PRIVACY POLICY

Jose Carlos Ibanez operates FandomWar and determines why and how FandomWar-specific personal data is processed. This Policy applies to the FandomWar website, game experience, support communications, and server-side payment correlation.

Third-party websites and hosted checkout pages have their own privacy notices. Follow external links only after reviewing their practices.

Technical access data

IP-derived request information, user agent, language, timestamps, request metadata, security logs, and a one-way pseudonymous session fingerprint used for reservations and abuse prevention.

Community information

Fandom and community names, public alias, private contact email, logo/image URL, public community URL, YouTube URL, moderation state, and review history.

Attack and game records

Selected territory, fandom, community, price quote, discount, reservation, timestamps, conquest history, protection, rankings, and public War Feed events.

Payment correlation

Internal payment and reservation identifiers, provider identifiers, expected/confirmed amount and currency, status, webhook event identifiers, and refund/review operations.

Support data

Your email, message, evidence you choose to provide, and our response. Never send complete card numbers, passwords, government IDs, or payment secrets.

Optional analytics

If enabled with appropriate notice or consent, product interactions such as territory views, quotes, checkout starts, confirmations, and victory shares, plus device and browser context.

FandomWar does not require a user account in V1. We do not request your legal name for ordinary gameplay, do not use community contact email as a public username or analytics identifier, and do not receive or store full payment-card numbers or security codes.

Our hosted payment provider may collect billing, tax, identity, and payment-method information as Merchant of Record under its own notices and terms.

• Provide quotes, exclusive reservations, checkout redirection, verified conquest delivery, victory pages, rankings, and history.
• Verify amount, currency, timing, and payment authenticity; prevent duplicate conquest and payment replay.
• Moderate public names, logos, links, videos, and reports.
• Detect fraud, automated abuse, malicious links, and attempts to evade game rules.
• Respond to support, refund, privacy, legal, and dispute requests.
• Comply with tax, accounting, consumer-protection, payment, sanctions, and lawful authority requirements.
• Measure and improve FandomWar when optional analytics is lawfully enabled.

Depending on your location and the activity, we rely on performance of a contract for paid attacks and requested support; legitimate interests in operating, securing, moderating, and improving the service; compliance with legal obligations; establishment or defense of legal claims; and consent where required for optional analytics or other non-essential storage.

Where Peru’s personal-data framework applies, we process data in accordance with Law No. 29733 and its applicable regulations. Where the GDPR applies, you may also have the rights and legal bases described below.

Territory control, fandom name and colors, governing community name and public alias, approved community assets and links, paid amount, conquest time, defeated fandom, rankings, and battle history may be public by design. Do not submit personal information in a public name, alias, image, link, or video.

Private contact email, reservation tokens, payment identifiers, request fingerprints, webhook bodies, and operational review details are not included in public map or share-card data.

We may disclose the minimum data necessary to infrastructure and service providers acting for or with us, including Vercel for hosting, Turso/libSQL infrastructure for database services, Dodo Payments as payment provider and Merchant of Record, PostHog if optional analytics is enabled, and security, support, or professional advisers when necessary.

We may also disclose information when legally required, to protect users and service integrity, to investigate fraud or disputes, or as part of a business reorganization subject to appropriate safeguards. FandomWar does not sell personal data.

FandomWar and its providers may process data in countries other than yours. Where required, we use contractual, organizational, and technical safeguards appropriate to the transfer and the recipient’s role.

We retain data only as long as reasonably necessary for its purpose. Short-lived reservations remain long enough to enforce concurrency, investigate failed or late payments, and prevent abuse. Payment, refund, and conquest records may remain for the periods required by tax, accounting, consumer, fraud, dispute, and legal obligations. Public conquest history may remain as part of the game’s historical record.

Community contact and moderation records remain while the community is active or while needed to document enforcement. Support and security records are deleted or anonymized when no longer reasonably necessary, unless law or an active dispute requires longer retention.

FandomWar uses server-side price verification, exclusive reservation controls, one-way request hashing, access separation, signed webhook verification, idempotency controls, provider-secret isolation, input validation, restricted public data models, and operational logging designed to exclude secrets and complete payment information.

No system can guarantee absolute security. If you believe data or an accountless session has been compromised, contact support promptly.

Subject to applicable law, you may request access, information, correction, deletion, restriction, portability, or objection; withdraw consent without affecting prior lawful processing; and complain to a competent data-protection authority. Peru residents may exercise applicable ARCO rights. We may need to verify your identity and preserve data we must retain by law or for legal claims.

Submit a privacy request through Support with the subject “Privacy request.” Do not include payment-card details.

FandomWar is not directed to children under 13 and does not knowingly collect their personal data. You must be 18 or older to purchase an attack or submit community contact information. If you believe a child provided personal data, contact us so we can investigate and delete it where appropriate.

Read the Cookie Policy for browser storage and analytics details. We may update this Policy when the service, providers, or legal requirements change. Material changes will be highlighted before they take effect where required.