Privacy Policy
Last updated 8 August 2026
The short version: ITWars stores what it needs to run your account and show your progress. There is no advertising, no analytics SDK, and nothing is sold.
1. What we collect
| Data | Why |
|---|---|
| Username | Identifies your account and appears on leaderboards and profiles. |
| Email address | Required to create an account, and confirmed with a one-time code. Used to sign in, to reset your password, for receipts, and for security notices such as a password change. It is never shown on your profile, never shown to other players, and we do not send marketing. |
| Billing email | Optional and separate. Only set if you ask for receipts to go somewhere other than your account address. |
| Payment records | The reference, amount, currency, status and date of each order. Card numbers never reach ITWars at all — the card is entered on your bank's own payment page, not ours. |
| Password | Stored only as a salted scrypt hash. We never see the original. |
| Study activity | Answers, lab attempts, exam results, streaks. This is what produces your readiness score and statistics. |
| Profile picture | Optional. Resized in your browser and stored inline with your account. |
| Preferences | Theme, daily goal, exam date. |
| Session records | Browser, operating system and IP address for each signed-in device, so you can review and end sessions yourself. |
| IP address | Recorded when you create your account and when you sign in. Used for abuse prevention and to derive your country (see below). |
| Country | Derived once from your IP address so we can see, in aggregate, which countries our users are in. Country only — we do not store or derive your city, region, ISP, or coordinates. |
| Friends and challenges | Who you are connected to, so the social features work. |
2. How country detection works
When you sign up, your IP address is sent once to a geolocation lookup service, which returns a country. We request the country field and nothing else, we store only the two-letter country code and country name against your account, and the lookup is not repeated afterwards. If it fails or you are on a private network, your country is simply left blank — nothing about your account depends on it.
This exists so we can answer one question: which countries are our users in. It is never used to target, restrict, or price anything, and the per-account value is visible only to administrators.
3. What we do not collect
We never receive your card details. Payment is taken on your bank's own secure page; ITWars only learns that an order succeeded or failed. There are no third-party analytics, no advertising trackers, no fingerprinting, and no cross-site tracking. We do not sell or rent personal data to anyone, for any purpose. We do not derive your city, precise location, or internet provider from your IP address, and we do not send marketing email.
3a. Email verification
Creating an account, resetting a password and changing your email address each require a six-digit code sent to the address in question. Those codes are stored hashed, expire after ten minutes, and are deleted within seven days. We keep a record of the messages we sent you — recipient, subject and date — for thirty days, so a “I never received it” report can actually be investigated.
Verification exists for one reason: without a confirmed address there is no way to give you your account back if you forget your password.
4. Cookies
ITWars sets one session cookie so you stay signed in (and a second, separate one for the administration panel). They are strictly necessary, httpOnly, and carry no tracking identifier. There are no advertising or analytics cookies, which is why you are not being shown a consent banner.
5. What other people can see
Your username, avatar, XP, level, streak, arena rating and per-domain accuracy are visible on your public profile and on leaderboards to other signed-in users. Your email is not collected, your password is never visible, and your session and device list is visible only to you.
6. How long we keep it
Account and progress data is kept while your account exists. Sessions expire after 30 days of inactivity and expired ones are deleted automatically. Administrative actions are kept in an audit log for accountability.
7. Your rights
You can change your username, password, avatar and preferences at any time in Settings, and end any session on any device. To request a copy of your data or its deletion, email us and we will action it. You can also delete your account yourself at any time from Settings → Delete account, which removes your username, email address, password, profile picture, preferences, friendships and notifications immediately. Matches you have already played stay in your opponents' history as an unnamed player, because deleting those would rewrite someone else's record.
8. Security
Passwords are hashed with scrypt and a per-user salt. Session identifiers are random and are never displayed in the interface. Cookies are marked secure in production. No system is perfectly secure; if we become aware of a breach affecting you, we will tell you.
9. Children
ITWars is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.
10. Changes
If this policy changes in a way that affects what we collect or why, we will say so in the product before the change takes effect.
11. Contact
Privacy questions or data requests: itwars.contact@gmail.com