Trojan Horse Riders — Privacy

Last updated September 2026

Trojan Horse Riders is a small studio making browser games. This page explains what our websites and games do with data. The short version: playing never needs an account, and we never ask for your name, address, or payment. If you choose to create a cloud account to sync The Old Empire between your devices, we keep your email address and the saves you sync, and nothing else about you.

Our websites

apps.trojanhorseriders.com and trojanhorseriders.com collect nothing: no analytics, no recording, and no cookies set by us. The only exception is the account page on trojanhorseriders.com, and only when you sign in there. It keeps your sign-in in the open tab and forgets it when you close the tab.

Our games

Some of our games collect a small amount of product data to find bugs and learn what is fun. Where a game does, it works like this, and only after you agree to it in that game:

• Usage events — which screens you open, sessions started and finished, and any ratings you choose to submit. Tied only to a random device id generated in your browser.
• Session recordings — a replay of your on-screen activity (menus and dialogs) so we can see where players get stuck. The game canvas itself is not recorded, and anything you type is masked. Recording starts only after you opt in.
• Crash reports — if something errors, a technical report (no personal data) is sent so we can fix it.

Cloud accounts (optional)

The Old Empire can sync your campaigns between devices through a free cloud account. You can play without one; your saves then stay on your device. If you create one, we keep:

• Your email address — to sign you in with a code we email you. There is no password. We send no other email: no newsletters, no marketing. If our email to you bounces or is marked as spam, the address goes on a do-not-send list.
• Your cloud saves — the campaigns you sync, and a record of which device changed what and when, so your devices stay in step.
• Technical logs — errors, request timings and IP addresses from our servers and from AWS, kept for up to 90 days to keep the service running and secure.

When a cloud save is replaced, the previous version stays in our backups for 30 days so we can recover from mistakes, then it is deleted.

What we don't do

• No name, address, or payment details. An email address only if you create a cloud account.
• No advertising, no selling of data, no cross-site tracking.
• We don't link your cloud account to the product data above, and the device id is random and pseudonymous.

Why, and the legal basis

We use product data solely to improve our games (fix bugs, balance difficulty, see what lands). Our legal basis is your consent, given in the game, supported by our legitimate interest in improving the games. You can withdraw consent at any time.

We use your cloud account data only to provide the sync you asked for. Our legal basis is providing that service to you (performance of a contract); for technical logs, our legitimate interest in running a secure service.

Processors

• PostHog — product analytics + session replay (EU-hosted).
• Sentry — crash/error reporting.
• Amazon Web Services — cloud accounts, cloud saves and sign-in emails (EU, Ireland).

Your choices

• Decline (or pick “Play without sharing”) when a game asks, to opt out of product data.
• Toggle a game's Settings → Anonymous analytics off at any time — it stops events and recording and persists across sessions.
• If your browser sends Do Not Track, we collect no product data automatically.
• Delete your cloud account and all its cloud saves at any time on trojanhorseriders.com/account. The saves on your devices are not affected.

Retention

Product data is kept only as long as it is useful for improving our games, and deleted when it no longer is. A cloud account and its saves are kept until you delete the account. Deleting it removes them at once; copies in our backups are gone within 30 days.

Contact

Questions or a deletion request? Reach us through our itch.io pages. Product data is pseudonymous and tied to a random in-browser id, so clearing your browser storage also removes the link to your device.