Privacy Policy

Last updated: 2026-09-06. The English version is the binding one. Operator: the account owner, reachable at [email protected] (legal entity to be published before public launch) (see the imprint at https://carbonui.app/imprint). Contact for anything about your data: [email protected].

1. What we store and why

Your sign-in. CARBON signs you in with Telegram. We store your Telegram user id and username, the chat id the bot talks to, and your language choice. Purpose: to know which dashboard is yours and to send you the alerts you switch on. Legal basis: the contract with you.

Your game accounts. To act for an account you add, CARBON stores the game login details you give it (e-mail and password or session material) and the game data it reads for that account: cities, resources, buildings, units, movements, messages and similar. Your login details are never shown to other customers and never shared with anyone. Passwords and session material are stored encrypted (AES-256-GCM) with a server-side key, and our off-site backups are themselves encrypted before they leave the server. Legal basis: the contract with you.

Orders. When you buy a plan we store the order (slots, term, add-ons, amount), the PayPal transaction id and the date. We never receive your card or bank details; PayPal handles the payment on its own pages under its own privacy policy. Legal basis: the contract, and the tax law that requires us to keep invoices.

Proxies. Every plan includes a proxy for each of your accounts; we store which IP is assigned to which of your accounts. Requests your accounts make to the game go through that IP.

Server logs. Our server keeps technical logs (IP address, time, request path, errors) for security and debugging. They are deleted after 30 days.

Learning data. CARBON's in-app learning agent ("CARBONATOR") learns game rules from what it observes. Facts about one account stay with that account. Only account-neutral game facts (for example how long a building takes at a given level) are kept as shared knowledge, with a count of how often they were observed, never with a customer or account name.

2. What we do not do

We do not sell or rent personal data. We do not show ads and do not use advertising or analytics trackers. We do not read your Telegram messages beyond the commands you send to our bot.

3. Who else processes data for us

We use a small number of service providers, each bound by contract to act only on our instructions: a hosting provider in the European Union for the servers, a network provider that sits in front of the servers for protection and delivery, a provider of IP addresses for the optional IP add-ons, and a storage provider in the European Union for encrypted backups. Two providers you interact with directly act under their own policies: PayPal (payments — we never see your card or bank details) and Telegram (sign-in and alerts). We will name any provider on request, and we will tell you before a new category of provider receives personal data.

4. Cookies

CARBON uses one cookie, the session cookie that keeps you signed in. It is HttpOnly, sent only over HTTPS and holds no personal data itself. Your browser also keeps your dashboard preferences (language, layout) in its local storage; nothing is sent to us from there.

5. How long we keep data

Game account data: until you delete the account from CARBON, and at most 90 days after your last paid term ends. Sign-in data: until you ask us to delete your CARBON account. Orders and invoices: as long as tax law requires. Logs: 30 days. Backups: encrypted, rotated within 90 days.

6. Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to its processing, and take it with you, by writing to [email protected]. We answer within 30 days. If you live in the EU/EEA or the UK you can also complain to your data protection authority.

7. Children

CARBON is for adults. We do not knowingly store data about anyone under 18; if you believe we do, write to [email protected] and we will delete it.

8. Changes

We announce changes to this policy on the dashboard and by Telegram at least 14 days before they take effect.