Privacy Policy
Last updated: 12/04/2026
Introduction
This privacy policy describes how Spacy collects, uses, and protects your personal data, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
Data Controller
Data Collected and Purposes
The following table details the data collected, its legal basis, and retention period:
| Data | Legal basis | Retention period |
|---|---|---|
| Email, username | Contract performance (Art. 6(1)(b)) | Account duration + 3 years |
| OAuth identifiers (Google, Discord) | Contract performance | Account duration |
| Avatar | Consent (Art. 6(1)(a)) | Account duration |
| Date of birth | Legal obligation (Art. 6(1)(c)) | Account duration |
| Payment data (via Stripe) | Legal obligation (Art. 6(1)(c)) | 10 years (accounting obligation) |
| IP address, connection logs | Legitimate interest (Art. 6(1)(f)) | 1 year (LCEN Art. 6-II) |
| In-game messages (mail, alliance chat, discussions) | Legitimate interest (Art. 6(1)(f)) — moderation | Account duration |
| Game data (planets, fleets, etc.) | Contract performance | Account duration |
Data Recipients
Your data may be shared with the following processors strictly for the purpose of providing the service:
- Stripe — payment processing
- Google — OAuth authentication
- Discord — OAuth authentication
- Hetzner Online GmbH — server hosting (EU)
Your Rights
Under the GDPR, you have the following rights:
- Right of access (Art. 15) — obtain a copy of your personal data
- Right to rectification (Art. 16) — correct your data via your profile
- Right to erasure (Art. 17) — request deletion of your account and data
- Right to data portability (Art. 20) — receive your data in a structured format (JSON)
- Right to object (Art. 21) — object to the processing of your data for marketing purposes
To exercise your rights, contact us at: [email protected]
Transfers Outside the EU
Stripe, as a US company, may transfer payment data to the United States. These transfers are governed by the European Commission's Standard Contractual Clauses (SCCs) and the Data Processing Agreement (DPA) signed with Stripe.
Filing a Complaint with the CNIL
If you believe that the processing of your data does not comply with the regulations, you may file a complaint with the French Data Protection Authority (CNIL): www.cnil.fr
Cookies
Spacy uses cookies necessary for the operation of the service (authentication, language preferences). Analytical cookies are subject to your consent via our cookie banner (CookieHub).