UK GDPR & PECR Charter · Last updated: 26 October 2026

Privacy & Cookies Notice

How the MossBastion stronghold handles technical server logs, keeps your device free from cookies and tracking, and upholds your data protection rights under United Kingdom law.

First · In Plain Words

Short Summary: What Happens When You Visit

We built MossBastion so you can read about strategy games in peace. Here is the whole picture in plain words and short sentences:

No accounts or sign-ups: You never have to type in your name, email address, or age to use this site.
No cookies or tracking: We do not put cookies on your phone or computer. We do not use analytics, ad trackers, or hidden scripts.
Only basic server logs: When your browser loads a page, it automatically sends your IP address to our web host so the page can reach your screen. Our host keeps a short technical log of this to keep the site safe and fix errors, then deletes it.
Device settings stay on your device: The site follows your device’s light or dark theme and reduced-motion settings automatically without saving anything.
External game links leave our site: When you click a button to visit a game’s official site, you leave MossBastion. Each game site has its own privacy policy.

Clause I · Data Controller

1. Who Is Responsible for Your Data

Under the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller responsible for operating mossbastion.com is:

Operator / Legal Name: [Operator legal name]
Legal Form & Registration: [Legal form] · [Registered in, company number and registered office]
Address: [Trading address]
Privacy & Data Contact Email: [Contact email]

If you have any questions about this notice or how technical logs are handled, you can contact us directly at [Contact email].

Clause II · Technical Server Logs

2. What Data We Process

We process only the minimal technical server logs that a web host keeps when a browser loads a webpage. Every time you visit any website on the internet, your browser has to send your IP address and basic request headers so the server knows where to send the page back.

Server Log Fields Recorded by Our Host:

We keep no visitor logs of our own. To deliver and protect the site, Cloudflare processes technical request data: IP address, time of the request, the page requested, and browser and device type.

You do not have to give us anything else. We do not have registration forms, comment boxes, newsletters, or user profiles. If you choose to send us an email at [Contact email], we will receive your email address and whatever message you write so that we can reply to you.

Clause III · UK GDPR Article 6(1)(f)

3. Why We Process It & Our Lawful Basis

Technical server logs are processed strictly for three operational reasons:

Delivering the site: Routing our HTML, stylesheets, and artwork across the network to your browser.
Keeping the site secure: Detecting and blocking automated attacks, denial-of-service floods, or malicious requests.
Fixing faults: Diagnosing broken links, server errors, or delivery failures.

Lawful basis: We rely on legitimate interests under UK GDPR Article 6(1)(f). Our legitimate interests are operating a safe, resilient, and fault-free public website and protecting our server infrastructure against abuse. Because these logs are strictly minimal, never used to profile you, and deleted automatically on a short schedule, they do not override your fundamental rights and freedoms.

If you contact us by email, we process your message under our legitimate interest in answering visitor enquiries and fulfilling any statutory data protection requests.

Clause IV · Processor & Retention

4. Who Receives the Data & How Long It Is Kept

We do not sell, rent, or share visitor data with advertisers, data brokers, or game publishers. Technical request logs are handled solely by our infrastructure hosting provider acting as a data processor under contract:

Hosting Provider (Processor) & Safeguards: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. The site is delivered from Cloudflare's global network, including data centres outside the UK and Canada; Cloudflare is certified under the EU-U.S. Data Privacy Framework and its UK Extension.
Log Retention Period: We keep no server logs. Cloudflare keeps request data only for as long as its privacy policy (cloudflare.com/privacypolicy) sets out for security and network operations.

Where our hosting provider processes or routes technical data outside the United Kingdom, transfers are protected either by United Kingdom adequacy regulations or by the UK Information Commissioner’s International Data Transfer Agreement (IDTA) / UK Addendum to the Standard Contractual Clauses, as specified in the processor details above.

Once the retention period (We keep no server logs. Cloudflare keeps request data only for as long as its privacy policy (cloudflare.com/privacypolicy) sets out for security and network operations.) expires, server logs are automatically overwritten or erased. If you send us an email, we keep the correspondence only for as long as needed to resolve your query and meet UK legal record-keeping duties.

Clause V · PECR & Zero-Storage Architecture

5. No Cookies, No Device Storage, No Tracking & No Profiling

Under the Privacy and Electronic Communications Regulations (PECR), websites must ask for consent before storing non-essential cookies or similar trackers on your terminal equipment. MossBastion stores nothing on your device at all:

Zero Cookies

We set no first-party or third-party cookies of any kind—neither session nor persistent.

Nothing Stored on Your Device

We never write to localStorage, sessionStorage, or IndexedDB, and we do not use browser fingerprinting.

No Analytics or Third-Party Assets

We run no analytics scripts, tracking pixels, or external fonts. Every font, image, and video is served directly from this site.

Theme and motion preferences: MossBastion automatically respects your device’s light or dark colour scheme and your reduced-motion accessibility setting (prefers-reduced-motion) using standard browser CSS media queries. It reads those preferences inside your browser’s rendering engine without storing any cookie or token on your device, and without sending those preferences to our server.

No automated decision-making or profiling: We do not carry out any automated decision-making, scoring, or user profiling (under UK GDPR Article 22 or otherwise).

Clause VI · UK Visitor Rights

6. Your Data Protection Rights & How to Complain

Under UK data protection law, you have the following rights over your personal data:

Right of access: You can ask us whether we hold personal data about you and request a copy of it.
Right to rectification: You can ask us to correct inaccurate or incomplete personal data.
Right to erasure: You can ask us to delete your personal data where there is no lawful reason for us to keep it.
Right to restriction: You can ask us to suspend the processing of your personal data in specific circumstances.
Right to object: You can object to our processing of your data where we rely on legitimate interests.

Practical note on technical server logs: Because we only log basic network data (We keep no visitor logs of our own. To deliver and protect the site, Cloudflare processes technical request data: IP address, time of the request, the page requested, and browser and device type.) and never link IP addresses to names or accounts, we usually cannot identify which log lines belong to a specific individual unless you provide the exact IP address and timestamp of your visit before the log retention window (We keep no server logs. Cloudflare keeps request data only for as long as its privacy policy (cloudflare.com/privacypolicy) sets out for security and network operations.) expires.

Complain to Us First

If you wish to exercise any of your rights or make a data protection complaint, please email us at [Contact email]. We acknowledge all privacy complaints within 30 days and work to resolve any issue promptly and transparently.

Complain to the UK Regulator (ICO)

You also have the right to lodge a complaint at any time with the United Kingdom’s supervisory authority for data protection, the Information Commissioner’s Office (ICO), by visiting ico.org.uk (opens in a new tab) or calling 0303 123 1113.

Clause VII · Frontier Boundaries

7. Links to Game Sites & Changes to This Notice

MossBastion is an independent editorial guide. Throughout our pages—including the home page and the Rampart Codex—we provide direct links to the official websites of the nine strategy games we feature (such as Goodgame Empire, Elvenar, Forge of Empires, Tribal Wars, Rise of Cultures, Heroes of History, Illyriad, Game of Thrones Winter is Coming, and War Commander).

When you follow a link to a game’s official site, you leave MossBastion and enter a website operated by that game’s developer or publisher. Those external game sites have their own privacy policies, cookie banners, and terms of service. We do not control how external publishers collect or use your data once you leave our domain, and we encourage you to read the privacy notice on any game site before registering an account or making an in-game purchase.

Date this notice was last updated: 26 October 2026. Any future updates to our data practices will be published on this page with a revised policy date.