Privacy and cookie policy

Last updated: 15 September 2026

This policy describes how Fieldcraft Games, the developer and publisher of Field of Command, handles personal data across fieldofcommand.com, the browser preview and related game services. Account creation and sign-in happen on the play host. Marketing pages do not load the account provider.

1. Controller

Fieldcraft Games is the data controller. For any data-protection query: support@fieldcraftgames.com.

2. Legal basis

• Contract: to run your account and in-game progression.
• Consent: for marketing email and optional website analytics. You can withdraw at any time.
• Consent: for bug reports and the diagnostic attachments you select.
• Legitimate interests: for abuse prevention, anti-cheat, service security and aggregated service measurements.

3. What we collect

Playing without an account

• A random anonymous identifier (UUID) generated in your browser.
• A commander username you choose for dispatches and matchmaking.
• In-game progression: XP, unlocks, loadout, completed maps, skill rating.
• Match records: outcomes, duration, faction, timestamps.

Creating an account

• Your email address and a hashed password, handled by our authentication provider, Clerk, on the play host.
• A Clerk user ID, stored on your player row to link the account to your progression.
• A marketing consent flag, set only if you tick the opt-in box. Timestamped; defaults to off.

Site & infrastructure

• IP addresses, held briefly for rate limiting (up to one hour).
• The Dunkirk campaign page loads fonts from Google Fonts. Google receives the normal connection details needed to provide those font files.
• Google Analytics 4, only after you accept optional analytics. It records page views and clicks on the Steam prompt, preview and external links, including link labels and destinations. Preview clicks also carry a limited referral label. Google says it uses IP addresses temporarily for routing and coarse location, then discards them before logging.
• Microsoft Clarity, only after you accept optional analytics. It records page structure and interactions such as clicks and scrolling. Input fields are masked by default; other page text follows the masking mode configured for the project.
• If you accept optional analytics and follow a tagged link to the browser preview, we pass a limited source label and campaign tags with that link. The source label stays in session storage for the current tab and is not used as an account identifier. Visitors who decline can still play the preview, without these attribution tags.
• If you decline, we record a rejection event to count these choices. It contains a SHA-256 hash of the request IP address, your browser's user agent, and the time, and is kept for 90 days. No analytics cookies are set.

Bug reports

• The category, title and description you enter.
• Game version, build target, browser or desktop platform, GPU, viewport, language, timezone and the game screen or battle context.
• Recent technical errors and a short, redacted log. Tokens, secret query values and email-like text are removed before upload.
• Client-reported player, account, career, posting and session identifiers when available. These are diagnostic hints and are not used to access your account automatically.
• An optional screenshot and an optional current campaign save or single-player battle snapshot, only when you leave those boxes selected and confirm the report.

Technical logs and saves are stored privately. Screenshot links use a long random address, but anyone who receives that address can view the screenshot until it is deleted.

We do not collect real names, addresses, phone numbers, or payment information.

4. How we use it

• Authenticate your account, save progression, and run matchmaking.
• Reconnect you to matches, detect forfeits, and prevent cheating.
• Send marketing email only if you have opted in. Every such email carries a one-click unsubscribe link.
• Aggregate analytics to improve the game and site.
• Investigate, reproduce and fix problems that players choose to report.

We do not sell, rent, or trade personal data. Signing up for an account is not consent to marketing; the two are separate choices.

5. Retention

• Account email and profile: kept while your account is active. On deletion, removed within 30 days.
• Anonymous progression (no account): retained while the UUID is active. Purged after 12 months of inactivity.
• Match records: retained for 12 months, then purged or anonymised.
• Marketing consent changes: timestamps retained for the life of the account to evidence compliance.
• IP addresses: up to one hour.
• Google Analytics: event-level data retention follows the GA4 property setting, which allows 2 or 14 months.
• Microsoft Clarity: playback data is retained for 30 days; click and heatmap data for up to 9 months. Labeled or favorited sessions can remain for up to 9 months.
• Cookie rejection events: 90 days.
• Bug-report screenshots, logs and saves: 90 days.

6. Processors

• Cloudflare: hosts the site and game backend (Pages, Workers, D1) and may provide cookie-free aggregate traffic and performance measurements. Policy
• Clerk: authentication provider for accounts on the play host. Marketing pages do not load Clerk. Policy
• Google: Google Fonts on the Dunkirk page and Google Analytics 4 after you accept optional analytics. Policy
• Microsoft: Clarity session analysis on the marketing site, loaded only after you accept optional analytics. Policy
• GitHub: stores the readable bug-report summary in our private project repository. Full logs and saves are not copied there. Policy

These processors may transfer data to the US under UK ICO-approved Standard Contractual Clauses.

7. Cookies and browser storage

Google Analytics and Microsoft Clarity load only after you accept optional analytics. Declining keeps the preview available and prevents attribution tags from being added to its link. You can change your choice at any time using Cookie settings in the site footer. Rejecting stops further analytics and removes first-party analytics cookies accessible to this site.

8. Your rights

Under UK GDPR you can request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You can also withdraw any consent you have given.

To exercise a right: email support@fieldcraftgames.com. We respond within 30 days.

For a bug report: include the report number shown after submission so we can locate its summary and diagnostic attachments.

To unsubscribe from marketing: click the unsubscribe link in any email, or toggle the switch on the Commander Profile panel in-game.

To delete your account: open the profile panel in-game and use the "Manage account" link on the play host. Your Clerk account is removed and unlinked from your player row within 30 days.

9. Security

Traffic is encrypted with TLS. Passwords are hashed by Clerk; we never see plain text. Rate limiting, Cloudflare DDoS protection, and a web application firewall guard public endpoints. We do not store payment data.

10. Automated decisions

We do not carry out automated decision-making with legal or similarly significant effects. Rate limiting is the only automated control and does not fall within that definition.

11. Children

The game and site are not directed at children under 13. If you believe data from a child has been collected, contact us for deletion.

12. Changes

When this policy changes we update the date above. Continued use after a change indicates acceptance.

13. Complaints

You can lodge a complaint with the UK Information Commissioner's Office:

ico.org.uk/make-a-complaint · 0303 123 1113 · Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

14. Contact

support@fieldcraftgames.com

We aim to respond to all queries within 30 days.