Privacy Policy

Last updated: 23 October 2026

Map & Might is a grand strategy game played in the browser at mapandmight.com. You can play without an account. This page explains what we store if you do create one, and what stays only in your browser.

Playing without an account

Saved games, settings and your career statistics are kept in your browser's local storage on your device. They are not sent to us. Clearing your browser data removes them.

What an account stores

• Username and email address. The username is your public name in the game. The email is used to sign in and, in the future, to reach you about your account.
• A password check value. Your password is never sent to us. Your browser turns it into a derived key, and we store only a keyed hash of that key.
• If you sign in with Google: your Google account ID, name, email address and profile picture link. We ask Google only for basic profile information (openid, email, profile). We do not get access to your Google Drive, contacts, Gmail or anything else.
• Profile choices: the flag you pick as your picture.
• Career statistics: totals such as weeks played, wars won and nations played, so they follow you across devices.
• Signed-in devices: for each session, when it started and a short device label (for example "Chrome on macOS"), so you can see and sign out your devices.
• Plan: whether your account is free or premium and until when.
• Dates: when the account was created and, at most once a day, when it was last used.

Cookies

We use one cookie to keep you signed in (mer_sess, 30 days) and, only during Google sign-in, a short-lived cookie that protects the sign-in from forgery (10 minutes). Both are strictly necessary. We use no advertising or tracking cookies and no analytics.

Services we rely on

• Cloudflare hosts the game and the account database. Cloudflare processes your IP address to deliver the site, to rate-limit requests against abuse, and for Turnstile, a bot check on sign-up. Request logs are kept for a few days for debugging. See Cloudflare's privacy policy.
• Google, only if you choose "Continue with Google". See Google's privacy policy.
• If paid plans are offered, payments will be handled by a payment provider. We will never see or store your card details, and this page will be updated before that starts.

What we do not do

We do not sell or rent your data, show ads, or share your data with anyone except the services above, as needed to run the game, or when required by law.

Use of Google user data

Information received from Google is used only to create and sign in to your Map & Might account and to show your name and picture in the game. Map & Might's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Keeping and deleting your data

Your account data is kept until you delete the account. You can delete it at any time in the game under Account → Security → Delete account. This removes your account and all its sessions from our database immediately. Sessions also expire on their own after 30 days. You can ask us for a copy of your data, a correction, or deletion by email.

Security

Connections are encrypted (HTTPS), session tokens are stored only as hashes, and sign-in attempts are rate-limited. No system is perfectly secure, but we keep what we store to the minimum the game needs.

Children

Map & Might is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

Changes

If this policy changes, we will update this page and the date at the top.

Contact

Questions or requests: ogzhansari@gmail.com