Privacy

Novarchy — last updated 25 October 2026

Novarchy is run by AIgen Solutions S.r.l. (Via dei Maffei 42, 00165 Roma, Italy; VAT IT18165291008), the data controller for what this page describes — reach us at support@novarchy.com or info@aigensolutions.it. The game is free to play. There are no ads in the game, and nothing about you is sold or shared for marketing. Three things are measured, and none leaves our own servers: visits to the website are counted without cookies; we look at how far new players get through the first steps, to find where the game loses people — that one reads the account data listed here, including a short report the game itself sends from your first minutes, not a tracker; and we advertise the game elsewhere, so we note which of our ads, or which other site, brought a new player, to know which ads bring players who stay. No advertiser's tracker or pixel is on this site. This page describes exactly what the game stores and why — in plain terms, because a policy nobody can read protects nobody.

What the game stores

• The name you choose. If you play as a guest, that name is your account: no email, no password.
• Your email address — only if you sign in with Google. It is used to recognise you when you come back, and for nothing else. We never see your Google password.
• An identifier from Apple — only if you sign in with Apple. Apple gives us a code that means "this person", and that code is what we store to recognise you when you come back. It is meaningless to anyone else, and it is not your email: Apple may also pass on an address — a relay one if you chose Hide My Email — but we do not store it and nothing in the game uses it. We never see your Apple password.
• The first name Apple gives us, if you signed in with Apple and let it. Apple offers it once, on your first sign-in only, and we use it as your public commander name — the name other players see in chat and on the leaderboard. You can change it in the game at any time, and if Apple sends nothing we generate a name instead.
• A recovery code — only if you play as a guest and make one. We keep a one-way scrambled form of it, its first six characters (so we can find it when you type it), when you made it and when it was first used: enough to check a code you type, not to show it back to anyone, us included. Making a new one, linking an account, signing out your other devices, or an hour passing since its first use makes it stop working. Making a new one replaces what we keep; linking an account or deleting your account deletes it; a code that stopped working any other way stays stored, unusable, until one of those happens. The game never keeps the code itself on your device.
• Your game state: colony, buildings, fleets, research, battles, alliances. This is the game.
• When you signed up, when you were last online, and when you reached each of the first steps. The last one is what tells us which step new players give up on. Inside your guild, the members list shows part of the second to other members. Members, Veterans, Officers and the leader see whether you were last seen within the last week, over a week ago or over two weeks ago, or that you are on a declared leave (never when it will end). The leader and Officers also see it in whole days, for example “not seen in over 3 days”, which can tell them the day you were last seen. The list never shows a time of day, but someone who keeps it open can notice the moment it changes: when you come back after a whole day or more away (after a week or more, for Members and Veterans), when a declared leave runs out, and when a week and then two weeks have passed since you were last seen. Recruits and players outside your guild are not shown when you were last seen. Separately, other players can see on the galaxy whether an empire’s owner has gone a week or more without being seen (a declared leave counts as being seen), and players without a guild see how many of a suggested guild’s members were seen in the last 48 hours.
• A short report of your first minutes — in your first 24 hours only. In the first 24 hours after your account is created, the game tells our own server that it started, that the card offering your first buildings appeared, when you tapped its Build button, and how each build request that button sent ended: it went through, was refused (with the server’s own short reason), timed out, got no answer at all, or never left your device. Each report also says which version of the game sent it. It records nothing you type and nothing about any other screen, and our server keeps no new report once those 24 hours have passed. What it kept stays with your account and is deleted with it; only daily totals, with no account attached, remain in our metrics. It exists to tell where new players get stuck before their first building.
• The two-letter country code your connection came from — at signup only. Our own web server resolves the country your address belongs to (using the freely licensed IP-to-Country database by DB-IP), and at the moment your account is created only the two letters are kept: your IP address is not stored, and the country is never updated afterwards. It tells us where new players are finding the game. If it cannot be resolved, no country is stored at all.
• Which of our doors you signed up through, and on what kind of device and app — at signup only. One word, web, ios or android, sent by the game itself: which of our own builds you arrived on. We need it because the country above is resolved from the address your connection reaches us from, and app traffic often reaches us through the platform's own network — so without this we cannot tell a player in one country from a phone routed through another. Beside it, also kept once, whether the device was a phone or a computer, and which kind of app opened the game: our own app, a browser, the in-app browser of Instagram, Facebook or TikTok, or another app's, on iOS, Android or a computer. Both are read from the identification string your browser already sends with every request, and we keep only those words: never the browser version, the device model or the string itself. They tell us where new players arrive from and which of those places the game loses them in. None of them is updated afterwards, and what cannot be read is not stored.
• Which of our ads, or which other website, brought you here — at signup only. Our ads link to the game with a few labels in the address that name the ad: where it ran (for example meta or reddit), what kind of ad it was, which campaign, and which version of the ad. If you arrive through one, the game keeps those campaign labels in this browser, and if another website linked you here, the name of that site — never the address of the page you came from. For 30 days they are sent with every sign-in from this browser, and kept on your account only if that sign-in creates it: once, never updated. Separately, the page you land on tells our own server that it was shown and that Play was tapped, with the same labels — or with none, for a visit that came from no ad and no other site; our server keeps only a count per day for each ad, and one for those direct visits, with nothing about you or your device, and the same count of sign-ups. To stop one address flooding that count, our server holds a key derived from your connection's address in memory for 15 minutes, and never writes it down. It is how we know which ads bring players who stay. If you arrive without an ad or a link from another site, nothing is kept in your browser or on your account: the visit only adds one to the day's count of direct visits. None of this happens in the mobile app, and none of it happens if you turned visit counting off or your browser sends “Do Not Track” or Global Privacy Control: then nothing is noted or sent, and labels kept from an earlier visit are deleted.
• Chat messages you send. The galaxy channel and your guild channel are read by other players by design. A private whisper is between you and one other person, and is not shown to anybody else.
• Reports and blocks: if you report a message we store the message text as it was, so it can still be judged if the message is later removed. If you block someone, we store that so we can hide them from you.

What is stored on your device

No advertising or tracking cookies are used. What the game does keep, in your browser's own storage (or the app's), is there so the game works the way you left it:

• Signing in: a sign-in token, so you are not asked to identify yourself on every visit; a note that this device has held an empire before; and, if you carried a guest empire to another browser, the last few one-time codes this browser made or used for it.
• Apple's and Google's sign-in, in the iPhone app: if you sign in with Apple there, the sign-in component the app uses keeps the identity token Apple issued (which carries your Apple account ID and email) and, on your first sign-in, the name Apple shared with us. If you sign in with Google there, Google's own sign-in library keeps its session on the phone.
• Your settings: language, sound, your notification choices (and, if you turned notifications on, the address the notification service gave this device), and display preferences such as which tabs sit in the menu.
• Work in progress: things you started and have not finished, so a reload does not lose them — unsent chat messages, mission, market, raid and defense drafts, recent targets and the last orders you launched.
• What you have already seen: which reports, messages and notices you have already opened or dismissed, which panels you collapsed, and a snapshot of your colonies' stock, buildings and research from your last visit, for the "while you were away" summary.
• Where you arrived from — if you came through one of our ads or a link on another website, that ad's campaign labels or that site's name, for 30 days, so that signing up on a later visit still counts for the ad that brought you. The game deletes them as soon as you sign in, and otherwise the first time the sign-in page opens after those 30 days. Separately, on every visit to the landing page, ad or not, a note for the open tab only that its landing was already counted, so a reload is not counted twice. See which of our ads brought you here above.
• Your choice about visit counting — only if you use the button below to turn visit counting off: that flag is how your browser remembers it.

Much of this is kept separately for each account, so a second player on the same browser does not inherit your drafts. Signing out removes the sign-in token and the one-time codes, and in the app also this device's notification address once our servers confirm the sign-out. The rest stays on the device and is there again when you sign back in, and that includes Apple's and Google's sign-in data in the iPhone app: signing out of the game does not clear it. Clearing this site's data in your browser removes everything the game keeps there. Uninstalling the app removes what the app keeps, though Google's sign-in library may keep its session in the phone's secure storage beyond that.

How visits are counted

We count visits to the website, so we know whether anyone is finding the game at all. It runs on a server we run ourselves, using open-source software called Plausible Analytics: no third party is involved — nothing about the counting leaves novarchy.com. It sets no cookies and stores nothing on your device.

What is recorded: the page you opened, the site that linked you, your country, your browser, operating system and device type, how far down the page you scrolled and how long you were actually looking at it. Your IP address and browser are also used to build a scrambled key for the day, so two visits from you in one day usually count as one person rather than two; your IP itself is never stored, and once that day's key is thrown away the count can no longer be traced back to you. Nothing you click, download or type is recorded — this counter does not watch clicks, downloads or forms at all, so sending a chat message never reaches it. None of it is connected to your game account, and it does not run inside the mobile app.

If you would rather not be counted, the button below switches it off for this browser, and nothing is loaded on any later visit. If your browser offers “Do Not Track” or Global Privacy Control, turning either on does the same thing without asking us — we check for both. Safari has no such setting, and on iPhone every browser is Safari underneath, which is exactly why the button exists. Any of the three also stops the landing page noting which of our ads brought you here.

It is worth saying plainly why a button is needed at all: the counter is served from novarchy.com itself, so blocking an analytics domain will not stop it. Refusing has to be something we honour rather than something your ad blocker can catch for you. (A blocker that filters by path can still stop /n/s.js, and nothing in the game breaks if it does.)

Who else sees anything

• Google — the game's fonts come from Google Fonts, so opening the game reaches Google whether or not you ever sign in. The screens that offer the Google button — the sign-in screen, and account linking in settings — also load Google's sign-in script, before you have chosen anything; in the mobile app that button uses Google's own app instead. Those requests show Google what any web request shows: your IP address, your browser, and which page made the request. Your email address reaches us only if you actually sign in with Google.
• Apple — in a browser, the screens that offer the Sign in with Apple button load Apple's sign-in script, before you have chosen anything, exactly as the Google one above does: that request shows Apple your IP address, your browser, and which page made it. In the app no script is loaded — the button opens Apple's own sheet instead. What comes back to us if you go through with it is the identifier above; whether an address comes with it is your choice in Apple's sheet, not ours.
• Discord — the game mirrors some public chat into a Discord channel. Only messages written by the game's AI-run empires are mirrored. Messages written by human players are not sent to Discord.
• OpenRouter — the game uses AI models, reached through OpenRouter, for the things below. Each one sends only what is listed with it. OpenRouter passes each request on to a provider that runs the model the request names, so what is listed also reaches that provider. The models are Google's Gemini (Gemini 2.5 Flash Lite) for translating chat and checking names, and Anthropic's Claude for everything the AI empires do there: their plans, their guilds, their voice and the Kepler Observatory bulletin.
  • Translating chat. Messages you send to the galaxy channel or a guild channel are sent there to be translated into English before they are stored, so that everyone reads the channel in one language. The text goes on its own: without your name, and with mentions of other players replaced by placeholders first. Before a translation is stored, it is sent there once more together with the message, the same way, to check that it says what you wrote. When a message is translated, we also keep the words you typed beside the translation; only you and the moderators can see them.
  • Checking names. A name you choose — your commander name, a colony name, a guild name and tag, the titles a guild gives its ranks, a flagship name — is sent there on its own to be checked against the rules when you pick it.
  • The AI empires' plans. The AI-run empires can make their plans with an AI model or by rules of the game's own; which of the two is a setting of ours, and it does not depend on whether the AI empires are talking. When a plan is made there, it is sent what the empire knows from the game or has run into itself: the leaderboard (commander names and points) and the wanted board (commander names, coordinates, bounty grade and value); the commander names, colony coordinates and power ratings of players in their attack range, or near them, or that they have had dealings with — battles, espionage (including what their spy reports saw of your colony: the ships in its hangar, its defences and the upgrades behind them, any garrisons stationed there, whether its power falls short of what it draws, and whether you noticed the probe), trades, and chat messages to them that read as a threat — and what happened between them, together with the game's own estimate of whether your fleet is over a strength threshold, which is not shown to players; and, while their guild is at war, the commander name (or, if it is not known, the colony name) and coordinates of the enemy guild's colonies, and the names and tags of the guilds they are at war with. A plan never includes the text of anything you wrote in chat: a threat is sent as the fact and your name, not your words.
  • The AI empires' guilds. An AI empire that leads or helps run a guild can make its guild decisions there too, by the same kind of setting, again whether or not the AI empires are talking. When it does: if you apply to its guild, your commander name is sent, and, if the guild has an entry bar, your power rating and whether you meet the bar on power and on account age; each review of the guild's ranks sends every member of the guild, not only the ones being decided about, with their commander name, rank, empire points, what they gave the guild and how that compares with the other members; and each review of the guild's Fund sends up to four members whose contributions are among the lowest in the guild, with their commander name and what they gave.
  • The AI empires' voice. Whenever their voice is switched on, their chat lines are written there, and the recent chat around them is sent along with each author's commander name: the last messages of the galaxy channel, of their own guild channel, and of a whisper thread with them, plus short quotes of what you said to that AI empire earlier in public channels, and game facts of the same kind as their plans and their guild decisions. In a guild channel that includes what happened in the guild, with the commander names involved: who joined, left, was promoted, demoted or removed, who took over command of it, who was given Scrip from its Fund, and whose request for help was answered. An AI empire that is the leader or an officer of a guild also reads that guild's High Council, the room only the guild's leader, its officers and an acting leader can read. When it answers a message there, or starts a conversation there, the last messages of the High Council are sent along with each author's commander name, the same way. High Council messages are still not sent for translation. Up to 90 characters of the last message of yours that an AI empire replied to stay in its memory. From a public channel they are sent again; from a whisper or the High Council they are kept but not sent again, apart from the whisper thread or the High Council itself when it answers there. If you withdraw that message, the AI empire drops those words, and its own reply to you, from its memory: normally within a few minutes, and at the latest on its next check once the game's servers are reachable again. For a High Council message that check depends on the AI empire still being able to read the room: while it is no longer the guild's leader or an officer, its checks are not told, and those words stay in its memory, though they are not sent again. Of that exchange it keeps only that the two of you talked, and a threat it had already read still counts against you, without your words. Its reply stays in the channel like any other message, and what it said to other players is not traced back to your message. A withdrawn message also stops being sent as part of the recent chat on the same schedule. Quotes an AI empire kept before this change are not linked to their message and are not dropped when you withdraw it. So a message you post in the galaxy channel can be sent with your name even if you never talk to an AI empire.
  • The Kepler Observatory bulletin. Whenever that same voice is on, the Observatory's news bulletin is written there about once a day, from public data only: the top three commanders' names and points, five guilds' names, tags, member counts and points, the last five galaxy-channel messages with their authors' commander names, and the commander name and coordinates of one newly founded colony.
  None of these ever sends your email address, your account identifier or your IP address. Private whispers are not sent for translation. A whisper you send to another player stays on our server, and the AI empires cannot read whispers between two other players. (A whisper to one of the AI empires is different: it is the message their reply would be written from, so whenever their voice is on it is sent there like any other message they answer. A whisper sent while they are silent stays unread on our server — and would be sent if that voice is switched back on.)
• Anthropic — the Wraiths, the openly hostile AI faction, are commanded by Claude, Anthropic's AI model, in a session that wakes on a schedule. At each wake-up the game prepares a briefing, the session reads it, and it decides the Wraiths' orders from it. What the briefing carries about players:
  • for each player the Wraiths may attack — the top five of the leaderboard, leaving out their own empires — their place on the leaderboard, commander name, power rating and number of colonies, how often and how recently the Wraiths have struck them, and, if there is a bounty on them, its value and the coordinates of one of their colonies;
  • for at most three of those players, the ones proposed as the next targets, the account identifier as well, because an attack order names its target by it;
  • the commander names of players whose fleets are on their way to a Wraith empire, when the game can tell whose they are, with how many fleets are coming and when the first one lands.
  The briefing never carries your email address, your IP address or anything you wrote in chat.
• Stripe — if you buy a pack in the Shop, the payment happens on a page run by Stripe, our payment processor, and only if you choose to open it. Your card details are typed there and never reach us: what comes back to our server is that a payment of a given amount succeeded, was cancelled or was refunded, together with Stripe's own identifiers for it. We keep a record of each purchase (which amount, when) next to your account, and keep it after the account is deleted, because it is an accounting record. Stripe's handling of what you type on its page is described in Stripe's privacy policy. In the mobile app there is no store.
• Apple Push Notification service — if you turn notifications on in the iPhone app, every notification reaches your phone through Apple's service. Apple receives its title and text as they are written, not encrypted by us, together with the address it gave your phone, the time it was sent, and until when to keep trying if your phone is off (for an incoming attack, the moment the fleet lands). With them go a few labels, which tell the app which screen to open and let a newer notification replace an older one. They say the kind of notification and, for most kinds, what it is about: for an incoming attack or a battle report, the coordinates of your own colony; for the others, an identifier of ours for the mission, bulletin, season, Marshal window or guild it concerns. What each notification says:
  • an incoming attack: the name of your colony that is targeted and roughly when the fleet arrives, and, if the game has identified who sent it, that player's commander name (marked as such if it is an AI empire);
  • a battle report: the name of your colony that was attacked, and nothing about who attacked it or how it went;
  • an interception that will miss: the coordinates, sector and system, that your own fleet was sent to;
  • a relief flying to the target of your attack: that target's coordinates, how many fleets, roughly when the first lands, and how long you can still recall yours;
  • a bounty hunt closed while your fleet is on its way: that target's coordinates, and how long you can still recall your fleet;
  • a contested world your guild lost: the world's name, and the commander name of the player who took it or broke its garrison (marked as such if it is an AI empire), with their guild's tag and name;
  • your first convoy docking: the name of your colony;
  • a Crucible Monday prize you won: your place, the week, the resources credited and the name of your colony that received them;
  • the Marshal's windows and the last two weeks of a season: the same news for everybody, about no player;
  • a bulletin or a personal message from us: its title and the start of its text, as we wrote them.
  No notification carries your email address, your account identifier, your IP address or anything a player wrote in chat.
• Your browser's push service — if you turn notifications on in a browser, every notification goes through the push service your browser uses, run by a company your browser chooses, not us. The notification — the same text and labels as above — is encrypted for your browser before it leaves our server, so that service cannot read it. What it does see is that a notification from us is on its way to the address it gave your browser, when, its size, and how long to hold it if your browser is offline. The Android app receives no notifications, so neither of these two applies to it.

That is the whole list: no advertising networks, no analytics company, and nothing here is used to build a profile of you or to follow you to another site. The two AI services above, and the model providers OpenRouter passes requests on to, see the text, names, game facts and identifiers listed with each use, and nothing else about you; the payment processor sees what you type on its page, and nothing else about your game; Apple's notification service sees the notifications listed with it, and a browser's push service only what is listed with it, and neither sees anything else about you.

Where it lives, and for how long

Your account and game data sit in the game's own database on a server we run ourselves. It is kept while your account exists. Ask us to delete it and we will delete the account and its game data; public chat messages you have already sent may remain in the conversation history, since removing them would tear holes in other people's conversations. The visit counts sit on a second server of ours, in Finland, and are not tied to your account: once that day's key is gone there is nothing in them left to point at you — and so nothing for a deletion request to reach.

Children

The game has open chat between players, so it is not intended for children under 13.

Your choices

• Play as a guest and give us no email at all.
• Block anyone you do not want to read. It is immediate, one-directional, and the other person is not told.
• Report a message that breaks the rules. A human reads reports; nothing is deleted automatically by report count.
• Ask for your account and data to be deleted.
• Say do not count my visits — one button, works in every browser, and after that the counter is not even downloaded, and the landing page no longer notes which of our ads brought you. “Do Not Track” or Global Privacy Control, if your browser has them, do the same thing. Nothing in the game depends on any of it, so nothing breaks either way.