Privacy Policy

Last Updated: October 19, 2026

Welcome to Tribes of Malaya (accessible from https://tribesofmalaya.com). Your privacy is of paramount importance to us. This Privacy Policy describes how we collect, use, process, and protect your personal data when you visit our website, register for an account, and participate in our game services.

1. Information We Collect

We collect information that you provide directly to us as well as data gathered automatically when using our services:

Account Information: When registering via email, we collect your email address, first name, last name, username, city, birthdate, and password (securely hashed).
Google Sign-In / User Data: If you choose to sign up or log in using Google Identity Services, we request access only to basic authentication profile scopes (openid, email, profile). We receive and store:
- Your Google account email address;
- Email verification status from Google;
- Your name (given name and family name);
- Your unique Google user identifier (sub).
We do not request, access, or store your Google password, contacts, Google Drive files, or any other sensitive account information.
Gameplay and Virtual Items: Towns, alliances, coordinates, game actions, building queues, troops, resources, and in-game communication logs necessary to operate the game state.
Technical and Security Logs: When you connect to our servers, we automatically log your IP address, browser user-agent string, operating system, and request timestamps to maintain server security, prevent multi-account cheating, and enforce rate limits.

2. Google API Services User Data Policy Compliance

Limited Use Disclosure: Tribes of Malaya's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google user data solely to facilitate seamless authentication and account creation. We never sell your Google user data to third parties, nor do we use it for advertising or loan eligibility purposes.

3. How We Use Your Information

We use the collected information for the following legitimate purposes:

Account Management & Authentication: To create and authenticate your player profile, manage session tokens, and ensure you can access your game realm.
Game Operations: To process simulation ticks, update town resource productions, calculate combat and alliance interactions, and display leaderboards.
Security & Rule Enforcement: To detect, investigate, and prevent fraudulent activities, botting, automated attacks, and violations of our Multi-Account and Terms of Service rules.
Service Communications: To send essential transactional emails, such as email verification codes, password resets, and critical account notices.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We only share information with trusted third-party service providers essential for running our game:

Cloud Infrastructure & Hosting: Google Cloud Platform (Google App Engine, Google Cloud Storage, Google Compute Engine) for secure hosting and database services.
Security & Content Delivery: Cloudflare for DDoS mitigation, DNS resolution, and global CDN delivery.
Transactional Email Delivery: ZeptoMail / email delivery services for sending verification and password reset emails.
Legal Requirements: If required by law, regulation, legal process, or governmental request to protect the security and safety of our community.

5. Cookies and Local Storage

We use browser cookies and browser local storage strictly for operational purposes:

Session & API Tokens: To remember your authenticated game session (api_key) so you do not have to log in on every page transition.
Analytics: Google Analytics (gtag.js) to understand general website traffic and improve user experience.

6. Data Security and Retention

We implement industry-standard technical measures to safeguard your data:

Passwords are irreversibly hashed using standard cryptographic algorithms (bcrypt).
All data in transit is encrypted using Modern Transport Layer Security (TLS/HTTPS).
API keys and login tokens are short-lived and subject to immediate cache invalidation upon logout or password reset.

We retain your account information for as long as your account remains active. Inactive accounts may be subject to routine server resets or archiving in accordance with game rules.

7. Your Rights & Data Deletion

You have the right to:

Access the personal information we hold about you;
Update or rectify inaccurate profile information;
Request the deletion of your account and associated personal data.

How to request account or data deletion: To request complete deletion of your account, email address, and associated game data (including Google authentication records), send an email to [email protected] with the subject line "Data Deletion Request" using the email address linked to your account. Your account and personal identifiers will be permanently removed from our active database within 30 days.

8. Children's Privacy

Tribes of Malaya is not intended for children under 13 years of age. We do not knowingly collect personal identifiable information from children under 13. If you believe a child has provided us with personal information, please contact us immediately so we can remove the data.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our legal obligations, game features, or operational practices. Any changes will be posted on this page with an updated "Last Updated" date.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how your data is handled, please contact us at:

Email: [email protected]
Website: https://tribesofmalaya.com