Both new versions take effect 28‑09‑2026. In each case the new text replaces the old one entirely. A short generic boilerplate document has become a long one written specifically for EU and French consumer and data-protection law.
Terms diff: https://www.diffchecker.com/9TyFGNNk/ (102 removals / 474 additions)
Privacy diff: https://www.diffchecker.com/rxeLGD3X (38 removals / 709 additions)
Overall direction: the old Terms leaned towards the company. The new ones repeatedly say that mandatory consumer, GDPR and French law come first.
New age rules. Under 15 needs a parent or guardian's consent. Under 18 needs a parent's authorisation for purchases, which must also cover the recurring price of any subscription.
One account per person. Sharing an account or a device is banned. An approved "Family Group" may share an IP address but not a device.
You're no longer responsible for all activity on your account. If War Era has a security failure, or someone breaks in despite your reasonable care, that's not on you.
The old licence was transferable and sub-licensable without limit. Now:
you keep your rights
the licence is limited to what's needed to run the Service
it lasts only while the content is live, plus a period for backups and legal needs
"Premium" is renamed the Supporter Plan. It's billed monthly with no minimum term.
There are new rules for failed payments and retries. After 90 days of inactivity, the subscription may be auto-cancelled.
Gems are explicitly not legal tender or stored value.
Skins, banners and packs are permanent unlocks. They don't expire when your subscription ends.
Paid randomised boxes (loot boxes) are covered in detail:
the odds and reward pool are shown before you buy
duplicate protection: items you already own are removed from the pool
no pity mechanic
if a box has no eligible rewards left, your Gems are refunded
boxes may be restricted by country or age
New rules for gifts (a month of Supporter Plan bought with Gems), free trials (no card needed, no auto-renewal) and Stripe Managed Payments ("Sold through Link" as merchant of record).
New rules on chargebacks and fraud. Disputing a charge isn't a violation in itself, and someone who receives a gift isn't presumed guilty of fraud.
Purchases through third-party app stores (Google Play / Apple) now have their own section.
The old blanket waiver ("you lose your withdrawal right once delivery starts") is gone. Now:
Gems keep the 14-day withdrawal right for unused Gems
the waiver applies only to content you unlock with Gems
withdrawing from a subscription can mean paying for the share of service already used
New: the legal guarantee of conformity, including the full French statutory notices, the official withdrawal form, and a withdrawal procedure.
The old refund-appeal process (and the EU ODR platform) is replaced by consumer mediation through CM2C.
Fair play, and a rule against knowingly helping someone else break the rules.
Illegal-content notices under the Digital Services Act (DSA).
A ban on Real Money Trading, with possible equivalent in-game fines.
Public API rules: no scraping, no getting around rate limits, no use of non-public endpoints.
A phone-verification process:
48 hours of normal use after a request
then purchases and donations are restricted
after 5 days the account is suspended
there's an alternative route if you can't verify by phone
How account sharing is detected, and how to appeal.
Ban evasion.
Statements of reasons for decisions, appeals, protection for staff and a way to complain about staff.
Infrastructure abuse (including denial-of-service attacks) and disputes between users.
Security research: a responsible-disclosure policy. You can test the dev environments freely; production needs written permission. There's a 90-day disclosure window and good-faith protection. There's no paid bug bounty.
Service and liability: active-development, availability and third-party clauses, all subject to mandatory law.
Changes to the Terms: amendments need a valid reason, with about 30 days' notice. The new Terms also cover changes of business ownership.
Disputes: French law still applies, but binding arbitration in Paris is removed. Consumers can go to court and keep the protections of their home country's law.
Company details: fuller trader identification (WAR ERA SARL, its company registration number, and the DSA point of contact).
The old policy was a few lines: it collected Google login data and gameplay data, said "we use appropriate security," and gave a vague "you can access or delete your data." The new one is a complete GDPR policy.
Controller: WAR ERA SARL in Paris. The supervisory authority is the CNIL.
Login: email codes, Google, or Discord (which also sends your Discord ID and avatar).
Phone verification through Twilio:
the number is stored encrypted only while verification is in progress, then deleted
after that they keep a keyed one-way fingerprint and the country
Gameplay, profile and user content.
Technical data: IP address, device type, OS, browser, security cookies and a limited device/browser fingerprint. They state that this is a signal, not proof, and that it's not used for advertising.
Support and moderation records: email, Chatwoot (hosted by War Era itself), Discord, and in-game support.
Stripe payment data: card brand and last four digits, but never the full card number.
Push notification tokens (Firebase).
Age bracket (under 15 / 15–17 / 18+, not your full date of birth) and parent or guardian details.
Each purpose is mapped to its GDPR basis (contract, legal obligation or legitimate interest).
The anti-multi-account system is openly described as profiling. Users can contest it and ask for human review.
Final permanent bans are never made by automated processing alone.
Public profiles and the public API expose a lot of data, including purchase-related rankings such as Gems bought and boxes opened. You can opt out of the purchase-related rankings.
Moderation outcomes are publicly visible for a limited period. The staff member who made the decision isn't named.
Deleted accounts are pseudonymised, not fully anonymised.
Google, Discord, Brevo, Zoho, Twilio, Stripe / Sold through Link, Firebase, and hosting providers.
A list of approved GIF and image hosts (Imgur, Giphy, Tenor, Klipy and others).
Umami analytics, hosted by War Era itself.
No selling of data, and no advertising.
DataRetentionGameplay and history24 months after the account becomes inactive (inactive = 3 days without a login)Security and technical data24 monthsModeration records24 months, or the sanction's duration + 12 months, whichever is longerSupport recordsup to 24 monthsAccounting records10 yearsBackupsabout 6 months
Account deletion has a 15-day grace period.
For accounts banned for serious abuse, they may keep a hash of the email address to catch ban evasion.
International transfers (Data Privacy Framework and Standard Contractual Clauses).
A concrete list of security measures (encryption, masking, role-based access).
A section on children.
A full list of GDPR rights, including French post-mortem instructions (what happens to your data after your death).
Response time for data requests: one month, extendable by two.
A note that unofficial player Discord servers aren't War Era's responsibility.
Both documents went from generic templates to detailed, EU/French-law-compliant texts.
Main changes for players:
stronger consumer rights (no arbitration, real withdrawal and conformity rights, mediation)
formal rules for loot boxes, gifts and trials
explicit anti-multi-account enforcement, including phone verification and fingerprinting
much more openness about what data is collected, what's public and how long it's kept
What players should watch: more of their data is public through the API and rankings, and moderation outcomes are publicly visible.