Privacy notice — Janusz Fortress
1. Controller and contact
The controller of personal data for Janusz Fortress is Dawid Kuczera, trading as GMCO. Address: 3 Glenure Loan, Edinburgh, EH4 7LW, Scotland, United Kingdom. For privacy, data protection rights, security and account deletion, contact [email protected]. This notice describes the service; the retention schedule and safeguards for international transfers remain to be verified. It is not a legal compliance certificate or an audit certification.
2. Account data and sources
We process your player name, email, password hash, account status and login information. Passwords are not stored as plain text. Data come from you and from your activity and connection to the service. Required form fields are necessary to create and operate an account; without them, sign-in features cannot be provided.
3. Gameplay, rewards and communication
The server records progress, resources, squads, buildings, actions, achievements, rewards, gang membership and applications, recruitment decisions and chat messages. It also stores ticket and PEPE histories, withdrawal requests and paid features where used. These data support gameplay, accounting, support requests and dispute resolution.
4. What other players can see
Your nickname, ranking position and scores, and selected gang information may be visible to other players. Gang members see information shared in their panels and gang chat messages. Leaders and officers see candidate applications and their own gang’s defence map. Do not put sensitive information, passwords or wallet secrets in names or chat. Email, IP addresses and withdrawal details are not part of the public ranking.
5. Security and technical data
Login protection records an email hash, IP address, outcome and time of the attempt. Withdrawal verification may record IPv4/IPv6, ASN, ISP, VPN/proxy results, ping, jitter, download and upload measurements, verification source and a risk score. Bug reports contain a description, URL, screen dimensions and user agent. These data support account protection, diagnostics, limits and abuse detection. Email hashes and other identifiers linked to an account may still be personal data, not anonymous information.
6. Purposes and lawful bases
Accounts, gameplay, requested features and withdrawals: performance of a contract or steps requested before entering a contract, only as necessary to provide the service. Account and infrastructure protection, fraud prevention, and establishing or defending claims: legitimate interests, requiring a necessity and balancing assessment against your rights. Accounting duties: legal obligations only where a specific applicable law requires them. If an additional feature needs consent, its purpose will be explained before activation; consent is not the default basis for the entire game. The operator must approve the mapping of lawful bases to actual processing before the notice is fully verified.
7. Cookies, language and the PWA
An essential session cookie maintains sign-in and form protection. It uses Secure, HttpOnly and SameSite=Lax. Your language preference is stored locally as janusz_lang. The PWA caches public interface assets; its service worker does not cache PHP endpoint responses, balances or session tokens. Clearing site data or signing out ends local session access, but does not delete the server account. Browser data can be cleared in browser settings. When configured, optional Google Analytics 4 only loads after consent. It measures visits using technical data, device/browser information and first-party _ga cookies (up to 180 days). We do not intentionally send account identifiers, emails, balances, form contents, query strings or fragments. Google receives connection data and may process it internationally; its services do not make visitors anonymous. The consent choice is stored as janusz_analytics_consent_v1 for 180 days. Refusal does not affect gameplay; Privacy settings lets you withdraw consent and delete the analytics cookies. The operator must verify the Google agreement, international transfer safeguards and property retention settings before activation.
8. External shortlinks and advertising
Opening a shortlink takes you to external providers. They receive connection data and may use their own cookies, advertising and tracking. The provider receives a return URL containing a single-use task token; on return, the server checks the token and IP address to account for the reward. Do not share your return URL. Providers and sites in their redirect chains apply their own privacy policies. They may show aggressive ads, phishing or deceptive messages. Never enter your game password or recovery phrase, run a system command, or install software from an ad. GMCO cannot guarantee all external content is safe. This warning does not remove the operator’s obligations for data it discloses.
9. Withdrawals and FaucetPay
When processing a withdrawal, we send FaucetPay the recipient address or email, amount, PEPE currency, the IP recorded during verification and an operation identifier to prevent duplicate processing. We store the provider response, status and transaction reference. GMCO does not require your FaucetPay password, private key or recovery phrase. FaucetPay applies its own data processing rules. Separate payments for premium features have their own order data and are not the same as reward withdrawals.
10. Hosting, traffic protection and fonts
The service uses IONOS hosting. Where traffic passes through Cloudflare, that provider also processes connection and traffic-protection data. Infrastructure providers may receive IP addresses, HTTP headers, browser information and requested URLs. Interface fonts are hosted on the service’s own server; loading them does not require a connection to Google Fonts. The operator must confirm the exact services, their roles and applicable agreements; a provider’s privacy policy does not replace this verification.
11. Data access and safeguards
Administrative access should be limited to account operation, security, support and accounting. Data should not be sold or disclosed for unrelated marketing purposes. Infrastructure and payout providers receive data needed for their services; disclosure to public authorities requires an appropriate legal basis. The service uses password hashing, sessions, access controls and form protection. No system can eliminate all risk of loss or unauthorised access.
12. Retention
Account data and progress support an active account. After closure, further retention needs a separate justification, such as settling an open transaction, a legal duty or a specific dispute. Security-log criteria include incident investigation, abuse prevention and necessary evidence; support records relate to resolving the request and justified handling of further claims. The 15-minute login-blocking window is not a log-deletion period. Current mechanisms do not automatically delete all these data under an approved schedule. The operator must still approve specific periods, deletion or anonymisation rules and backup retention; we do not claim nonexistent deadlines.
13. Rights and requests
Subject to applicable law, you may request access and a copy, correction, erasure, restriction and portability where applicable. You may object to processing based on legitimate interests. Where consent is the basis, you can withdraw it without affecting the lawfulness of earlier processing. Email [email protected] with your request and account details; do not send your password. Proportionate identity verification may be needed. Under GDPR or UK GDPR, the usual response period is one month, with extensions allowed by law and notice of the reason. A refusal requires an explanation. You can complain to a competent supervisory authority, such as the UK ICO or Poland’s UODO, depending on jurisdiction.
14. Account deletion and security decisions
Deleting an account may remove progress and access to game features. It does not automatically forfeit an owed payout: open requests and any claims need separate settlement. An erasure request does not remove data that must be retained on a separate lawful basis. Automated login, token, IP and verification checks may reject an operation, award a reward or refer a withdrawal for review; they are not by themselves proof of fraud. You can request an explanation and human review at [email protected]. The scope of decisions and whether rules on solely automated decisions apply require an impact assessment, not merely a wording change.
15. Children and young people
Age, reward and withdrawal eligibility must match the game terms, provider requirements and applicable law. A statement of parental consent does not replace required verification or an assessment of children’s privacy. We do not invent an age limit; the operator must establish it before final approval of the documents. If you suspect improper processing of a child’s data, contact [email protected].
16. International transfers
External infrastructure, font, shortlink and payout services may process data outside the UK or EEA. Safeguards must be verified for the actual recipient and transfer: an applicable adequacy decision or appropriate contractual instruments, such as EU standard contractual clauses, a UK IDTA or UK Addendum, with required assessments, may apply. We do not claim those agreements are in place without evidence. Countries, recipients and safeguards actually used remain to be completed by the operator. You can request information and a copy of applicable safeguards at [email protected].
17. Updates and contact
Version: 6 October 2026. Changes to features, providers or processing require updated information. The current notice is published here with its version date and is accessible without sign-in. For privacy and data enquiries, contact [email protected].