| Language: |
Current version: https://manala.eu/privacy
Your privacy matters. This policy explains what data we collect when you play Manala, why, and your rights. We never sell your data.
Last updated: 2026-07-26.
Who is responsible (controller). OÜ Kilbirivi (registry code 17538063), a company registered in Estonia, is the data controller for the Game. Contact: shieldwall@manala.eu / Virmalise 7-12, Tallinn 10131, Estonia.
What we collect, why, and our lawful basis.
Who we share it with (subprocessors).
We do not sell personal data and do not use it for advertising.
Steam / Valve (separate, independent controller). When you buy or play the Game through Steam, Valve Corporation processes your data as its OWN, independent data controller under Valve's privacy policy: not as our subprocessor. We and Valve each decide our own purposes for the data we hold and are each separately responsible for it.
Discord and other platforms. We run an official public Discord server, which we moderate under the Community Rules, and post the world-event information described above to it. Discord is an independent controller for your activity there under Discord's own policies. We do not monitor and take no responsibility for private Discord messages (DMs) or for contact between players on any other platform or channel; those happen outside the Game.
International transfers. Game data is hosted in Central EU (Frankfurt, Germany). Some providers (e.g. auth/security logging) may process data outside the EU/EEA, including the United States; where that happens we rely on the EU Standard Contractual Clauses or an equivalent safeguard.
How long we keep it. We keep personal data only as long as necessary for the purpose it was collected (GDPR storage limitation), then delete or anonymise it. In practice: account and character data while your account is active; security and sign-in logs (e.g. IP, client) for 30 days; diagnostic and balance telemetry for up to 90 days; public chat logs and whisper metadata for up to 90 days (evidence behind a moderation action may be kept longer, for the ban and appeal period); feedback until we have acted on it. When you delete your account, your character and associated game data become inaccessible immediately, are purged from active systems within 7 days, and are removed from backups within 30 days, except where we must keep limited records to meet a legal obligation.
Your rights. Under the GDPR you have the right to access, correct, erase, restrict, or object to the processing of your personal data, and the right to data portability. To exercise any of these, use the in-game Feedback (Tagasiside) tool ("Account issues") or email shieldwall@manala.eu; we may need to verify that the request relates to your account. You can also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or your local supervisory authority.
Children. You must be at least 13 years old to play. We do not knowingly collect data from anyone under 13; if we learn that we have, we will delete it.
Security. We use TLS for data in transit and take reasonable measures to protect your data. To report a security issue, email shieldwall@manala.eu.
Changes and contact. We may update this policy; we will update the date above and note significant changes in the Game or on manala.eu. Questions: shieldwall@manala.eu.
Adapted from the Basecamp open-source policies ( https://github.com/basecamp/policies ), used under CC BY 4.0. Modified.
Manala: Privacy Policy
Your privacy matters. This policy explains what data we collect when you play Manala, why, and your rights. We never sell your data.
Last updated: 2026-07-26.
Who is responsible (controller). OÜ Kilbirivi (registry code 17538063), a company registered in Estonia, is the data controller for the Game. Contact: shieldwall@manala.eu / Virmalise 7-12, Tallinn 10131, Estonia.
What we collect, why, and our lawful basis.
- Account and sign-in. You sign in with your Steam account. From Valve we receive your SteamID and limited public Steam profile information (such as your persona / display name) to create and identify your in-game account. We do NOT receive your Steam password or your payment-card details. For security and fraud prevention we log technical data such as your IP address and client/user-agent. Lawful basis: performance of our agreement with you (running the Game) and our legitimate interest in keeping it secure.
- Entitlement. To grant access, we may receive from Valve confirmation that your Steam account owns the Game. Lawful basis: performance of the agreement.
- Your character(s). The name you choose and your gameplay state (stats, inventory, quests, location, faction). One account may hold several characters. Your character name is visible to other players in the world. For certain world events (area conquest, new-recruit welcome, the weekly leaderboard) your character name and faction are posted to our PUBLIC Discord server. Lawful basis: performance of the agreement (you chose to play a shared online world) and legitimate interest in running community features. Do not put personal information in your character name.
- Chat and messages. Public chat (say, yell, narrate) is logged with the sender, scope, and time and kept for up to 90 days, so we can keep the world safe and enforce the Community Rules. Private whispers are NOT logged: we keep only minimal metadata (who messaged whom, when, and message length: no content) for up to 90 days to detect spam and abuse. The content of a whisper is recorded only if you report it, from the copy on your device. Lawful basis: our legitimate interest in safety and moderation.
- Diagnostics and balance telemetry. We log in-game actions and errors to fix bugs and balance the Game. Lawful basis: legitimate interest. Retention: kept only as long as needed to act on it, up to 90 days.
- Feedback. When you use the "Tagasiside" (Feedback) button, we keep what you send so we can act on it. Lawful basis: legitimate interest.
- Local storage. We use functional local storage to keep you signed in and remember settings. We do not use advertising or third-party analytics cookies.
Who we share it with (subprocessors).
- Supabase: database, authentication, and backend hosting.
- Vercel: hosting and content delivery for manala.eu (the information site and these policies).
- Discord: receives your character name + faction for the public world-event posts described above.
We do not sell personal data and do not use it for advertising.
Steam / Valve (separate, independent controller). When you buy or play the Game through Steam, Valve Corporation processes your data as its OWN, independent data controller under Valve's privacy policy: not as our subprocessor. We and Valve each decide our own purposes for the data we hold and are each separately responsible for it.
Discord and other platforms. We run an official public Discord server, which we moderate under the Community Rules, and post the world-event information described above to it. Discord is an independent controller for your activity there under Discord's own policies. We do not monitor and take no responsibility for private Discord messages (DMs) or for contact between players on any other platform or channel; those happen outside the Game.
International transfers. Game data is hosted in Central EU (Frankfurt, Germany). Some providers (e.g. auth/security logging) may process data outside the EU/EEA, including the United States; where that happens we rely on the EU Standard Contractual Clauses or an equivalent safeguard.
How long we keep it. We keep personal data only as long as necessary for the purpose it was collected (GDPR storage limitation), then delete or anonymise it. In practice: account and character data while your account is active; security and sign-in logs (e.g. IP, client) for 30 days; diagnostic and balance telemetry for up to 90 days; public chat logs and whisper metadata for up to 90 days (evidence behind a moderation action may be kept longer, for the ban and appeal period); feedback until we have acted on it. When you delete your account, your character and associated game data become inaccessible immediately, are purged from active systems within 7 days, and are removed from backups within 30 days, except where we must keep limited records to meet a legal obligation.
Your rights. Under the GDPR you have the right to access, correct, erase, restrict, or object to the processing of your personal data, and the right to data portability. To exercise any of these, use the in-game Feedback (Tagasiside) tool ("Account issues") or email shieldwall@manala.eu; we may need to verify that the request relates to your account. You can also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or your local supervisory authority.
Children. You must be at least 13 years old to play. We do not knowingly collect data from anyone under 13; if we learn that we have, we will delete it.
Security. We use TLS for data in transit and take reasonable measures to protect your data. To report a security issue, email shieldwall@manala.eu.
Changes and contact. We may update this policy; we will update the date above and note significant changes in the Game or on manala.eu. Questions: shieldwall@manala.eu.
Adapted from the Basecamp open-source policies ( https://github.com/basecamp/policies ), used under CC BY 4.0. Modified.