Privacy Policy for OpenRes

Version 2026-10-25.6

This policy applies to the OpenRes game (the Android app "OpenRes" and its game server) and explains which personal data the game uses, why, who receives it, how it is protected and how long it is kept. The controller is Ivan Vrabac (developer of OpenRes). Our server is located in the European Union and we follow the EU General Data Protection Regulation (GDPR) and Croatian law.

In short

We use your data only to run the game. We don't use it for marketing or advertising, we don't sell it, and we don't give it to third parties, except where this policy says so. There are no ads and no analytics or tracking tools in the game.

What we process and why

Account: your company name, a securely hashed password, your country if you choose one, and sign-in sessions. Needed to give you an account (GDPR Art. 6(1)(b), performing our agreement with you).
Game data: your mines, headquarters, buildings, items, credits, quests, achievements, rankings and game history. The positions of mines and buildings are places on the map that you chose; other players see them.
Your location (precise): the game is played on a real map. The app uses your phone's location only while the app is open, to show the map around you. When you do something that depends on where you are (scan, build, collect, attack, pick up crates or artifacts), your position at that moment is sent to the server to check the distance, and your last position is kept to detect impossible jumps (cheating) and to drop game crates in the area. We don't collect your location while the app is closed and we don't build a location history. The app explains this before Android asks for the permission. On Android the position comes from Google Play services. The app does not use activity recognition or any other health or fitness data.
Chat and private messages (optional): the text messages you send (no photos or files), kept for 7 days and then deleted automatically. You can turn chat and messages off in Settings › Chat and messages; that deletes all your messages at once.
Reports and moderation: when a player reports a message or a player, we keep the report with a copy of the reported message, and any chat ban or ban that follows, for up to 1 year, to keep the game safe (GDPR Art. 6(1)(f)). A filter refuses messages with rude words before they are sent.
Notifications: the notifications the game sends you, kept on the server (at most the last 200) so your phone can fetch them.
Contact form: what you write to us and the reply address you give, kept until your request is handled and at most 1 year.
Device ID: a one-way scrambled (hashed) form of Android's ID for this app on your phone, to recognise several companies played from the same phone (one person, one company; GDPR Art. 6(1)(f), preventing cheating). It is not used for ads and never shared. Kept as long as your account exists.
Technical data: IP address, device and app version and server logs, needed to run and protect the service (GDPR Art. 6(1)(f), legitimate interest).

Who else receives data

Other players see your company name, level, country, public profile, rankings, mine and headquarters positions on the map and your chat messages. Your own position is never shown to them.
OpenStreetMap (OpenStreetMap Foundation, United Kingdom) delivers the map pictures directly to your phone, so it receives your IP address and the map area you look at (see the OpenStreetMap privacy policy).
Google provides location services and app distribution on Android phones (see Google's privacy policy).
Our hosting: the game server runs on our own hardware in the EU; no cloud provider receives your data.
Authorities, only where the law requires it.

We don't sell or rent personal data and we don't share it for marketing ("we do not sell or share your personal information", also in the sense of US state privacy laws such as the CCPA).

How we protect your data

All connections between the app and the server are encrypted (HTTPS/TLS).
Passwords are stored only as salted hashes; nobody, including us, can read them.
Sign-in sessions are signed and expire; repeated wrong passwords are blocked for a while.
Other players get only a random public id for you, never your internal account id.
The server and its backups are only accessible to the operator.

How long we keep data

Account and game data: as long as your account exists.
Chat and private messages: 7 days. Reports (with the reported message) and bans: up to 1 year.
Server logs and backups: at most 30 days.
When you delete your account (in the app: Settings › Delete account, or on https://resources.vrabac.eu/delete.html), your company and all its game data are deleted. Accounts younger than 30 days are deleted at once; older accounts are deleted after a 30-day waiting period, during which signing in cancels the deletion (this protects against mistakes and stolen passwords). After deletion, copies in logs and backups disappear within 30 days. We keep nothing else about deleted accounts.

Your rights

Under the GDPR you can ask for access to your data, correction, deletion, restriction, data portability, and you can object to processing based on legitimate interest. You can delete your account yourself at any time (see above). For anything else, use the contact form below. You also have the right to complain to a supervisory authority, in Croatia the Personal Data Protection Agency (AZOP, azop.hr).

Children

The game is not meant for children under 16 and we don't knowingly collect data from children under 13 (also in the sense of the US COPPA). If you believe a child has created an account, contact us and we will delete it.

Changes

We may change this policy at any time, for example if we start using new services. The current version is always in the game (More › Privacy policy) and on https://resources.vrabac.eu/privacy.html, and any change is shown to you when you open the game: you can accept it and keep playing, or decline it, in which case the game closes.

Contact

Questions, data requests (access, correction, deletion, objection) and complaints: use the contact form at https://resources.vrabac.eu/contact.html. We answer within 30 days.