Privacy Policy

Updated: October 18, 2026

1. Who we are

Stormfall Bot (stormbalur.xyz) is an unofficial helper service for the game Stormfall: Rise of Balur. It is run by the project administrator, a private individual based in Ukraine, who is also responsible for your data. Contact: Telegram @yur_yak, email mesnik2001@gmail.com.

2. What data we keep and why

• Google account: name, email, profile picture and Google account ID — so you can sign in and we recognize you next time.
• Site settings: language, which announcements you've read, and messages about your tickets (added, declined, removed).
• Castle: name, game world, game account number, character name, bot type and settings — so the bot can run your castle.
• Game access: your Plarium ID email and the sign-⁠in data the game issues. Kept securely and used only to run the bot. We don't store your Plarium ID password.
• What the bot sees in the game: your castle's resources, units, buildings and events — the bot plays by them, and you see them as the summary and log.
• Sign-⁠in and visit log: time, sign-⁠in result, email and IP address — for security.
• Tickets and payments: balance and remainder, ticket history, orders, received payments (amount, time, order code), “I've paid” requests (amount and time as you entered them) and when you opened the bank's payment page — we use it to find your payment if the order code in the comment got lost. We don't have the payer's name or card details.
• Support messages are kept in the administrator's Telegram and email.

Legal basis: we need this data to provide the service you ask for and to protect the site and people's accounts.

3. How long we keep it

• Sign-⁠in and visit log with IP addresses — up to 90 days.
• Messages about tickets — 60 days.
• When you opened the payment page — 31 days.
• Payment records — while the service operates.
• Everything else — while you have an account (castle data — while the castle is connected).

4. Who we share it with

We don't sell data or share it for advertising. Data only goes to those the service can't work without:

• Google — for signing in;
• the game's servers (Plarium) — so the bot can play on your behalf; when you connect a castle, the game receives your Plarium ID email and password once;
• the bank — when you pay: you enter your card details on the bank's page, and we never see them. As with any transfer, the bank may show the recipient the payer's name — we don't record it;
• technical contractors — the hosting provider where the site and bots run.

Otherwise, we disclose data only when lawfully required by the authorities.

5. How we protect data

We keep data secure and give access only to those who need it to run the service. Everyone sees only their own castles. Only the administrator sees people's data (directly or through service tools, including an AI assistant that helps run the project), and only when needed to run the service, for support or for security. If something happens to your data, we'll announce it on the site.

6. Cookies

The site sets one technical cookie: it remembers that you're signed in and your site language. Your browser may also remember a few interface settings — they stay in your browser. There are no advertising, analytics or third-⁠party cookies.

7. How to delete your data

• One castle — “Delete castle” in My castles.
• Everything at once — “Delete my account” on the My castles page: your account, castles and their data are deleted.

After deletion, only the “trial week already used” and “ban” (if any) marks remain, plus an “account deleted” mark for 30 days — without your email or name, so the rules still apply if the same account or castle comes back — plus payment records without your email or name. Deleted data disappears from logs within 90 days and from backups within 30 days.

You can also write to us to find out what data we hold about you, get a copy, correct it or delete it — we'll reply within 30 days. If you believe we're violating your rights, you can complain to the data protection authority in your country.

8. Changes

If this policy changes, we'll update the date at the top and announce important changes on the site in advance. If we ever want to receive anything from Google beyond what's listed here, we'll ask for your consent first.

9. How the site uses data from Google

When you sign in with Google, the site receives only your name, email, profile picture and Google account ID. We use them only for sign-⁠in: to recognize you and show your name and picture — and your email also to find your account when you contact support. The site gets no access to your emails, files, contacts or other Google account data, and changes nothing in your account. We don't sell this data, don't use it for advertising and don't share it with others, except the technical contractors the site can't run without (section 4) and when the authorities lawfully require it. We keep it while you have an account (in the sign-⁠in log — up to 90 days); “Delete my account” erases it. Our use of information received from Google complies with the Google API Services User Data Policy.