Last updated: February 25, 2026
Welcome to Children of Titan ("we", "us", "our"). We operate the website childrenoftitan.com and the associated browser-based game (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service, in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, the California Consumer Privacy Act ("CCPA"), and other applicable data protection laws.
The data controller responsible for your personal data is:
Children of Titan
Email: privacy@childrenoftitan.com
If you have any questions about how we process your data, or if you wish to exercise your rights, contact us at the address above. We currently do not have a designated Data Protection Officer (DPO) as our processing activities do not meet the threshold requiring one under Article 37 GDPR, but our privacy team handles all data-related inquiries.
When you register, we collect your email address, username, and a hashed password. We never store your password in plain text.
If you connect a cryptocurrency wallet, we store your public wallet address. We never have access to your private keys or seed phrases.
We collect data generated through gameplay, including base configurations, resource balances, troop compositions, fleet movements, alliance memberships, research progress, achievements, and transaction histories within the game.
When you access our Service, we may automatically collect device information (browser type, operating system), IP address, access times, pages viewed, and referring URLs through cookies and similar technologies.
We do not collect special category data (racial/ethnic origin, political opinions, religious beliefs, health data, biometric data) or financial information beyond public wallet addresses.
Under Article 6(1) of the GDPR, we process your personal data based on the following legal grounds:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Account creation & authentication | Email, username, hashed password | Contract performance (Art. 6(1)(b)) |
| Two-factor authentication | Email, 2FA tokens | Contract performance (Art. 6(1)(b)) |
| Gameplay & game state | All gameplay data | Contract performance (Art. 6(1)(b)) |
| Wallet connection & blockchain features | Public wallet address | Consent (Art. 6(1)(a)) |
| Leaderboards & public profiles | Username, game stats, alliance | Legitimate interest (Art. 6(1)(f)) |
| Analytics & Service improvement | Device info, IP, usage patterns | Consent (Art. 6(1)(a)) via cookie banner |
| Anti-cheat & fraud prevention | IP, gameplay patterns, account data | Legitimate interest (Art. 6(1)(f)) |
| Email communications (security alerts) | Email address | Contract performance (Art. 6(1)(b)) |
| Legal compliance | As required | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interest, we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms. You may object to processing based on legitimate interest at any time (see Section 10).
We use cookies and similar technologies categorized as follows:
Required for authentication, session management, security (CSRF protection), and cookie consent preferences. These cannot be disabled as the Service cannot function without them. No consent required (Art. 5(3) ePrivacy Directive exemption).
Help us understand how players use the Service (pages visited, session duration, feature usage). Only set after you give consent via our cookie banner.
Remember your preferences (language, UI settings, theme). Only set after you give consent via our cookie banner.
We do not use marketing or advertising cookies. You can withdraw cookie consent at any time through our cookie settings banner or your browser settings. Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal.
We do not sell, rent, or trade your personal information. We may share data with:
All third-party service providers are contractually bound to process data only on our instructions and to implement appropriate technical and organizational security measures.
Our servers and some service providers may be located outside the European Economic Area (EEA) or the United Kingdom. When we transfer personal data outside these regions, we ensure adequate protection through one or more of the following safeguards:
You may request a copy of the safeguards in place by contacting us at the email in Section 2.
We implement appropriate technical and organizational measures in line with Article 32 GDPR, including:
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours (Art. 33 GDPR) and, where required, inform affected users without undue delay (Art. 34 GDPR).
We retain personal data only as long as necessary for the purposes described in this policy:
Under the GDPR, you have the right to:
If you are a California resident, you additionally have the right to:
Contact us at privacy@childrenoftitan.com with your request. We will verify your identity and respond within 30 days (extendable by 60 days for complex requests, with notice). There is no fee for exercising your rights, unless requests are manifestly unfounded or excessive.
If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with a data protection supervisory authority in the EU/EEA member state of your habitual residence, place of work, or place of the alleged infringement (Art. 77 GDPR).
We would appreciate the chance to address your concerns before you contact a supervisory authority — please reach out to us first at privacy@childrenoftitan.com.
We may use automated systems to detect cheating, exploits, or fraudulent behavior (e.g., bot detection, unusual gameplay patterns). These systems may result in temporary restrictions on your account pending manual review.
We do not use fully automated decision-making that produces legal or similarly significant effects on you without human involvement. Any account suspension or ban resulting from automated detection is reviewed by a human before becoming permanent. You have the right to contest such decisions and request human review by contacting us.
Our Service is not intended for individuals under the age of 16 in the EEA (or the applicable age of digital consent in your member state, which may be as low as 13), or under 13 in other jurisdictions. We do not knowingly collect personal information from children below these ages. If we learn we have collected data from a child without valid parental consent, we will delete it promptly. Parents or guardians who believe their child has provided us with personal data should contact us immediately.
Our Service may integrate with third-party wallet providers (e.g., WalletConnect, MetaMask) and blockchain networks. When you interact with these services, their own privacy policies govern the data they collect. We encourage you to review them. Key third-party integrations include:
We are not responsible for the privacy practices of third-party services. Links to external services are provided for convenience and do not imply endorsement.
We may update this Privacy Policy from time to time. For material changes, we will notify you by posting the updated policy on this page, updating the "Last updated" date, and where appropriate, sending you an in-game or email notification. Where changes affect processing based on consent, we will seek fresh consent where required by law. Continued use of the Service after non-consent-based changes constitutes acknowledgment of the revised policy.
For all privacy-related inquiries, data subject requests, or complaints:
Children of Titan — Privacy Team
Email: privacy@childrenoftitan.com
General support: support@childrenoftitan.com
We aim to respond to all requests within 30 days.