Idle Legions — Privacy Policy

Last updated: October 5, 2026

This policy explains what data Idle Legions ("the Game") processes, why, how long we keep it and what you can do about it.

Data controller: Alpaca Team, Spain
Privacy contact: soporte@idlelegions.com

1. What data we process

We only process what the Game needs to work and to protect itself.

SteamID (the public number of your Steam account)
Where it comes from: Steam, when you enter the Game
Why: To identify your account and log you in. We never see your Steam password.
Account name
Where it comes from: Created automatically when you first log in (by default "steam_" followed by 8 random digits)
Why: To identify your account inside the Game; other players use it to whisper to you, send you a friend request or invite you to a guild.
Commander name
Where it comes from: You choose it
Why: Shown to other players (chat, rankings, guild, auction house, PvP, World Boss).
Game save (heroes, items, gold, progress, game settings stored on the server)
Where it comes from: Generated while you play
Why: To save your game on our server.
Session key
Where it comes from: Created by our server
Why: To keep you logged in. It expires after 30 days and is renewed every 24 hours.
DLC you own
Where it comes from: Steam (Steamworks Web API)
Why: To give you the content you bought.
This Game's items in your Steam inventory, and a record of sends and collections
Where it comes from: Steam and our server
Why: To send items to Steam, collect them and solve problems.
Achievements
Where it comes from: Generated while you play
Why: To report the achievements you unlock to Steam.
Social and multiplayer activity: friends and their online status, guild (rank, weekly activity, donations, last seen), guild hero lending, auction listings and sales, mailbox, PvP fights and replays, PvP defence team, World Boss damage, Abyss rankings
Where it comes from: Generated while you play
Why: To run those features and show rankings.
Chat messages
Where it comes from: You write them
Why: To show them to the right people and keep a short history (see section 4).
Technical and security data: IP address, connection and disconnection times, login attempts, rejected messages, signs of cheating, sanctions and records of in-game operations (auction house, PvP, Steam)
Where it comes from: Automatically, when you connect and play
Why: To protect the server, prevent cheating, fraud and abuse, handle appeals and fix bugs.
What you write to us (email, Discord)
Where it comes from: You
Why: To answer you.

We do not process your real name, your email address (unless you write to us), your payment details or your precise location. Purchases are handled entirely by Steam (Valve) and we never receive your card or payment information. We do not read your Steam profile name or your Steam friends list either.

On your computer, the Game stores only locally your settings, the session key, some interface preferences, any screenshots you take and the technical logs of the game engine. Those files are not sent to us.

The Game does not use advertising, tracking cookies or third-party analytics. Neither do our legal web pages.

2. Legal bases (GDPR)

Performance of a contract (Art. 6(1)(b) GDPR): creating and keeping your account, saving your game, giving you what you bought, the online features (chat, guilds, friends, auction house, PvP, World Boss, Abyss, rankings), sending and collecting Steam items, and achievements.
Legitimate interest (Art. 6(1)(f) GDPR): security logs, the anti-cheat system, sanctions, preventing fraud and abuse, backups and fixing bugs. Our interest is keeping the Game safe and fair for everyone. You can object (section 6).
Legal obligation (Art. 6(1)(c) GDPR): when the law requires us to keep or disclose information, or to handle notices about illegal content.

We do not use your data for advertising or to send you marketing.

3. Automated decisions

The server's anti-cheat system can apply measures automatically when it detects impossible or clearly automated actions: a warning, a disconnection, temporary suspensions (for example 1 hour and 24 hours) and, if offences are repeated, a permanent suspension of the account. Offences are forgotten after 7 days without a new one. Actions that can happen during normal play are only rejected and do not count as an offence.

You have the right to have a person review any automated measure, to give your point of view and to contest it. Write to soporte@idlelegions.com.

4. How long we keep data

Account and game save
Period: While your account exists. If you ask us to delete it, we delete it within 30 days at the latest.
Session key
Period: 30 days at most; deleted when it expires or when you log out.
General chat of each channel
Period: Only the last 200 lines of each channel are kept; older lines are deleted automatically as new ones arrive.
Whispers and conversations with friends
Period: Only the last 200 messages of each pair of players are kept so you can see the history; older ones are deleted automatically. They are also deleted when the account is deleted.
Guild chat
Period: Delivered to online members and not stored in our database.
Guild message
Period: Until it is changed or the guild is disbanded.
Security log (includes IP address)
Period: 30 days; then deleted.
IP connection blocks
Period: While the block lasts; automatic ones, 7 days at most.
Operations log (auction house, PvP, anti-cheat checks and sanctions)
Period: 12 months, unless we need it longer for a specific case of cheating, fraud or an appeal.
Record of Steam item sends and collections
Period: 24 months, to be able to solve problems and fraud.
Public rankings and records (for example "first to achieve…")
Period: While the Game exists; when you delete your account your name is removed or anonymised.
Backups
Period: Deleted after 30 days at most. What you delete may remain in a backup until it expires.
Support emails and messages
Period: 12 months after the request is closed.

5. Who can see your data

Other players can see your commander name, your account name, your public profile (your combat team with its levels, stats and equipped items), your ranking positions, your guild, your auction listings, your PvP defence team, the replays you share and the messages you send to general chat. Your friends can see whether you are online. Your guild mates can see your rank, activity, donations and last connection. Your private save (gold, backpack, shop) is not shown.
Valve / Steam: the Game uses Steam to identify you, check your DLC, manage this Game's items in your Steam inventory and record your achievements. To do so we send Steam your SteamID and the details of each operation. Valve processes that data as an independent controller under its own policy: https://store.steampowered.com/privacy_agreement/
Hosting provider: our servers and backups are hosted by OVH SAS in France (European Union). OVH stores the data on our behalf and cannot use it for its own purposes.
Discord: if you join our community, Discord processes your data under its own policy.
Authorities, only when the law requires it.

We do not sell your data and we do not share it for advertising.

6. Your rights

You can:

Access the data we hold about you.
Correct it if it is wrong.
Delete your account and data.
Object to processing based on legitimate interest, or ask us to restrict it.
Receive a copy of your data in a commonly used format (portability).
Ask for a person to review an automated decision (section 3).
Complain to a data protection authority. In Spain this is the Agencia Española de Protección de Datos (https://www.aepd.es).

To exercise them, write to soporte@idlelegions.com from any address and include your SteamID or in-game name. To check that the account is yours, we may ask you to type a code in the in-game chat. We answer within one month; for complex requests this may be extended by two more months and we will tell you.

Deleting your account permanently removes your progress and the Game content linked to it. DLC stays in your Steam library and items already in your Steam inventory stay there, but your Game progress is lost. In records that also concern other players (for example, a PvP fight against you) your name is removed or anonymised.

7. Children

The Game is not directed at children under 14. We do not knowingly process data of children below that age or, if higher, below the age of digital consent in their country (in the European Union, between 13 and 16 depending on the country). Players under 18 need the permission of a parent or legal guardian to play. If you believe a child has created an account, contact us and we will delete it.

8. Security

Connections to our server are encrypted (TLS). Session keys are random, expire and are renewed; logs never store passwords, session keys or Steam tickets. The database can only be reached from the server itself and access to the server is restricted. No system is perfect, but we take reasonable measures to protect your data and, in the event of a serious data breach, we will notify the authority and the people affected when the law requires it.

9. International transfers

Our servers are in the European Union. When the Game communicates with Steam, Valve may process data outside the European Economic Area; those transfers take place with the safeguards required by the GDPR (for example an adequacy decision or the European Commission's Standard Contractual Clauses).

10. Changes

We may update this policy. If the changes are important, we will announce them in the Game or on our Steam page before they apply. The date at the top shows the latest version.

11. Contact

Questions or requests: soporte@idlelegions.com
Community: https://discord.gg/FrQmjrU3vx