Privacy and cookies
City Architect is a city-building game you play in your browser. This page explains what data the game uses, why, how long it is kept, and what you can do about it. Last updated 16 October 2026.
Who is responsible
Ticsie AB, Sweden, is responsible for the personal data described here (the "controller" under the EU General Data Protection Regulation, GDPR). For questions or to use your rights, email wilmer@ticsie.se.
What we collect, and why
| What | Why | Legal basis | How long |
|---|---|---|---|
| Your account: name, email address and password (stored only as a secure hash) | To let you sign in and keep your cities in your account | Contract (GDPR art. 6.1 b) | Until you delete your account |
| Cities you save to your account, with a small picture of each | So you can load them in any browser | Contract (art. 6.1 b) | Until you delete them or your account |
| Password reset: a one-time link sent to your email address | To let you choose a new password | Contract (art. 6.1 b) | The link stops working after 60 minutes |
| Statistics, if you allow them: a random id kept in your browser, when you visit and how long you actively play, linked to your account if you are signed in | To see how much the game is played and improve it | Your consent (art. 6.1 a), which you can withdraw at any time | 24 months, or until you withdraw your consent: that deletes them |
| Anonymous visit counts, if you do not allow statistics: the time of a visit and how long it lasted, with no id kept and no link to you or your account | To count visits | Not personal data | 24 months |
| Your session: while you play, the server keeps your session with your network (IP) address and your browser's name, and whether you are signed in | To keep you signed in, and to spot misuse of an account | Contract (art. 6.1 b) and legitimate interest (art. 6.1 f) | Deleted 2 hours after your last visit |
| Security: failed sign-in attempts are counted per email address and network address (stored scrambled, not readable) for one minute, to stop password guessing; how often forms are sent is counted per network address for a minute, to stop floods; new accounts are counted per network address (stored scrambled) for an hour, to stop robots signing up in bulk; the web server may log network addresses to keep the site safe | To protect your account and the site | Legitimate interest (art. 6.1 f) | One minute for the counts (an hour for new accounts); server logs only as long as needed for security, at most 30 days |
We do not show ads, sell data, or use outside analytics or tracking. The game's fonts and code are served from this site, so your browser does not contact Google or other third parties when you play.
Cookies and browser storage
The game stores the following on your device. Only the statistics id needs your permission; everything else is needed for the game to work.
| Name | Kind | What it does | How long |
|---|---|---|---|
city-architect-session | Cookie, necessary | Keeps your session (and you signed in) while you play | 2 hours after your last visit |
XSRF-TOKEN | Cookie, necessary | Protects forms against forged requests | 2 hours |
remember_web_… | Cookie, necessary | Keeps you signed in, only if you tick "Remember me" | 400 days, or until you log out |
cityArchitect | Browser database (IndexedDB), necessary | Your saved cities when you play without an account | Until you delete them |
cityArchitect.options, cityArchitect.maps | Browser storage, necessary | Your settings and the maps you made in the map editor | Until you clear them |
cityArchitect.consent | Browser storage, necessary | Remembers your choice about statistics, so we don't ask every time | Until you clear it |
cityArchitect.visitor | Browser storage, statistics (only with your consent) | A random id that tells your visits apart | Until you withdraw consent (which deletes it and what it recorded) or clear it |
Your choice about statistics
You have not chosen yet.
Who else receives data
We share data only with the services that run the game for us, under data processing agreements that let them use it only on our behalf:
- Hosting: Inleed, Sweden, which stores the game's database and runs the website.
- Email: none for now, which sends password reset emails.
If a provider is outside the EU/EEA, the transfer is protected by the EU's standard contractual clauses or an adequacy decision, as named above.
Your rights
You have the right to see the data we hold about you, have it corrected, have it deleted, limit or object to how we use it, get it in a format you can take elsewhere, and withdraw your consent at any time without affecting what happened before. You can do most of it yourself:
- Your account page: change your name or email, download all your data, or delete your account and everything in it.
- The buttons above: change your choice about statistics, or delete the statistics about this browser. Cookie settings on the game's main menu changes the choice too, and turning statistics off there also deletes them.
- Anything else: email us, and we answer within one month.
If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se).
Children
If you are under 13, ask a parent or guardian before you create an account or allow statistics.
Changes
If we change how we use data, we update this page and the date at the top. If a change needs your consent, we ask again.