Privacy & Data Handling

CABAL Crimean Campaign · Last updated: 2 June 2026

CABAL's Crimean campaign is a free, browser-based historical simulation. There are no public player accounts. We collect as little about you as possible. This page explains, in plain terms, what reaches our servers and what does not.

The short version

• No accounts, no sign-up, and no profiles for public play.
• We do not ask for, store, or sell your name, email, or contact details.
• No advertisers, no analytics companies, no data brokers, and no third-party trackers, advertising pixels, or analytics scripts in the public game.
• Your save games and settings stay in your own browser; they are not uploaded to us.
• One thing does reach our providers: your IP address. Like almost every website, the services that host and run the game receive it and may record it briefly at the infrastructure level for security. Our own application keeps it out of its routine logs (it may appear only in occasional security records, such as a rate-limit warning). An IP address counts as personal data under UK and EU data protection law, which is why this page exists.

What we record, and why

Your IP address. To deliver the game, your browser connects to our hosting and backend providers, which necessarily receive your IP address (an IP address counts as personal data under UK and EU data protection law). Our own application is configured not to record your IP address in its routine request logs; it may appear only in occasional security records (for example, a rate-limit warning when too many sessions come from one address). Our hosting and edge providers (listed under "recipients" below) may record it transiently at the infrastructure level to operate and protect their services, under their own policies and retention periods. Where we process an IP address for security, the legal basis is our legitimate interest in the security and proper functioning of the service (GDPR Article 6(1)(f)).

Gameplay. The public game runs its simulation and AI advisors entirely inside your browser and does not send gameplay statistics to us.

Your browser's own storage. Save games, audio and performance preferences, tutorial progress, map calibration, and (if you use it) your AI-provider settings are stored on your device so the game works and remembers your choices. This is functional storage that you create by playing; it is not used for tracking, so no cookie-consent banner is required for it. Nothing in this storage is sent to us.

Bring-your-own AI key

The AI advisors are optional. If you choose to enable them with your own provider API key, that key stays in your browser for the session only and is sent directly from your browser to the AI provider you choose (for example Google, OpenAI, Anthropic, or OpenRouter). It is never sent to, stored by, or seen by CABAL's servers, and closing the tab clears it. Your use of that provider is governed by the provider's own terms and privacy policy.

Who your data reaches (recipients)

To deliver the game, your browser necessarily contacts:

• GitHub Pages (GitHub / Microsoft, United States) — serves the game's files. Your IP and request details reach GitHub whenever you load the page.
• Render (Germany, EU) — our backend host. Your IP reaches Render when the app contacts the backend.
• An AI provider you choose — only if you opt in to AI advice with your own API key, in which case your browser contacts that provider directly (see above).
• An AI model host (Hugging Face / GitHub, United States) — only if you choose the in-browser "WebGPU (local)" AI option, your browser downloads the model files directly from the model host, which therefore receives your IP for that download. The model then runs entirely on your device; your prompts stay in your browser and are not sent to the host.

International transfers

Our backend host (Render) is in the EU (Frankfurt, Germany), so routine backend calls stay within the EU/UK. Some other providers are in the United States — GitHub Pages, and any AI provider or model host you choose — so those features transfer your IP address (and, for the AI features you choose, your prompts or model-file downloads) outside the EU/UK. International transfers like these are permitted under GDPR Chapter V (Articles 44–46) where appropriate safeguards are in place — such as EU–US Data Privacy Framework certification or Standard Contractual Clauses. We select providers with these transfer mechanisms in mind; for the specific safeguard relied on for a given provider, please contact us using the details below.

Your choices and rights

Under the GDPR you may have the right to access, correct, or erase personal data we hold about you, to restrict or object to its processing, and to data portability. Because public play involves no account and we hold no name or email for you, in most cases we genuinely cannot identify you from the limited data we keep, and some rights apply only if you give us enough information to locate your records (GDPR Article 11). You can object at any time to our IP-based security logging (GDPR Article 21).

Who is responsible (data controller)

The controller for this service is Nell Watson / Creed Space. For any privacy matter, including to exercise your rights, contact nell@ethicsnet.com. CABAL is operated from the United Kingdom, so this service is provided under the UK GDPR (UK GDPR Article 3(1)); the EU GDPR may also apply to players in the EU, and where it does we may need to appoint an EU representative under Article 27.

Children

This game is not directed at children and we do not knowingly collect data from them.

Changes

We may update this notice; the date at the top shows the latest version.

Credits & attribution

The battlefield terrain is derived from the Copernicus GLO-30 Digital Elevation Model: © DLR e.V. 2010–2014 and © Airbus Defence and Space GmbH 2014–2018, provided under COPERNICUS by the European Union and ESA; all rights reserved. The game is built with open-source software (including three.js and React); full third-party notices ship with the project source.