Rites of Accord: Privacy Policy

Last updated: 2 November 2026

Who we are

Rites of Accord is made by CodeSeed Studios, the trading name of Bryce Merrill. We are a team of two, Bryce and Leyla, based in Washington State, USA. Bryce is responsible for your personal data (the "controller"). In this policy, "we" and "us" mean CodeSeed Studios. Our studio's site is code-seed.io/studios.

This policy covers ritesofaccord.com, the game in a browser or installed from the site, the Steam version, and the email we send.

Questions and requests go to bryce@ritesofaccord.com. We answer within 30 days.

What we collect

Your account

Your email address and username. The username is kept in lowercase for sign-in and as you typed it for display.
Your password, stored only as a bcrypt hash. We never store the password itself.
If you sign in through Steam: your SteamID, which we confirm with Valve using a Steam sign-in ticket. An account made through Steam starts with your Steam name as its username, and has no email or password until you add them.
Whether you want update emails, and when and where you said so.
The display language you pick from the globe menu, so the game shows it on every device you sign in on.
Where you came from when you made the account: the tag of the link you followed (such as /links/tiktok) or the site that sent you, and whether you made it in a browser, the installed app or on Steam.

Your play

Multiplayer matches: who played, the forces each side used, the result, the score for each round, when the match started and ended, and the map. For ranked matches, each player's rating before and after.
A replay of each multiplayer match (the moves, in order), kept in our file storage.
The forces you save, with their names.
Ranked play: your rating, tier, best tier, titles, games played and season standings.
Survival: your saved run, the scores of your finished runs, and the stories of the units in them.
Survival runs as you play them: when each started, the furthest wave it reached, how long it was on screen, how it ended or that it was left, your faction, where you play, the source tag of the link you came from (if it had one), and whether it was the first run on that device. A guest's runs are recorded the same way, with no account.
Progress the game reports, such as finishing a training game or a campaign act, and the factions you have unlocked.
Matchmaking: each time you search for a ranked match or send a challenge, when it started and ended, how it ended (a match, you withdrew, you left, no one took it), and whether you play in a browser, the installed app or on Steam.
The days you open the game while signed in.
Apps you link to your account (see ListForge).

Emotes and map pings in a match go to your opponent and are not stored. There is no chat.

Purchases

What you bought, the amount, the currency, the date and the payment's transaction id, and any promo codes you redeem. We never receive your card details.

Bug reports and feedback

What you write. A bug report also carries your browser and device details, your screen size, the page address (with any reset or unsubscribe code taken out), a recent log from the game (from this visit and the last two before it on the same device, if they were within a day) and a recent log from our server. If you are signed in, a report includes your account id.

Connections

Our server sees your IP address when your device connects. We use it in memory to limit how many requests one address can make, and we do not store it with your account. The analytics described under Counting visits use it to make a code that changes daily, and keep only that code.

On your device

If you play without an account, your forces and settings stay in your browser. A force reaches us only if you share it as a short link.

Why we use it

If you are in the EU, the EEA, the UK or Switzerland, the law asks us to name a legal basis for each use.

To provide the game (contract). Your account and sign-in, matchmaking, ranked play, saving forces and runs, replays, and purchases.
Legitimate interests. Keeping the game secure and fair (limiting requests, finding cheating and ranked manipulation), counting visits without cookies, seeing where players stop and how often they come back (the matchmaking record and the days you played), fixing bugs from reports, and telling press and creators about the game. You can object to any of these (see Your rights).
Consent. Update emails, and the translation cookie when you pick a language. You can withdraw consent at any time.
Legal obligation. Keeping purchase records for accounting and tax.

We do not sell your personal information, and we do not use it for advertising.

What others can see

The leaderboard and player profiles show your username, title, rating, tier, results and season standings.
Public match history shows both players' usernames, factions and forces (with their names), the scores and the ratings. Any signed-in player can watch a match's replay.
The Survival boards show your best scores, your squads and your units' stories.
A force you share, as a code or a short link (/f/...), can be read by anyone who has it. It holds the force's name and units, not your username.
We may name season winners, with their results and forces, in the game, on this site and in our posts and videos.

Choose a username and force names you are happy for anyone to see.

Email

Password resets, when you ask for one.
One welcome when you make an account, or when you add an email to an account made through Steam. It comes from Bryce, is about your new account, and asks how you found the game and how it is going. You can answer by replying.
Everything else only if you ask for it: launch news, updates, and Toto's field reports about your own play (at most one a week). You ask with the box at sign-up, which starts unticked, or the switch on the Account screen. You must be 16 or over.
The signup form on /links gets you launch news and major updates only, never field reports. It is also for 16 and over. We keep the words you agreed to and the date.

Every update email has an unsubscribe link and our postal address. Unsubscribing, or turning updates off in your account, stops further update emails.

We send email through Resend. For each email sent we keep its kind, when it went, and a scrambled form (a hash) of the address, not the address itself, so nobody gets the same email twice and field reports keep to their weekly limit. Replies reach our own inbox.

Cookies and your device

We use no advertising cookies or trackers, and our own analytics use no cookies.
Your sign-in is a token kept in your browser's local storage, not a cookie. Your settings and some progress (such as whether you have seen the opening comic, a Survival run in progress, a guest's finished Survival score waiting a day for you to sign in, and which of the first steps counted above this device has taken, so each is counted once) are kept there too. Signing out removes the token.
The game also keeps a short log of its last few visits there, so a bug report sent after the game was closed or reloaded can say what went wrong. It leaves your device only in a bug report you send.
When a page is shown in a language other than English (one you picked from the globe menu, or your device's own), it sets a cookie called googtrans, which Google's translation widget reads. A language you pick is also kept in local storage.
On a phone or tablet, the game keeps copies of its own files on the device so it starts faster.

Google and YouTube on our pages

Every page loads its fonts from Google Fonts, so Google receives your IP address and browser details.
The home page and the game, in a browser and on Steam, load Google's translation widget when they open. Other pages, such as this one, load it only when they are shown in another language: one you picked, or your device's own.
The trailers on the home page and in the press kit are embedded from YouTube in its privacy-enhanced mode (youtube-nocookie.com). When one loads, YouTube receives your IP address, and once you play it YouTube may store data on your device under its own policy.

Google's use of this data is covered by the Google Privacy Policy.

Counting visits

We count visits ourselves, without cookies and without any outside analytics service. When a page loads or you press certain buttons, your browser sends us the event's name and either the address that sent you or a source tag from the link you followed (such as /links/tiktok). A few events from the game send a short device summary instead, such as "phone", the system version and the screen size. Inside the game, some steps are counted the same way (reaching the main menu, the menu entry you choose, searching for a match, finishing one, starting and finishing a mode, each step of the tutorial), with where you play (browser, installed app or Steam), and the source tag of the link you came from when it had one. So is where you were when you closed the page or put it away (a screen, or a round or wave of a match); only the last of the day is kept. The first time a device opens the game, and the first time it takes a few steps (the tutorial, a training game, a Survival run, an online match), is counted once, and so are crashes and errors in the game's code. Each attempt at a mode (a tutorial or campaign mission, a training game, a Survival run, a search or a match online) is recorded with where you play, where you stopped, how it ended and how long it took. None of these counts or records is tied to your account.

Our server mixes your IP address and browser details with a secret and the day's date into a short code (a hash), and stores only that code. The code changes every day, so one visit cannot be followed to the next day, and the IP address itself is never stored. We use these counts to see which pages and links work, never to identify anyone.

Services we use

These companies handle data for us, each only for its part:

Cloudflare hosts the website, stores replays and game files, and passes on mail sent to our ritesofaccord.com addresses.
Fly.io runs the game server, in the United States.
Neon hosts our database.
Resend sends our email.
Stripe takes payments on the website.
Valve (Steam) for Steam sign-in, the Steam version and Steam purchases.
Google for fonts, the translation widget, the YouTube trailer, and our email inbox (Gmail).
LFP (Looking For Project), our project tracker, receives bug reports and feedback.
PayPal pays out season prizes.
ListForge, only if you link it (next section).

Our community server is on Discord. What you post there is covered by Discord's privacy policy, not this one.

We are in the United States, and your data is processed there and in other countries where these companies work. For data from the EU, the EEA, the UK or Switzerland, we rely on the safeguards the law provides for such transfers, such as the standard contractual clauses in our providers' data processing terms.

ListForge

ListForge is a separate list-building app, also made by Bryce, with its own terms and privacy policy. Nothing goes to ListForge unless you link your account to it, which you approve on the Account screen.

The link lets ListForge do what you approved: read your match history, read your forces, and create, change and delete your forces. With match history it can also read your rating, tier and title. Match records include your opponents' usernames, as public match history does.
We send ListForge facts about your play so it can give you rewards: when you linked, your username, your first game, your best Survival result, how many multiplayer games and opponents you have had (all and ranked), and your ranked wins by faction.
We keep your ListForge account's id and name, and a label for each device you link.

To stop it, press End Link on the Account screen (or end it in ListForge). We stop sending facts and its access stops working. What ListForge already received is covered by its own policy.

Payments and prizes

On the website, Stripe takes your payment and collects your payment details under the Stripe Privacy Policy. We keep what you bought, the amount, the currency, the date and Stripe's transaction id. On Steam, Valve handles the payment under the Steam Privacy Policy, and we see no payment details.

If you win a prize in a ranked season, we ask for the email address of your PayPal account so we can pay you, and keep a record of the payment. PayPal handles the payment under its own privacy policy.

Press and creators

If you write about games or make videos about them, we may keep the details you publish for business: your name, your outlet or channel, the email address you list for enquiries, links to your published work, and public channel details such as audience size, country and language. We keep notes on your work and our emails with you, and use them only to tell you about Rites of Accord. Our basis is legitimate interest.

Tell us to stop at any time, by replying or by writing to bryce@ritesofaccord.com. We will stop and delete your details, keeping only your address on a do-not-contact list if you want us never to write again.

YouTube and TikTok

Our own tools use YouTube API Services to upload our videos to our YouTube channel and to read public information about channels and videos when we look for creators to contact. They act only for our own channel, and collect nothing from visitors to this site or players of the game. YouTube's handling of data is covered by the YouTube Terms of Service and the Google Privacy Policy. Anyone who has given an app access to their Google account can remove that access on Google's security settings page.

Our posting tool also sends drafts of our videos to our own TikTok account. No visitor or player data goes to TikTok through it.

How long we keep data

Your account: until you delete it.
Match records, ratings history and replays: for as long as the game runs, so that ladders and histories add up. After you delete your account they no longer carry your name, except old replay files (see Deleting your account).
Purchase records: as long as accounting and tax law require.
Matchmaking records and the days you played: while they help us see where players stop and how often they come back, and never past the deletion of your account.
Survival run records: while they help us see how runs go. When you delete your account they stay without it, as a guest's do.
Password reset links: they work for one hour.
Visit counts and attempts at a mode: the day's code, the event or attempt and the source, with no IP address, kept while they help us compare visits over time.
Bug reports: while they help us fix bugs.
Email records: the hashed send records, for as long as we send email. A website signup that unsubscribes is kept marked as unsubscribed so it is never mailed again. Ask us and we will delete it outright.
Press and creator contacts: until you ask us to stop, or the contact is no longer useful.

Deleted data can stay in backups for a short time until they expire.

Deleting your account

On the Account screen, choose Delete account and confirm with your password. An account with no password (one made through Steam) confirms by typing DELETE. You need to finish or leave any match first. If you cannot sign in, write to bryce@ritesofaccord.com from the address on the account.

What is removed

Your email, password and Steam link.
Linked apps and their access.
Your saved forces, Survival save, Survival scores and unit stories.
Your titles, unlocked factions, language and email choices. Your website signup for the same address is unsubscribed.
Your matchmaking record, the days you played, and where you came from when you made the account.

What stays, without your name

Match results and rating history, so other players' records still add up. Your name becomes "Deleted player" there and in season standings. Past matches keep the forces as they were played, including their names.
Purchase and promo code records, for accounting and tax.
Recorded replay files are not rewritten, so a replay of a past match can still show your old username. Write to us and we will remove those replays.
Shared force codes and short links are not tied to your account, and keep working.
Bug reports you sent stay in our tracker unless you ask us to remove them.
The record of your Survival runs (when, how far, how long, how each ended), with no account, as a guest's.

After deletion your Steam account is free, so it can make a new account later. Deleting is final: we cannot restore an account or what it unlocked.

Your rights

Depending on where you live, including the EU, the EEA, the UK, Switzerland and California, you can ask us to:

give you a copy of your personal data (access), in a common format you can take elsewhere (portability);
correct it, including changing your email address;
delete it;
restrict how we use it;
stop using it for something based on our legitimate interests, and stop direct marketing at any time (objection);
withdraw a consent you gave, which does not affect what we did before.

Some of this you can do yourself: change your username or password, turn update emails off, end a link, or delete your account. For a copy of your data or anything else, write to bryce@ritesofaccord.com. We may ask you to confirm the account is yours, usually by writing from its email address. We answer within 30 days and charge nothing.

You can also complain to the data protection authority where you live (in the UK, the Information Commissioner's Office). We would like the chance to fix it first.

California and other US states

We do not sell personal information, and we do not share it for cross-context behavioural advertising.
Do Not Track: we do not track you across other sites, so we do nothing different when your browser sends a Do Not Track signal. The Google and YouTube parts of our pages (see Cookies and your device) may collect data under Google's own policy.
California residents have the rights in Your rights, and we will not treat you differently for using them.
We collect no health data, so Washington's My Health My Data Act does not apply.

Children

Rites of Accord is not meant for children under 13, and accounts are for 13 and over. We do not knowingly collect personal data from children under 13. If we learn that we have, we delete it. A parent or guardian who thinks this has happened can write to bryce@ritesofaccord.com. Update emails are for 16 and over, and season prizes for 18 and over.

Changes to this policy

When we change this policy, we post the new version here with a new date. If a change matters to how we use your data, we will also tell you in the game or by email before it applies.

Contact

CodeSeed Studios (Bryce Merrill), Washington State, USA.
bryce@ritesofaccord.com

Our Terms of Service cover the rules for using the game.