Just two, both needed for the site to work: your session (it lasts until you sign out or 90 days go by without a visit) and your language. Your browser also keeps, on your device only, the plan on the Order Table and your preferences. None is for ads or analytics.

For how long

• Your account and your games, for as long as you keep the account.
• A signup that is never confirmed is deleted after 24 hours; a password-reset link expires in one hour.
• If you delete your account, everything of yours is deleted at once. Battles others played against you stay in their archives, but under “Retired commander”, not your callsign.

Your rights

You can see your email and callsign, change your callsign and delete your account yourself in Settings (at HQ). To get a copy of your data, correct it, restrict or object to its use, or take it to another service, write to the owner from your account’s email.

If you think we handle your data wrongly, you can complain to your data protection authority; in Spain, the Agencia Española de Protección de Datos (aepd.es).