Privacy
This page explains what Diplomaps stores about you, what leaves your browser, and which third-party services are involved. In short: account and game data lives on the server, sessions are cookie-based, there is no analytics and no advertising, and the only third parties your browser talks to are the map-tile and flag-icon servers described below.
Data you give us
- Account — your username and a password hash (Argon2, one-way; the plaintext password is never stored or logged). Used only to log you in.
- Game state — the armies, city claims, targets and other actions you create while playing, so the round can resolve each tick.
Data we keep about your activity
- Last active — a timestamp of your most recent page view, shown as “last active” in player listings. It is written at most once a minute.
- Notification read state — which game events you have seen on the notifications page.
Cookies
Two cookies are used, both described in your browser’s cookie list:
| Cookie | Purpose | Lifetime |
|---|---|---|
diplomaps_session |
Logs you in. It holds a random token for your server-side session;
HttpOnly and SameSite=Lax. |
30 days |
diplomaps_csrf |
Protects the login, signup and action forms against cross-site
request forgery. Not HttpOnly, so the page’s own forms
can read it. |
1 hour |
There are no analytics, advertising or tracking cookies.
What your browser sends to third parties
-
Map tiles — the world and city maps fetch tiles from
server.arcgisonline.com(Esri). Each request sends your IP address and the tile coordinates you are viewing. Your account data is never included. -
Flag icons — the flag-glyph stylesheet is loaded from
flagcdn.io. This is a single stylesheet request; it sends your IP address but no account data. - No other requests. Leaflet itself is vendored and served from this site, as are the country-flag SVG sprites, so those never contact a third party.
What leaves this site
- Your username and password travel to this site’s server, over HTTPS in production.
- The world map is public: anyone can view city ownership for the current round without logging in.
- Your data is not sold, rented, or shared beyond the third-party services listed above.
Removal
Rounds are reset between games, which deletes the finished round’s armies, claims and notifications from the database. To delete your account, or for any privacy question, contact JMFT (jmft.dev).