Strigard
Strigard Privacy Policy
Last updated: 03/11/2026
At Strigard we take the protection of your personal data seriously. This Privacy Policy explains what data we process, for what purpose, on what legal basis, with whom we share it and what rights you have. It applies to this website and the Strigard app.
1. Data controller
- Privacy contact email: contact@strigard.app
2. Data we process
Depending on how you use the Service, we may process the following categories of data:
- Account data: email address and password (stored encrypted; never in plain text).
- Profile and preferences: user role, notification preferences, registration date.
- Payment and billing data: plan purchased, amount, currency, payment status, transaction ID and date. Your card, banking and full payment details are entered directly into Paddle's secure checkout and are never received, processed or stored by us or on our servers. We only receive confirmation metadata about the transaction (see section 5).
- Licence and Service usage data: licence status and type, bot sessions, usage time, client version and device identifier.
- Support data: the content of tickets, messages and attachments you send us, from the website or from the app. A ticket of the "Bug" category opened from the app also attaches the app's activity log, unless you untick that option. The activity log records what the app did in your game account, such as the names and coordinates of your villages and the actions it carried out; it never contains your passwords. It is kept on your device in encrypted form and is sent encrypted, so only Strigard support can read it.
- Ban reports: if the app detects that your game account has been banned or that the game can no longer be played, it sends us a report with the game server, the time, what the game page showed and the app's activity log, encrypted as described above. We use it to find out what led to the ban and to improve the app.
- Survey answers: if you answer one of our occasional surveys about the Service, your answers and whether you had a paid subscription at the time.
- Game credentials: see section 3, which receives specific handling.
- Technical data: IP address, activity logs, data associated with strictly necessary cookies and aggregated website traffic statistics (see section 9).
3. Specific handling of game credentials
For the Service to work, you must provide your login credentials for the game.
These credentials are stored locally on your device and are used only to log in to the game's servers on your behalf. They are never transmitted to or stored on our servers.
4. Purposes and legal bases
We process your data for the following purposes, on the following legal bases under applicable data protection law:
- Create and manage your account and licence, and provide the Service → performance of the contract.
- Process payments and issue invoices → performance of the contract and compliance with legal (tax and accounting) obligations.
- Handle your support requests → performance of the contract and our legitimate interest in giving you good service.
- Ensure security and prevent fraud (licence sharing, abuse, non-payment) → legitimate interest.
- Find out what led to the ban of a game account that used the app, and improve the app → our legitimate interest in keeping the Service working for its users.
- Ask for your opinion about the Service through occasional surveys, sent by email to users who have used the app recently → our legitimate interest in improving the Service. Every survey email has a link to stop receiving them.
- Measure how the website is used, in aggregate (visits, pages viewed, load times) → legitimate interest in understanding and improving the website.
- Send you service communications (renewal notices, incidents, changes) → performance of the contract.
- Send you marketing or product-update communications → your consent, which you can withdraw at any time from your notification preferences.
- Comply with legal obligations → compliance with legal obligations.
5. Recipients and processors
We do not sell your data. We share strictly necessary data with providers that act as our data processors under the appropriate agreement:
- Supabase — database hosting, authentication and file storage.
- Cloudflare — web hosting, CDN and DNS; protection against automated abuse on the sign-up and password-reset forms (Turnstile); and cookieless website analytics (Cloudflare Web Analytics, see section 9).
- Paddle (Paddle.com Market Ltd.) — payment processing, acting as merchant of record. The pricing section of the home page also asks Paddle for the price including your country's taxes, so when you open that page your browser connects to Paddle, which receives your IP address.
- Resend (Resend, Inc.) — sending transactional emails (account confirmation, password recovery, notices of new replies to your support tickets) and the occasional survey emails.
In addition, some content on the website is served by independent third parties, which do not act as our processors and handle these requests under their own privacy statements. No account data is shared with any of them:
- GitHub (GitHub, Inc.) — when you open the home page, your browser queries GitHub's public API to display the latest available version of the app, and app downloads are served from GitHub. For these requests GitHub receives your IP address and standard browser information. No cookies are set.
- YouTube (Google) — the videos in the guides are embedded in YouTube's privacy-enhanced mode (youtube-nocookie.com). Nothing is loaded from YouTube until you press play; from that moment YouTube receives your IP address and standard browser information, and may store information on your device, under Google's privacy policy.
- jsDelivr — some of the code libraries used by the website are served from this public CDN, which receives your IP address and standard browser information in order to deliver them. No cookies are set.
We may also disclose data to authorities where legally required.
6. International transfers
Some of our providers may process data outside your country or region. In such cases, transfers are covered by appropriate safeguards, such as standard contractual clauses, or by an adequacy decision where applicable. We recommend choosing the regional option closest to you in providers that allow it, to minimize transfers.
7. Retention periods
We keep your data for as long as you maintain an active account. After you cancel or delete it, we apply the following specific retention periods:
| Data category | Retention period | Reason |
|---|---|---|
| Billing and transaction data (plan, amount, currency, status, transaction ID and date) | 6 years from the end of the financial year | Article 30 of the Spanish Commercial Code, which requires business records and supporting documentation to be kept for that period |
| Account and registration data (email, registration date, licence history) | 4 years from account cancellation | Limitation period for tax liabilities (Article 66 of the Spanish General Tax Act) and for the enforcement of contractual liabilities |
| Service usage data (bot sessions, usage time, client version) | 4 years from account cancellation | Evidence of contract performance and fraud prevention over the same limitation period |
| Support data (tickets, messages and attachments, including any attached activity log) | 4 years from the closure of the ticket | Handling of claims and warranty-related disputes |
| Keyed hash of the email address of deleted accounts | Indefinitely | Fraud prevention and prevention of free-trial abuse (legitimate interest). The email address itself is not kept — see section 8 |
| Ban reports (game server, time, what the game page showed and the attached activity log) | 12 months from the report | Finding out what led to the ban and improving the app |
| Survey answers | Deleted together with the account | They are only used to improve the Service while you use it |
| Technical data and security logs | 12 months | Detection of incidents and abuse |
Once these periods have elapsed, the data is deleted or irreversibly anonymized. During the retention period, the data remains blocked: it is used solely to serve the purpose that justifies it (attending to legal, tax or judicial requirements) and is not processed for any other purpose.
Invoices issued by Paddle as merchant of record are kept by them, as the seller of record, under their own legal obligations and retention periods.
8. Your rights and account deletion
You have the right to access, rectify, delete and port your data, to object to or restrict certain processing, and to lodge a complaint with your data protection authority. To exercise any of these rights, write to contact@strigard.app.
Account deletion. You can delete your account at any time from your dashboard ("Delete account"). This permanently removes your account, profile, licence, support tickets, ban reports, usage records and payment history from our systems. Please note:
- If you have an active paid subscription, you must cancel it first so that no further charges occur.
- Transaction and invoicing records are held by Paddle (as merchant of record) and are retained by them in accordance with their own legal obligations.
- To prevent abuse of the free trial and fraud (legitimate interest), we keep a keyed cryptographic hash (HMAC-SHA-256) of the deleted account's email address, not the address itself. The key is a secret held only on our server: without it, the hash cannot be linked to any email address. It is only used to detect that the same address is registered again. It is still pseudonymised personal data, and we protect it as such. For this reason, accounts created with a previously deleted email address do not receive a new free trial.
9. Cookies
The Service uses cookies and similar technologies that are strictly necessary for the site to function and to keep you signed in, which do not require consent.
To measure visits to the website we use Cloudflare Web Analytics, which does not use cookies or local storage, does not fingerprint your browser and does not track you across websites. It only produces aggregated statistics (pages viewed, referring site, country, browser type and load times) and does not identify you, so it does not require consent either.
If in the future we add non-essential cookies, we will ask for your prior consent through a cookie management system.
10. Security
We apply reasonable technical and organizational measures to protect your data against unauthorized access, loss or alteration, including password encryption and database access control. The app's activity log is stored on your device encrypted with a key that only Strigard support holds. No system is completely infallible, but we work to maintain an appropriate level of security.
11. Minors
The Service is intended exclusively for people aged 18 or over. We do not knowingly collect data from minors. If we detect that a minor's data has been provided, we will delete it.
12. Changes to this Policy
We may update this Privacy Policy. We will inform you of material changes by reasonable means (for example, by email or via a notice on the website). The version in force will always be the one published on the website with its last-updated date.
13. Contact
For any question about this Policy or the processing of your data, write to us at contact@strigard.app.