Privacy Policy

Last updated: 3 November 2026

In short: we keep only what we need to run OpenKogama. We don't sell your data, show ads or use tracking cookies, and you can delete your account at any time.

Who we are

OpenKogama is responsible for your data in our services (it is the data controller). Write to us at contact@openkogama.org in English or Polish.

Your account

When you create an account, we keep:

• your name, which other players can see;
• your password, but only as a salted hash that can't be turned back into the password;
• your email address, if you give one, to send you codes and to reset a forgotten password;
• your Google account ID and email address, if you sign in with Google;
• the date you created the account.

When you sign in, we keep a session so you don't have to sign in every time. It ends when you sign out or after 180 days without use. Codes from emails work for 15 minutes. If you register with an email and never confirm it, the account is deleted after 24 hours. Emails are sent through Resend.

Why: to give you the account you asked for (Article 6(1)(b) GDPR).

Keeping accounts safe

To stop bots and password guessing, we count attempts from each IP address for up to an hour, only in memory. Signing in, registering, resetting a password and sharing maps use Cloudflare Turnstile, which checks that you are not a bot. We send Cloudflare the answer from that check and your IP address.

Why: to protect your account and our services, which is our legitimate interest (Article 6(1)(f) GDPR).

Playing on servers

When you join a server with your account, we give the launcher a ticket with your name and account ID that is valid for 2 minutes. The server you join gets that ticket and your IP address.

Most servers are run by other people, not by us. Their owners decide what their servers keep and are responsible for that data. Servers we run, like war4, keep your profile there (your name, your progress and the worlds you build) and logs.

Why: to let you play where you choose (Article 6(1)(b) GDPR).

The public server list

The Public tab in the launcher shows servers from list.openkogama.org. While you play on a public server, the launcher tells the list which server it is, so the list can count players. The list keeps your IP address with that server for 3 minutes and then forgets it.

Titles and thumbnails of listed servers are checked with a word list and the OpenAI moderation service. OpenAI gets those titles and thumbnails, but not your account or your IP address.

Why: to show a list that is accurate and safe, which is our legitimate interest (Article 6(1)(f) GDPR).

Hosting with a code

When you host or join a world with a code, the connection can go through our relay servers in Europe, North America, South America or Asia. They pass the game traffic on without saving it, and they see the IP addresses of the host and the players.

Why: to make the connection you asked for (Article 6(1)(b) GDPR).

Sharing maps

When you share a map with the archive, we receive the file, its name, the author name you type in and your IP address. The map then goes to the public archive with its name, the author name and a note that it was archived after KoGaMa closed.

Why: to publish what you shared (Article 6(1)(b) GDPR) and to stop abuse (Article 6(1)(f) GDPR).

Publishing plugins

When you publish a plugin, we keep its files, name, descriptions, images and videos, the list of versions and your account name as the author. All of this is public, except the files of versions that are still waiting for approval: only you and moderators can see those. We send every plugin file to VirusTotal (Google) to check it for malware; VirusTotal keeps the file and shares it with its partners under its own rules. We send plugin names, descriptions, changelogs and images to OpenAI to detect abuse. When you report a plugin, we keep your account and the reason until a moderator handles the report. When you rate a plugin, we keep your account and the rating; only the average and the number of ratings are public. To count downloads we keep your IP address in memory for up to an hour. Deleting your account also deletes your plugins.

Why: to provide the service (Article 6(1)(b) GDPR) and to protect players from abuse (Article 6(1)(f) GDPR).

The website

The website doesn't use analytics, ads or tracking cookies. Your browser keeps a few things in its local storage: your sign-in, your language, your likes, the 18+ setting and the author name from the map sharing form. They stay on your device. The website runs on Cloudflare, which sees your IP address when you visit.

Videos on the home page are embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com). Google gets your IP address when a video player loads, and YouTube's privacy policy applies when you play a video.

The launcher

The launcher downloads game files and updates from our CDN on Cloudflare and from GitHub. If Discord is running, the launcher shows what you are playing in your Discord status, through the Discord app on your computer. Your sign-in is saved on your computer and encrypted by Windows.

Logs

Our servers keep technical logs to fix problems and stop abuse. They can contain IP addresses, names and chat messages from servers we run. We delete them after 30 days.

Why: to keep OpenKogama working and safe, which is our legitimate interest (Article 6(1)(f) GDPR).

Who else gets data

• Cloudflare: the website, the CDN and Turnstile.
• Resend: sending emails.
• OpenAI: checking server titles and thumbnails, and plugin descriptions and images.
• VirusTotal (Google): scanning plugin files.
• Google: YouTube videos, and sign-in with Google if you use it.
• GitHub: game files and launcher updates.
• The companies that host our servers.
• Owners of the servers you join.
• Other players: they see your name, and the maps you share are public.

We don't sell or rent your data to anyone.

Where your data is

Accounts are kept on a server in São Paulo, Brazil. Our other servers are in Europe, North America, South America and Asia, and some of the companies above are based in the United States. When data leaves the European Economic Area, we rely on adequacy decisions of the European Commission or on the standard contractual clauses that these companies provide.

How long we keep it

• Account: until you delete it.
• Account with an unconfirmed email: 24 hours.
• Sign-in session: until you sign out, or 180 days without use.
• Codes from emails: 15 minutes.
• Counting attempts and players: up to an hour.
• Logs: 30 days.
• Shared maps: in the archive until you ask us to remove them.
• Plugins: until you delete them or we remove them.
• Plugin reports: until a moderator handles them.
• Download counting: up to an hour.
• Backups: deleted data can stay in backups until they are replaced.

Your rights

You can ask us to show you your data, correct it, delete it, send you a copy of it, or stop or limit using it. You can delete your account yourself on your account page. For anything else, email us and we will answer within a month.

Deleting your account removes your account, email address, password hash and sessions from our account server. To remove your profile from a server we run, or a map you shared, email us. For servers run by other people, ask their owners.

You can also complain to a data protection authority. OpenKogama is run from Poland, so our authority is the President of the Personal Data Protection Office (UODO, uodo.gov.pl). You can also complain in the country where you live.

Children

You must be at least 13 to create an account. If you are under 18, read this page together with a parent or guardian. If we learn that an account belongs to someone under 13, we delete it. Parents can write to us at contact@openkogama.org.

Changes

When this policy changes, we update this page and the date at the top.