Privacy policy

1. Controller and scope

The controller for processing carried out to provide and secure the service at kingslayerlabs.com is the site publisher, a private individual publishing it on a non-professional basis. They can be reached at the address below or through the Contact page.

This policy covers the public site, accounts, private areas, guides, in-game memberships, and support requests. It does not cover third-party sites that may be referenced in user content.

For any question about personal data, use the Contact.

Contact email address : contact@kingslayerlabs.com

2. Data we process

We limit collection to information needed for the features you use.

Account and identity: Username, email address, preferred language, account status, creation, verification and login dates, and passwords and action tokens retained only as secure hashes.
In-game identity and organizations: Character name, governor ID when provided, kingdom, alliance, declarations, verification decisions, and membership history needed for scoped access.
Characters for gift codes: Server, FID and optional name of the characters you add, the result of each code sent (received, already collected, condition not met) and the codes you suggest.
Content and settings: Guides, drafts, revisions, collections, images, languages, categories, audiences, publication dates, and access-code hashes. Content remains private until an explicit publication action.
Security and technical data: Opaque request and session identifiers, browser summary, activity dates, audit records, and an HMAC of the IP address to protect accounts, limit abuse, and investigate incidents.
Contact requests: Message category, subject and text, sending account, and language. The originating path, request ID, and browser summary are attached only when you voluntarily select the diagnostics option.

The current version does not collect payment details, your Kingshot password, or access to your game account. Do not place sensitive data or secrets in a guide or message.

3. Purposes and legal bases

Each processing activity has a defined purpose and legal basis.

Provide the service — performance of the terms: Create the account, authenticate the user, remember preferences, save content, and carry out requested actions.
Verify access — performance of the terms: Keep the user, character, alliance, and kingdom distinct, then enforce selected audiences and permissions.
Publish content — performance of your choice: Display a revision only to the selected audience after the author explicitly publishes it.
Secure the platform — legitimate interests: Prevent fraud, intrusion, spam, and abuse, maintain accountability, and defend the service and its users.
Handle requests — service performance or legitimate interests: Understand and answer a request and retain a proportionate record of its handling. Optional diagnostics rely on your consent.
Comply with law — legal obligation: Respond to a legally valid request and establish, exercise, or defend legal claims.

Fields marked as required are necessary for the relevant feature. An account cannot be created without registration data, and a contact message cannot be sent without signing in.

4. Recipients and transfers

KingSlayer Labs does not sell personal data. Data is accessible only as needed and according to the selected visibility.

People authorized to operate, secure, or support the service, within the scope of their responsibilities.
Users in the audience selected for content: author only, signed-in members, alliance, kingdom, or public.
Technical providers required for deployment, including hosting and email delivery, bound by confidentiality and security obligations.
The official gift code service of Kingshot’s publisher: your characters’ FID and server, only to redeem the codes you send or for which automatic sending is on.
Authorized authorities or advisers, only where required by law or necessary to defend a legal claim.
Community ideas: an idea is only published with its author’s consent, reworded by the team and without a username; problem reports stay private.
Donations: the “Support the project” page links to Ko-fi. The site sends no data to Ko-fi; a donation is made on Ko-fi and falls under its own privacy policy. A username is only thanked publicly with the person’s consent, without any amount.

The current version includes no advertising network or third-party analytics. If a provider involves a transfer outside the European Economic Area, KingSlayer Labs must apply an appropriate legal mechanism and safeguards and update this policy.

5. Retention periods

Data is kept only for as long as needed for the stated purpose, then deleted or anonymized, subject to a legal duty or an ongoing dispute.

Account and memberships: For the life of the account. After a closure request, for the time needed to process it and, for essential records, for as long as required to meet an obligation or defend a legal claim.
Guides, revisions, and attached media: For as long as the account or content is retained. A published version stops being distributed when unpublished; revision history remains linked to the content for traceability and restoration.
Gift codes: Your characters and the history of codes received on them are kept until you remove those characters or delete your account. The technical request log is erased after 90 days, other sending results 180 days after the code ends.
Temporary data: Verification links expire after 24 hours, reset links after 1 hour, sessions after 2 hours of inactivity and no later than 24 hours, recovery drafts after 30 days, and unattached images after 7 days. The daily purge removes expired persistent logins; expired or revoked session metadata and expired action tokens are deleted after 30 days.
Security and audit: For a period proportionate to the risk, incident investigation, and applicable limitation periods. Rate limits stop taking effect when their window expires.
Contact requests: While the request is handled and then for the time reasonably needed for follow-up, service security, and any dispute.
Internal audience measurement: Detailed pseudonymous events are deleted after 90 days. Dashboards show no identity and hide small segments.

Longer retention is limited to data strictly needed for a legal obligation, a documented security measure, or the establishment, exercise, or defense of a legal claim.

6. Security

The service uses prepared queries, output escaping, CSRF protection, rotating server-side sessions, HttpOnly and SameSite cookies, password and token hashing, access controls, rate limits, and auditing of sensitive actions.

No system provides absolute security. If a breach is likely to create a risk, KingSlayer Labs follows applicable documentation, authority-notification, and individual-notification duties.

7. Cookies and local storage

The site uses a session cookie strictly necessary for security, authentication, the CSRF token, and language selection. It is HttpOnly, SameSite=Lax, and becomes Secure over HTTPS.

The reader lets you choose to save your position, checked steps and reading mode. For guests, this data stays in this browser for 30 days, limited to 50 guides. For signed-in accounts using the new reader, it syncs between devices and remains until removed using the save button; beyond 50 readings, the oldest are replaced. No guide content or access code is copied. Access rights are checked on every request; a new guide revision resets its progress. Other local data, including editor drafts and recent emojis, stays on the device until removed or replaced.

No advertising tracker, social tracker, or third-party measurement service is used. After permission, internal audience measurement only reuses the already-required first-party session in hashed form and solely for KingSlayer Labs.

Complete inventory of cookies the application may set:

Internal audience measurement

With your permission, pages, routes, reads, HTTP responses, language, device category, and general source are retained for at most 90 days. Your choice is remembered for six months. IP addresses, raw user-agents, searches, URL parameters, and private content are not stored. Bots are isolated. You can withdraw permission at any time; events linkable to the current session are then deleted.

With your consent, we also measure display and response delays, layout shifts and the start/completion of a Gear save or Workshop copy. No entered text or private URL is sent. These samples follow the same retention and consent withdrawal rules as audience measurement.

Current status: no choice is saved. Human measurement remains disabled.

8. Your rights

Depending on your circumstances and the legal basis, you may request:

access to your data and a copy of the information being processed;
correction of inaccurate or incomplete data;
erasure where no duty or overriding reason requires retention;
temporary restriction of processing in the cases provided by law;
portability of data you provided where the right applies;
objection to legitimate-interest processing on grounds relating to your situation;
withdrawal at any time of permission for audience measurement or optional diagnostics, without affecting prior processing.

Exercise these rights from your account through the Contact. Your signed-in session helps verify your identity; strictly necessary additional information may be requested where there is reasonable doubt.

You may also lodge a complaint with the competent supervisory authority, including the CNIL in France, after contacting KingSlayer Labs.

9. Children and minors

The service is not specifically directed at children. Anyone who cannot legally accept these terms in their country must obtain permission from a legal representative. A representative may request deletion of a minor’s data.

10. Changes to this policy

This policy may change with the service, law, or providers. The date above will be updated, and material changes will be appropriately highlighted before taking effect where required.

For a question, rights request, or privacy report, use Contact.