Kingbot Privacy Policy
Last updated 30 October 2026 ยท Version 2026-10-30
This policy explains what personal data Kingbot collects, why, who receives it, how long we keep it and what rights you have.
1. Who we are
The controller of your personal data is Kingbot.
Data protection contact (Data Protection Officer): support@kingbot.app.
2. What we collect
Your Kingbot account
- Email address, your chosen language, and a one-way hash of your password (we cannot read your password).
- Two-factor secrets if you turn on two-factor sign-in, stored encrypted, and one-way hashes of your recovery codes.
- Sign-in records: for each session and each companion device, the IP address, browser or device description, and when it was created and last used.
- Security and audit records: sign-ins, failed sign-ins, changes to your account and administrative actions, with the IP address where relevant.
- Terms acceptances: which version you accepted, when, from which IP address, and your confirmation that you meet the minimum age and own the game accounts you link.
Your game accounts
- Game login: after you sign in to the game's login provider in the Kingbot companion, the companion sends us the game's login session (not your Google or Facebook password). We store it encrypted and use it only to connect your game account. Details: How we handle your game login.
- A one-way code of your game account ID, so that one game account cannot be linked to two Kingbot accounts.
- Game data for your linked characters: character IDs and names, kingdom, game state (for example buildings, troops, heroes, items, events and alliance information) and the history of what Kingbot did.
- Your settings for each character and automation.
- Game traffic records: a record of the game requests and replies exchanged between Kingbot and the game for each character, used to diagnose faults. They do not include chat messages.
- Chat: when you open game chat in the dashboard, the messages are shown live and kept only in the server's memory while your character is connected. We do not store chat history. If you use chat translation, the text is sent to DeepL and the translation is also kept only in memory.
Trials
- The dates of your trial and a one-way code of each character's game ID that ran on a trial. We keep these codes after your trial and after you delete your account, so that a character cannot get a second free trial. They cannot be turned back into the game ID without a secret key that we hold.
Cancellations
- When you cancel on the public "Cancel contracts here" page: the email address and name you enter, the type of cancellation, any reason you give, the end you ask for, when we received it and from which IP address, and what we did.
Payments
- Your Stripe customer and subscription references, price, billing period, status, payment amounts and dates, refunds, chargebacks and the renewal reminders we sent. We never receive your full card number: you enter payment details on Stripe's own pages.
Emails
- The emails we send you (for example trial, renewal reminder, refund and outage notices), whether they were delivered, and delivery errors.
Support
- What you write to us and our replies.
We do not use advertising or analytics trackers, and we do not sell or rent your personal data.
3. Why we use it, and the legal basis
| Purpose | Data | Legal basis (where GDPR/UK GDPR applies) |
|---|---|---|
| Provide the Service: accounts, game connection, automation, translation, dashboard | Account, game login, game data, settings | Contract |
| Take payments, refunds and send renewal reminders | Payments, email | Contract; legal obligation |
| Keep accounts and the Service secure, prevent fraud and trial abuse | Sign-in and audit records, trial codes, game account codes | Legitimate interests (security and fraud prevention) |
| Diagnose faults and keep automation working after game updates | Game traffic records, game data | Legitimate interests (a working service) |
| Answer support requests | Support messages, account | Contract; legitimate interests |
| Keep accounting and tax records | Payments | Legal obligation |
| Comply with the law and defend legal claims | Any relevant data | Legal obligation; legitimate interests |
We send service emails needed to run your account. We do not send marketing emails unless you separately agree to them.
4. Who receives your data
We use these service providers, who process data for us under contract:
| Provider | What for | Location |
|---|---|---|
| Amazon Web Services | Hosting the Service and its database | Asia Pacific (AWS region ap-southeast-1) |
| Stripe | Payments, refunds, disputes, receipts | United States and other locations, see Stripe's privacy policy |
| Amazon Web Services (Amazon SES) | Sending emails | Asia Pacific (AWS region ap-southeast-1) |
| DeepL | Translating chat messages you choose to translate | Germany / European Union |
Century Games, the game's publisher, receives what any game client sends: your game login and the game actions Kingbot performs, from your own internet connection through the companion. Century Games is not our service provider; it handles that data under its own privacy policy.
Google or Facebook, when you sign in to the game through them in the companion, handle that sign-in under their own policies.
We may disclose data where the law requires it, to protect our rights or others' safety, or to a successor business that takes over the Service (we will tell you).
5. International transfers
Our providers may process data in countries other than yours, including the United States. Where the law requires it, we use appropriate safeguards for these transfers, such as the providers' standard contractual clauses.
6. How long we keep it
| Data | How long |
|---|---|
| Account, game logins, game data and settings | While your account is open. After all your access (trial or paid) ends, or from sign-up if you never had any, we keep them for 90 days so you can come back, then delete your game logins and game data; your Kingbot account stays. We email you twice before that, the first time at least 30 days ahead. |
| Game traffic records | 30 days, then deleted automatically |
| Sessions and companion devices | Until they expire (at most 30 days for a session) or you sign out or revoke them |
| Security and audit records | 12 months |
| Payment records (amounts, dates, refunds, invoices) | As long as tax and accounting law requires (at least 5 years after the end of the financial year they relate to); kept even after you delete your account, then deleted |
| Trial character codes and game account codes | Indefinitely, to prevent repeat trials; they contain no readable game ID |
| Terms acceptances | As long as payment records, as evidence of the agreement |
| Cancellations sent on the public page | As long as payment records, as evidence; 12 months when no subscription matched |
| Emails sent | 12 months |
| Support messages | 2 years after the request is closed |
When you delete your Kingbot account, we stop all automation, delete your game logins, game data, settings, sessions and devices straight away, and keep only the records listed above as kept after deletion.
Deleted data can stay in our encrypted database backups for up to 30 days, until those backups are deleted automatically. We use backups only to recover the Service after a failure. If we ever restore one, we delete again what you had deleted.
7. Security
Game logins and two-factor secrets are encrypted with AES-256-GCM, with keys kept outside the database. Passwords, session tokens, device tokens and recovery codes are stored only as one-way hashes. Administrators must use two-factor sign-in and confirm it again before sensitive changes, and cannot view or export your game login. Logs never include passwords, tokens or game logins.
No system is perfectly secure. If a breach affects your personal data and the law requires it, we will notify you and the relevant authority.
8. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy;
- correct it;
- delete it (you can delete your account yourself under Your account);
- object to, or ask us to restrict, some uses;
- receive your data in a portable format; and
- withdraw consent, where we rely on it.
To use these rights, email support@kingbot.app from your account's email address. We answer within 30 days. We may need to confirm your identity. Some data must be kept for the reasons in section 6.
You can also complain to the data protection authority where you live.
California residents: we do not sell or share personal information for cross-context behavioural advertising. You have the rights to know, delete and correct, and we will not discriminate against you for using them.
9. Cookies and local storage
We use only what the Service needs:
| Name | Purpose | Lasts |
|---|---|---|
| Session cookie | Keeps you signed in | Up to 30 days, or until you sign out |
| Language cookie | Remembers your language | 1 year |
| Browser local storage | Remembers dashboard preferences, such as open sections | Until you clear it |
There are no advertising or analytics cookies. Stripe's checkout pages set their own cookies under Stripe's policy.
10. Children
Kingbot is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
11. Other players' data
Game data and traffic records can include other players' names and alliance information that your character can see in the game. We use them only to run the Service for you, keep traffic records for 30 days, do not store other players' chat messages, and do not build profiles of other players.
12. Changes
We will post any change here with a new date. If a change materially affects how we use your data, we will email you before it applies.
Contact
Kingbot, support@kingbot.app.