Privacy & Data Handling

CABAL Crimean Campaign · Last updated: 30 August 2026

CABAL's Crimean campaign is a free, browser-based historical simulation. There are no public player accounts. We collect as little about you as possible. This page explains, in plain terms, what reaches the services that host the game and what does not.

The short version

• No accounts, no sign-up, and no profiles for public play.
• We do not ask for, store, or sell your name, email, or contact details.
• No advertisers, no analytics companies, no data brokers, and no third-party trackers, advertising pixels, or analytics scripts in the public game.
• Your save games and settings stay in your own browser; they are not uploaded to us.
• One thing does reach our provider: your IP address. Like almost every website, the static host that serves the game receives it and may record it briefly at the infrastructure level for security. CABAL runs no application server of its own — the game runs entirely in your browser — so we operate no server that logs your IP. An IP address counts as personal data under UK and EU data protection law, which is why this page exists.

What we record, and why

Your IP address. To deliver the game, your browser connects to our static hosting provider, which necessarily receives your IP address (an IP address counts as personal data under UK and EU data protection law). CABAL runs no application server of its own: the game is served as static files and runs entirely in your browser, so we operate no server that records your IP in request logs. Our hosting provider (listed under "recipients" below) may record it transiently at the infrastructure level to operate and protect its service, under its own policy and retention period. Where an IP address is processed for security, the legal basis is the legitimate interest in the security and proper functioning of the service (GDPR Article 6(1)(f)).

Gameplay. The public game runs its simulation and AI advisors entirely inside your browser and does not send gameplay statistics to us.

Your browser's own storage. Save games, audio and performance preferences, tutorial progress, map calibration, and local AI model consent and preferences are stored on your device so the game works and remembers your choices. This is functional storage that you create by playing; it is not used for tracking. Nothing in this storage is sent to us.

Optional AI advisors

The public GitHub Pages build does not accept or store remote AI-provider API keys and does not send prompts directly from your browser to OpenAI, Anthropic, Google Gemini, OpenRouter, or another remote inference provider. CABAL uses deterministic heuristics by default. If you explicitly choose the WebGPU option, your browser downloads model files from the identified model host and runs the model on your device; your prompts remain in your browser. A separately built, self-hosted CABAL server may offer authenticated provider-backed inference with provider credentials held server-side. That deployment is not the public service described by this notice and needs its own deployment-specific privacy information.

Who your data reaches (recipients)

To deliver the game, your browser necessarily contacts:

• GitHub Pages (GitHub / Microsoft, United States) — serves the game's files. Your IP and request details reach GitHub whenever you load the page.
• An AI model host (Hugging Face / GitHub, United States) — only if you choose the in-browser "WebGPU (local)" AI option, your browser downloads the model files directly from the model host, which therefore receives your IP for that download. The model then runs entirely on your device; your prompts stay in your browser and are not sent to the host.

International transfers

The public CABAL deployment has no application backend. Loading the game sends your IP address and request details to GitHub Pages in the United States. If you explicitly choose WebGPU, downloading the model files also sends your IP address and request details to the identified model host in the United States. The model then runs on your device; your prompts are not sent to that host or to a remote inference provider. These contacts may involve transfers outside the UK or EU. The providers describe the safeguards for those transfers in their privacy documentation; contact us for further information.

Your choices and rights

Under the GDPR you may have the right to access, correct, or erase personal data we hold about you, to restrict or object to its processing, and to data portability. Because public play involves no account and we hold no name or email for you, in most cases we genuinely cannot identify you from the limited data we keep, and some rights apply only if you give us enough information to locate your records (GDPR Article 11). We do not operate request logs for the public service. Requests concerning hosting-layer records may need to be handled through GitHub's privacy process.

Who is responsible (data controller)

The controller for this service is Nell Watson / Creed Space. For any privacy matter, including to exercise your rights, contact nell@ethicsnet.com. CABAL is operated from the United Kingdom, so this service is provided under the UK GDPR (UK GDPR Article 3(1)); the EU GDPR may also apply to players in the EU, and where it does we may need to appoint an EU representative under Article 27.

Children

This game is not directed at children and we do not knowingly collect data from them.

Changes

We may update this notice; the date at the top shows the latest version.

Credits & attribution

The battlefield terrain is derived from the Copernicus GLO-30 Digital Elevation Model: © DLR e.V. 2010–2014 and © Airbus Defence and Space GmbH 2014–2018, provided under COPERNICUS by the European Union and ESA; all rights reserved. The game is built with open-source software (including three.js and React); full third-party notices ship with the project source.