Privacy Policy
Last updated: 3 November 2026
In short
- You play Thunder Siege with an account: your Google account, or your e-mail address and a password.
- We use your e-mail address and your base only to run your account and the game.
- We do not sell your data, there is no advertising in the game, and we use no tracking or advertising cookies.
- Your data is stored in the EU (Frankfurt, Germany).
- We ask only the year you were born, to keep Battalion chat safe for younger players; nobody else sees it.
- You can ask us at any time to see or delete your data.
- Who we are
- What we collect
- How we use it, and on what legal basis
- Who helps us
- Cookies and local storage
- How long we keep data
- Your rights
- Deleting your account
- Children
- Security
- Changes
- Contact
1. Who we are
Thunder Siege (the website thundersiege.com and the game played there) is operated by:
Millstone
Acacialaan 18, 2282 AX Rijswijk, the Netherlands
Chamber of Commerce (KvK) number: 89795857
E-mail: info@thundersiege.com
Millstone is the controller for the personal data described here, as meant in the EU General Data Protection Regulation (GDPR). "We", "us" and "our" mean Millstone; "you" means anyone who visits the website or plays the game.
2. What we collect
Your account
- Your e-mail address and your password. The password is stored only in hashed form by our sign-in provider; we cannot read it.
- If you sign in with Google: the name, e-mail address and profile picture link Google shares with us when you agree on Google's screen. We never see your Google password, and we ask for nothing else from your Google account.
- When your account was created, whether you confirmed your e-mail address, and when you last signed in.
- Technical sign-in data kept by our sign-in provider for security, such as your IP address, browser type and session times.
Your game
- Your commander name and your base: buildings, army, weapons, progress, resources, diamonds, achievements and settings saved with it, so you can play on any device.
Your year of birth
- When you create an account (or once in Settings, if you signed up with Google) we ask the year you were born, never the full date. It sets what the Battalion chat allows: under 13 only the preset quick signals, 13 to 15 chat off unless you switch it on, 16 and over chat on unless you switch it off. Other players can't see it. Your chat setting is saved with it.
Battalions and chat
- If you join a Battalion (a team of up to 20 players): which one, your rank, when you joined and how many units you sent. Other players see your commander name, rank, Command Center level, trophies and roughly when you last played.
- The messages you send in your Battalion's chat, and the quick signals. Only members of that Battalion can read them. A filter blocks links, contact details and rude words; it is stricter for players aged 13 to 15.
- Reports and blocks: if you report a message we keep the message, its writer, the reason and who reported it, so our team can review it. A message reported by 3 players is hidden. If you block a player, we keep that so their messages stay hidden for you.
- Reinforcements: requests for units and the units players send each other.
- Weekly goals and wars: your points for Theatre Ops and Battalion Ops, your war attacks and their stars, and friendly battles (who, on whose base, the result), so the Battalion sees them. Members who haven't played for 14 days leave their Battalion automatically.
Raids on other players
- Once you have finished the tutorial, other players around your level may attack a copy of your base (your buildings, commander name, trophies and up to 10% of your resources). We keep a record of each raid (who attacked whom, the result, the loot and a replay of the attacking player's moves) so both players see it in the game.
Notifications
- Only if you switch them on in Settings: the push address your browser gives us for this device (and its keys), the texts of the notifications in your language, and the reminders the game plans for while you are away (an upgrade done, storage full, your supply chest, your shield ending). We send them through your browser's push service. Switch them off in Settings, and the address is deleted.
Website visits
When your browser loads the website or the game files, our hosting and storage providers see your IP address, browser and device type and the time of the request. They keep this in short-lived server logs for security and to fix problems. We do not use it to build a profile of you.
We do not collect your location, contacts, photos or any special categories of personal data, and the game has no payments yet. When we add features that handle more data, we will update this policy first.
3. How we use your data, and on what legal basis
| What | Why | Legal basis (GDPR) |
|---|---|---|
| E-mail address, password, sign-in data | To create your account, let you sign in, reset a forgotten password and send account e-mails (such as confirming your address) | Performance of our agreement with you (art. 6(1)(b)) |
| Your base and commander name | To save your game and let you continue on any device | Performance of our agreement (art. 6(1)(b)) |
| Year of birth, chat setting | To keep chat safe for younger players (age bands) and to remember your choice | Our legitimate interest in protecting children and other players (art. 6(1)(f)); for under-16s with the permission of a parent or guardian |
| Battalion membership, chat messages, reinforcements, raids | To let you play together and against other players, as the game describes | Performance of our agreement (art. 6(1)(b)) |
| Reports and blocks | To review messages that break the rules and to keep players safe | Our legitimate interest in a safe game (art. 6(1)(f)) |
| Server logs | Security, preventing abuse and fixing problems | Our legitimate interest in a safe, working game (art. 6(1)(f)) |
We never sell your data and never use it for advertising.
4. Who helps us
We use a few service providers who process data only on our instructions, under a data processing agreement:
- Supabase: accounts, sign-in, the database with your base and the storage of the game's files. Data stored in Frankfurt, Germany.
- Vercel: hosting of the website. Vercel may handle requests in data centres outside the EU; transfers are covered by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.
- Google: only if you choose "Continue with Google", to sign you in (Google's own privacy policy applies to your Google account).
- An e-mail service for account e-mails (confirming your address, resetting your password).
5. Cookies and local storage
Thunder Siege only uses what is needed to work:
| Name | What it does | How long |
|---|---|---|
sb-…-auth-token | Keeps you signed in (local storage, set by our sign-in provider) | Until you sign out |
thundersiege.save.v1 | A copy of your base in your browser, so the game also works on a weak connection | Until you clear your browser data |
thundersiege.mute, thundersiege.music | Your sound and music settings | Until you clear your browser data |
thundersiege.lang | The language you picked for the game | Until you clear your browser data |
thundersiege.owner, thundersiege.known | Which account the copy of your base belongs to, and that you have an account (so the page shows Sign in first) | Until you clear your browser data |
thundersiege.chatread | The last Battalion chat message you saw, for the unread count | Until you clear your browser data |
thundersiege.push | That you switched notifications on in this browser | Until you switch them off or clear your browser data |
thundersiege.cookies | Remembers your choice in the cookie banner | 12 months |
We do not use analytics, advertising or tracking cookies. If we ever want to, we will ask for your consent first in the cookie banner, and you can always say no.
6. How long we keep data
- Your account and base: as long as you have an account. When you delete it, we delete them within 30 days (backups are overwritten within 30 more days).
- Battalion chat messages: 30 days (the chat shows the last 7). Reports: until our team has reviewed them, and at most 90 days after that.
- Raid records and replays: as long as both accounts exist.
- Which days you played and when you reached each Command Center level (to see whether the game keeps players, in totals only): as long as you have an account.
- Server logs: at most 30 days.
- E-mails you send us: as long as needed to help you, and at most 2 years.
7. Your rights
You have the right to see the data we have about you, to have it corrected or deleted, to object to or limit its use, and to receive it in a common format (data portability). E-mail info@thundersiege.com and we will answer within one month. You may also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
8. Deleting your account
E-mail info@thundersiege.com from the address you play with and we will delete your account and your base. A delete button in the game's Settings is on its way.
9. Children
Thunder Siege is meant for players aged 16 and over. Younger players may only play with permission from a parent or guardian. If you believe a child under 16 has an account without permission, tell us and we will delete it.
For younger players the game is careful by itself: under 13 the Battalion chat offers only preset quick signals (no free text), and from 13 to 15 chat is off until it is switched on in Settings, with a stricter filter. Anyone can switch chat off, report a message or block a player.
10. Security
All traffic is encrypted (HTTPS). Every player can only read and change their own account data; passwords are stored hashed by our sign-in provider. If something goes wrong that affects your data, we will tell you and the authorities as the law requires.
11. Changes to this policy
We will update this policy when the game changes (for example with purchases). The date at the top shows the latest version; for important changes we will tell you in the game.
12. Contact
Questions about your privacy: info@thundersiege.com, or by post to Millstone, Acacialaan 18, 2282 AX Rijswijk, the Netherlands.