Last updated 10 September 2026
The controller for this service is:
Digital Source Marcin Sadowski ul. Radziwie 3/67, 01-164 Warszawa NIP 499 037 05 30 contact@towers.msSend any question or request about your data to contact@towers.ms.
This policy covers Towers, the game at https://towers.ms/, whether you play with an account or as a guest.
With an account: your nickname, which the players at your table see, your e-mail address, a scrypt hash of your password (never the password itself), the Google account identifier if you sign in with Google, whether your address has been verified, when you signed up and when you were last seen, your career counters (wins, losses and the like), and, if you have one, a friendship record linking your account to another player's.
As a guest: the nickname and colour you chose for that session, and a random reconnect identifier kept in your browser so a refresh can rejoin your game. These identifiers let us recognise your game session; they do not require your real name.
Whenever anyone plays: the IP address of the connection, in ordinary server logs, and a record of every finished match: its map, its roster, its outcome, when it started and ended, and per-player statistics.
Every finished match is stored as a compressed log of the moves made, so it can be watched back. It contains the nicknames, colours and moves of the players at the table, an internal identifier for any signed-in account among them, and the map and times involved. It contains no e-mail address and nothing typed outside the game. A recording is reachable at a link containing a long random identifier, and watching one requires an account: the link alone is not enough, and we do not publish or index those links ourselves.
There is no public directory of accounts. Profile statistics and match history require signing in and are restricted as described below. Room listings and players at your table can show player nicknames.
A profile, meaning a nickname together with the career counters and recent matches attached to it, can be read by two people only: you, and someone whose friend invitation you have accepted (or who has accepted yours). Removing a friend ends that access immediately, and a friend invitation that is still waiting for an answer grants nothing. Asking for a profile you may not read is answered exactly like asking for a nickname nobody has, so the service cannot be used to find out which nicknames exist.
Other players still see the nickname and colour you use at a table while you are playing with them, and those are recorded with the match.
Running the game and keeping an account is performance of a contract (GDPR Article 6(1)(b)). Server logs, abuse prevention and keeping the service secure are legitimate interests (Article 6(1)(f)). Sending the six-digit codes needed to activate an account or reset a password is part of the same contract.
Towers sets no cookies at all. Your browser's own storage keeps a few things, for your session and preferences: the token that keeps you signed in, a reconnect token and room code, the nickname and colour you chose, sound settings, the default bot difficulty, and whether the scoreboard is collapsed or its hint has been shown. These preferences are saved on this browser, rather than synced to your account. Temporary per-tab storage also prevents repeated reloads during an app update. Unlike a cookie, none of this is attached automatically to every request your browser makes: the session token is sent only when the game asks for it, as an authorization header on the calls that need it, and the nickname and colour are sent only when you use them, over the game's own connection, which is also how they end up recorded with a match and, if you keep an account, shown on the profile you and your friends can read. Clearing site data in your browser removes what is stored locally. There is no advertising and no tracking, which is why this page carries no cookie banner.
MyDevil.net, which provides the hosting and the mailbox the codes are sent from, acting as a processor. Google, only when someone chooses to sign in with Google, and only to confirm who they are. Nobody else. Nothing is sold, and nothing is used for advertising.
An account and its matches are kept while the account exists. Sessions expire on their own. A six-digit code lives fifteen minutes. Server logs are kept for as long as the hosting provider retains them. Deleting an account removes the account, its sessions and its friendships, and detaches its matches.
You can delete your account yourself, at any time, from your profile in the game: open the profile using the edit icon beside your nickname on the main screen, then use Delete account. We e-mail a six-digit code to the address on the account, and entering it deletes the account immediately. This cannot be undone. How to delete your account says the same thing outside the game.
On servers in Poland, in the European Economic Area. Google sign-in may involve a transfer outside it, under Google's own safeguards.
You have the right to access, rectify, erase, restrict, object to the processing of, and receive a portable copy of your data. Erasure is self-service, described above; for anything else write to contact@towers.ms. You may also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.
The game is not directed at children under 16, and an account should not be created by one without a parent's consent.
A changed policy carries a new date and a new version, and anyone with an account is asked to accept it the next time they sign in.