Privacy Policy

1. Who is responsible

EvonIQ (www.evoniq.app) is operated by EvonIQ by NKno, Les Landes, 1299 Crans-près-Céligny, Switzerland, who is the data controller for the processing described here. You can reach us at Contact@EvonIQ.app. This policy is written to meet the Swiss Federal Act on Data Protection and, for users in the European Economic Area, the GDPR.

2. What we collect and why

We only collect what the service needs to work:

• Account data: your email address, a hashed version of your password (we never store the password itself), your player name, your preferred language and an avatar colour. Needed to create and secure your account and to send you the emails described below.
• Game data you enter: your accounts' identifiers, power, troops, buffs, castle details, monthly history, the castle recap and screenshots you add to a sale listing, and battle plans. This is the service itself; it is shared with your alliance as explained in the Terms.
• Screenshots you upload for reading: a PvP report screenshot is sent to an AI provider (Anthropic) to transcribe the numbers on it, and the transcription is shown back to you. Anthropic processes it as our service provider and does not use it to train its models. We keep a count of these reads per account for fair-use limits.
• Sign-in records: for each sign-in, the date, the IP address, the browser and operating system, and an approximate city and country derived from the IP address using a database stored on our own server (DB-IP Lite; no lookup service is called). We keep the 20 most recent sign-ins per account. This is what lets us warn you by email when your account is used from a new device or country, and lets you check your own session history.
• Rate-limiting records: short-lived counters keyed by IP address or email address (sign-in attempts, password resets, registrations, contact messages), kept for the duration of the limit window only, to protect accounts against automated abuse.
• Purchases: when you buy a subscription through Polar we receive the order identifier, the product bought, the date and the email address used, so that we can activate your access. Card and billing details stay with Polar.
• Contact messages: what you write on the contact page, with the email address you give us, so that we can answer.

3. What we do not do

No advertising, no analytics trackers, no sale of data, no profiling. EvonIQ sets a single strictly-necessary cookie to keep you signed in (plus a short-lived marker when a session expires), and stores a few preferences such as the theme in your browser's local storage. None of this is used to track you across other sites.

4. Who else sees your data

Your alliance's members and leaders see the game data you enter, within EvonIQ. Beyond that, data is only shared with the providers we need to run the service, each bound by a contract to process it only on our behalf:

• Railway (hosting of the application, the database and the file storage);
• Resend (sending of transactional emails: verification, password reset, sign-in alerts, monthly reminders, alliance notifications);
• Polar (payments, invoicing and refunds, as merchant of record);
• Anthropic (transcription of the report screenshots you choose to upload).

Some of these providers are located outside Switzerland and the EEA, notably in the United States. Transfers rely on the providers' standard contractual clauses or equivalent safeguards. We disclose data to authorities only when the law requires it.

5. How long we keep it

Account and game data: for as long as your account exists, then deleted within 30 days of your deletion request. Sign-in records: the 20 most recent per account. Rate-limiting counters: the limit window (at most a few hours). Purchase records: 10 years, as required by accounting law. Contact messages: until the request is settled, at most 12 months.

6. Your rights

You can ask us at any time to see the data we hold about you, to correct it, to delete it, to receive a copy of it in a portable format, or to object to a processing. Write to Contact@EvonIQ.app from the address linked to your account; we answer within 30 days. If you live in the EEA you may also complain to your data protection authority; in Switzerland, to the Federal Data Protection and Information Commissioner.

You can change your email, password and player name yourself from the account page, unsubscribe from the monthly reminder with the link in each email, and delete your account yourself from the Security tab.

7. Security

Passwords are hashed with bcrypt, all traffic is encrypted (HTTPS), sessions expire after inactivity, sign-ins from an unfamiliar device or country trigger an email alert, and access to the servers is limited to the operator. No system is perfectly safe; if we ever discover a breach affecting your data we will tell you without undue delay.

8. Children

EvonIQ is not intended for anyone under 16. If you believe a child has created an account, tell us at Contact@EvonIQ.app and we will delete it.

9. Changes

We may update this policy; the date at the top shows the current version, and a material change will be announced on the site or by email.