Privacy Policy
Last updated: September 3, 2026
This policy explains what data we process on costanostragame.net, why we process it, the legal basis for doing so, and how you can exercise your rights.
Controller and contact
The data controller is Antonio Jesús Ruiz Cecilia, owner and operator of the Costa Nostra service available at costanostragame.net. Costa Nostra is the trade and publishing name used for this video game, not a separate legal entity. For privacy questions or data requests, contact [email protected].
Data we process
On the landing page we may process basic technical browsing data, browser-stored preferences, aggregated or pseudonymized usage data if you accept analytics, and your email address if you ask to receive updates. When you create or use a game account, the application also processes your preferred language and an approximate country or region code inferred from technical connection metadata.
Account, gameplay and content you share
To create and maintain your account, we process your username, email address, identifiers from the sign-in providers you choose, profile, language, approximate country and session data. We also store your progress, resources, achievements, purchases, in-game activity and content sent through direct, family or global messages, together with reports and moderation decisions needed to keep the service safe. We do not use this data for advertising.
Mobile app, notifications and purchases
The mobile app may process a random installation identifier, platform, version, language, preferences and an FCM or APNs notification token to deliver game alerts. Notifications contain a safe title and body plus the identifier needed to open the relevant alert. For purchases, we keep the product, provider, transaction status, encrypted receipt, credits and refunds. Google Play, the App Store or other providers process the payment; Costa Nostra does not receive or store card or bank-account details.
Purposes and legal bases
We use technical data and necessary cookies to provide the website and remember your preferences. Your language and account country or region configure your experience and help us administer your account as part of providing the service. We process the SSO data needed to authenticate you, link your identity and provide the account service you request. We retain minimal snapshots and, after Steam is disabled, the technical binding until account deletion on the basis of our legitimate interests in protecting accounts, providing support and preventing fraud, with data minimization and internal access restricted to OWNER. We use analytics and your email for updates only with your consent.
Country or region and language
We initially infer the country or region from which you connect to select a language and configure the account. This is approximate, not a precise location or proof of nationality or legal residence. Only authorized administrators can view it for support and service operations; you can correct it and change your language in your profile. Country and language are stored separately, and unavailable translations always fall back to English.
Connection security and IP history
When you use an authenticated account, we may consolidate by UTC day the IP address used to connect in order to protect accounts and prevent or investigate fraud, bots, coordinated exploitation and security incidents. We rely on our legitimate interests subject to necessity, minimization and balancing: the exact address is encrypted, this history does not store routes, actions, content or user-agent, and it is erased after 90 days or when the account is deleted. Only OWNER may view masked data or reveal an address with a documented reason; every access is audited for 730 days without including the IP. A shared IP may result from households, businesses, mobile networks, VPNs or proxies and never causes a sanction or automated decision on its own. You may exercise your right to object through our contact address.
Sign-in and identity providers
If you sign in or link an account through Google, Apple or Steam, we keep a minimal snapshot of the data the provider shares so that we can identify and protect your account and resolve support issues. For Google, this may include display name, email, its verification status and managed domain; for Apple, email, its verification status and whether it uses private relay; and for Steam, the account identifier. Only the internal OWNER role can view masked identifiers and email addresses in the support dossier. We do not store access or identity tokens, OAuth codes, nonces, tickets or raw provider responses.
Email and communications
If you give us your email address, we use it to send Costa Nostra updates. You can unsubscribe or ask us to delete it by writing to our contact email.
Analytics
If you accept optional cookies, we may measure page views, section views, scroll depth, language, device, approximate country and CTA clicks through Google Analytics and PostHog. These tools are not activated if you reject analytics.
Recipients and providers
We do not sell your data. We may use hosting, analytics and email providers acting as processors, accessing only the data needed to provide their service. If you choose Google, Apple or Steam to access the game, that provider also processes authentication data under its own policy.
International transfers
Some providers may process data outside the European Economic Area. When this happens, we use recognized safeguards such as standard contractual clauses or equivalent mechanisms.
Retention
We keep your language and account country or region while your account exists, unless you correct them sooner, and erase them when the account is deleted. SSO snapshots are erased when you unlink Google or Apple or delete your account. Disabling Steam keeps the technical association with the Steam identifier until account deletion to prevent transfers, fraud and Steam Wallet errors; it retains no tokens and does not permit sign-in. Browser preferences remain until you delete or change them, analytics follows provider retention settings, and email used for updates is kept until you withdraw consent or request deletion. Financial evidence may be retained for applicable legal and accounting periods.
Security
We apply reasonable technical and organizational measures to protect data against unauthorized access, loss or alteration. No system is infallible, but we work to reduce risks.
Minors
The website and the game are not directed to anyone below the minimum age applicable in their country. If you believe a minor has provided data, contact us so we can review and delete it where appropriate.
Your rights
You can request access, rectification, erasure, objection, restriction and portability, and withdraw consent, by writing to [email protected]. You may also lodge a complaint with the competent supervisory authority.
Changes
We may update this policy if the service, providers or legal obligations change. The current version will be published on this page.