Privacy & Data Handling

CABAL Crimean Campaign · Last updated: 2 June 2026

CABAL's Crimean campaign is a free, browser-based historical simulation. There are no public player accounts. We collect as little about you as possible. This page explains, in plain terms, what reaches the services that host the game and what does not.

The short version

• No accounts, no sign-up, and no profiles for public play.
• We do not ask for, store, or sell your name, email, or contact details.
• No advertisers, no analytics companies, no data brokers, and no third-party trackers, advertising pixels, or analytics scripts in the public game.
• Your save games and settings stay in your own browser; they are not uploaded to us.
• One thing does reach our provider: your IP address. Like almost every website, the static host that serves the game receives it and may record it briefly at the infrastructure level for security. CABAL runs no application server of its own — the game runs entirely in your browser — so we operate no server that logs your IP. An IP address counts as personal data under UK and EU data protection law, which is why this page exists.

What we record, and why

Your IP address. To deliver the game, your browser connects to our static hosting provider, which necessarily receives your IP address (an IP address counts as personal data under UK and EU data protection law). CABAL runs no application server of its own: the game is served as static files and runs entirely in your browser, so we operate no server that records your IP in request logs. Our hosting provider (listed under "recipients" below) may record it transiently at the infrastructure level to operate and protect its service, under its own policy and retention period. Where an IP address is processed for security, the legal basis is the legitimate interest in the security and proper functioning of the service (GDPR Article 6(1)(f)).

Gameplay. The public game runs its simulation and AI advisors entirely inside your browser and does not send gameplay statistics to us.

Your browser's own storage. Save games, audio and performance preferences, tutorial progress, map calibration, and (if you use it) your AI-provider settings are stored on your device so the game works and remembers your choices. This is functional storage that you create by playing; it is not used for tracking, so no cookie-consent banner is required for it. Nothing in this storage is sent to us.

Bring-your-own AI key

The AI advisors are optional. If you choose to enable them with your own provider API key, that key stays in your browser for the session only and is sent directly from your browser to the AI provider you choose (for example Google, OpenAI, Anthropic, or OpenRouter). It is never sent to, stored by, or seen by CABAL's servers, and closing the tab clears it. Your use of that provider is governed by the provider's own terms and privacy policy.

Who your data reaches (recipients)

To deliver the game, your browser necessarily contacts:

• GitHub Pages (GitHub / Microsoft, United States) — serves the game's files. Your IP and request details reach GitHub whenever you load the page.
• An AI provider you choose — only if you opt in to AI advice with your own API key, in which case your browser contacts that provider directly (see above).
• An AI model host (Hugging Face / GitHub, United States) — only if you choose the in-browser "WebGPU (local)" AI option, your browser downloads the model files directly from the model host, which therefore receives your IP for that download. The model then runs entirely on your device; your prompts stay in your browser and are not sent to the host.

International transfers

CABAL has no backend of its own. The providers your browser contacts — GitHub Pages, and any AI provider or model host you choose — are in the United States, so loading the game (and, for the AI features you opt into, your prompts or model-file downloads) transfers your IP address outside the EU/UK. International transfers like these are permitted under GDPR Chapter V (Articles 44–46) where appropriate safeguards are in place — such as EU–US Data Privacy Framework certification or Standard Contractual Clauses. We select providers with these transfer mechanisms in mind; for the specific safeguard relied on for a given provider, please contact us using the details below.

Your choices and rights

Under the GDPR you may have the right to access, correct, or erase personal data we hold about you, to restrict or object to its processing, and to data portability. Because public play involves no account and we hold no name or email for you, in most cases we genuinely cannot identify you from the limited data we keep, and some rights apply only if you give us enough information to locate your records (GDPR Article 11). You can object at any time to our IP-based security logging (GDPR Article 21).

Who is responsible (data controller)

The controller for this service is Nell Watson / Creed Space. For any privacy matter, including to exercise your rights, contact nell@ethicsnet.com. CABAL is operated from the United Kingdom, so this service is provided under the UK GDPR (UK GDPR Article 3(1)); the EU GDPR may also apply to players in the EU, and where it does we may need to appoint an EU representative under Article 27.

Children

This game is not directed at children and we do not knowingly collect data from them.

Changes

We may update this notice; the date at the top shows the latest version.

Credits & attribution

The battlefield terrain is derived from the Copernicus GLO-30 Digital Elevation Model: © DLR e.V. 2010–2014 and © Airbus Defence and Space GmbH 2014–2018, provided under COPERNICUS by the European Union and ESA; all rights reserved. The game is built with open-source software (including three.js and React); full third-party notices ship with the project source.