War Era’s official Privacy Policy (last updated 22 January 2024, available at app.warera.io/privacy) is extremely short. It states that the company collects:
Google profile information (name and email) when you create an account
Gameplay data (actions, progress, preferences)
It claims the data is used to provide and improve the service, and that phone numbers (when collected) are “encrypted and not visible to any administrator.”
That is the full extent of the transparency offered to players.
Despite the above, War Era regularly:
Requires phone number verification
Players receive an in-game prompt stating:
“Your account requires additional verification. Please verify your phone number as soon as possible to continue using your account normally. Unverified accounts will have restricted access after 48 hours and may be permanently suspended after 5 days.
Phone numbers are encrypted and not visible to any administrator.”
This collection and the consequences of non-compliance are not described in the Privacy Policy.
Collects and uses IP addresses and device identifiers
The official game rules explicitly regulate IP and device sharing. Players may only share an IP if registered in advance as a “Family Group” via Discord admins. The same rules forbid creating multiple accounts and using bots or automation. Enforcement of these rules relies on detecting shared IPs and devices.
None of this processing is mentioned in the Privacy Policy.
Groups accounts into “clusters” and issues permanent bans + economic sanctions
Multiple documented cases show accounts being permanently banned for multi-accounting or failed verification, often in groups (“clusters”). In several instances, gold has later been clawed back from vaults that received donations from the banned accounts.
The Privacy Policy contains no information about this type of profiling, automated or semi-automated decision-making, or the resulting financial consequences.
Asks players about private circumstances during ticket reviews
In support tickets, moderators have asked questions such as whether players know specific other users, whether they play at a university or workplace where devices might be shared, or whether they use a company VPN.
This additional collection of information about personal relationships, employment and technical setup is not disclosed in the Privacy Policy.
War Era is a French company (173 Rue de Courcelles, 75017 Paris). GDPR therefore applies in full.
Key requirements that are currently not met in the published Privacy Policy include:
Clear information about all categories of personal data collected (Art. 13)
The purposes and legal bases for each processing activity (Art. 6 and 13)
Information about profiling and automated decision-making that produces legal or similarly significant effects (Art. 22)
Retention periods
Recipients or categories of recipients (including any SMS providers used for phone verification)
The right to object, the right to human review of automated decisions, and how to exercise data subject rights
Simply stating that phone numbers are “encrypted and not visible to any administrator” does not fulfil the transparency obligations.
War Era collects and uses significantly more personal data — and uses it for more consequential purposes (account suspension, permanent bans, and economic clawbacks) — than its Privacy Policy discloses.
Players are entitled to accurate and complete information about how their data is processed. At present, that information is missing from the only official document that is supposed to provide it.
Under GDPR, every player has the right to:
Request access to all personal data War Era holds about them (Art. 15)
Ask for information about the logic involved in any automated decision-making (Art. 22)
Lodge a complaint with the French data protection authority (CNIL) if they believe their rights are not being respected
The first practical step is simply to email contact@warera.io and formally request a full copy of your personal data, including any device identifiers, IP history, phone number records, and cluster information linked to your account. Keep a copy of the request. If the answer is incomplete or missing, that itself becomes relevant evidence.