Privacy Policy

Last updated and in effect from 13 October 2026

Open Historia is a free, open-source strategy game. It runs on your own device: in the browser at openhistoria.com, as a desktop app for Windows, macOS and Linux, and as an Android app. This policy covers all of them, in their stable and beta versions. It explains what the game keeps on your device, what it sends elsewhere and to whom, what the project itself holds about you, and the rights you have.

Who is responsible. "We" means Nicholas Krol, an individual in the United States who runs the Open Historia project and its servers, and who is the data controller for what this policy describes. You can reach us at [email protected]. Open Historia is a non-commercial project: it has no advertising, sells nothing and has no paid accounts.

The Short Version

What Stays on Your Device

Everything you make and play is stored on your device: in your browser's storage on the website, in the app's storage on Android, and in the app's data folder on the desktop. That includes:

• your games, scenarios, maps, flags, basemaps and settings, and any language packs the game builds for you;
• your AI keys and endpoints. They are stored as they are, without encryption, so anyone who can use your device or browser profile could read them. On Android, if device backup is turned on, Android may include the app's data, keys among it, in your backup;
• a record of recent AI calls (the prompts and the answers: the last 200, and more from the session you are in), which the AI debug console shows and can save to a file exactly as recorded. It is kept unless you turn off Record AI telemetry in Settings; in the beta Android app it is kept only if you turn that on;
• the feeds Listen in has shown you (the posts your AI model wrote about a place), kept so that opening one again costs no AI request (beta versions);
• the diagnostics log: warnings, errors and milestones, and the text of advisor and diplomacy conversations only if you turn on detailed logging. It is never sent automatically. It leaves your device only when you copy or save it yourself, for example to attach to a bug report. Keys and tokens are removed from it first. What stays in it: your browser and operating system, screen size and language; the name of your game, scenario and country, its date, round and difficulty; your settings, with the names of your AI provider, model and connections and the host names of the AI endpoints you set up; the text of orders you have queued; on the desktop, the app's own log; and, if you hosted a shared game, the names the other players gave. Saving the file from an error message can add the AI answer that caused the error. Bug reports are GitHub issues, so anything you attach to one is public: read a log before you post it;
• on the desktop, a log file of the app's own errors and warnings (failed requests, messages from the updater), kept in the app's data folder in at most five files of 5 MB. It is not sent anywhere;
• games and scenarios you deleted. In the beta versions the library keeps them under Recently deleted so you can restore them: for 30 days in the desktop app, and for 7 days on the website and Android, where only the last five things you deleted are kept; emptying Recently deleted removes them at once. In the stable version, the website and the Android app delete them at once, and the desktop app moves them into a folder named .trash inside its data folder, where they stay until you delete that folder;
• on the desktop, downloaded community scenarios: a cache of up to 1 GB that you can clear in Settings in the beta versions; in the stable version it has no limit, and is cleared by deleting the hub-cache folder in the app's data folder;
• for shared games (beta versions): the name you chose, a key that identifies your installation to the hosts you join, and, if you host, your invite codes;
• your answer about counting visits (see Counting Visits).

You can delete any of it in the game, by clearing the site's data in your browser, or by uninstalling the app. On the desktop, uninstalling leaves the app's data folder in place: delete that folder too if you want everything gone.

Playing over your own network. If you turn on "Let other devices connect" in the desktop app, any device on your network can open, change and delete your games and scenarios and read the app's log, because the app's server has no password and no encryption. It is off unless you turn it on; use it only on a network you trust. If you run the game's server yourself, you are the one holding everything it stores.

Cookies and storage on your device

Umami sets no cookie and stores nothing on your device. Nothing else in Open Historia sets cookies.

Your AI Provider

To play, you connect an AI provider: for example Google Gemini, OpenAI, Anthropic, Groq, OpenRouter or DeepSeek, or a model running on your own computer or network. The game sends that provider prompts built from your game: the state of the world, recent events, and what you type as orders, chat and diplomacy. It can also do this in the background while a game is open. If you play in a language other than English, the game also sends scenario text, and the titles and descriptions of community posts, to be translated. Your key is sent with every request.

What happens to that data is set by the provider's own privacy policy and terms; the provider, not us, is responsible for it. Some providers keep prompts, and some may use them to train models, depending on your plan. We never receive your key or your prompts. On the desktop app, a request that a provider won't accept straight from the page passes through the app's own local server on your computer on its way; it is not stored. If you let other devices on your network send AI calls through the desktop app (a setting in the beta versions), their keys and prompts cross your network without encryption. On Android, a request to a model on your local network is sent by the app itself.

If you want nothing to leave your computer, use a local model through Ollama, LM Studio or llama.cpp. The AI setup guide explains how.

Counting Visits

We would like to know how many people visit and play, and which version they use. For that the website's pages, and the game itself on the website and in the desktop app, can load two visit counters, only after you say yes. The first time you open a page it asks; until you answer, and if you say no, neither counter is loaded and nothing is sent to either. Saying no costs you nothing: everything works the same.

Change my answer

You can also change it in the game under Settings → General → Privacy, or with the Privacy choices link at the foot of each page. Taking a yes back switches both counters off at once and deletes Google's cookies. Your answer is kept on your device for 180 days, and then you are asked again.

Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a no: neither counter is loaded and you are not asked.

If you say yes:

• Google Analytics (Google LLC) receives the address of the page, where you came from, your browser and device type, screen size and language, and your IP address (Google says it uses the IP address to estimate your location and does not store it). It sets the cookies listed above. We use it only to count visits and to see which pages, platforms and versions are used: its advertising features, Google signals and ad personalisation are switched off. Google keeps the detailed data for the period set in our Google Analytics property, at most 14 months; the totals in our reports are kept longer. Google's privacy policy applies.
• Umami (Umami Cloud, run by Umami Software, Inc.) receives the address of the page, where you came from, your browser, operating system and device type, screen size and language, and your IP address, which it uses to estimate your country, region and city and says it does not store. It tells one visitor from another with a scrambled value made from your IP address and browser details, which Umami says changes every month, so it does not follow you from month to month or from site to site. Umami's privacy policy applies. Its servers are cloud.umami.is and gateway.umami.is.

The game also tells Umami which application it is: the website, the desktop app, the desktop beta, the multiplayer build, or a copy of the game's server that you run yourself. That is how we count the players of each. From the desktop app the address the counters receive is only localhost. A server you run yourself is counted only when you open it on the same computer, never at any other address, and not at all if you start it with OH_VISIT_COUNT=0. Our Umami account is in the United States, and we keep these counts for as long as the project runs; nothing in them is your name, an email address, an IP address or a cookie.

The Android app loads neither counter and never asks.

Older versions. Desktop versions released before 13 October 2026 loaded both counters whenever the game was open and online, without asking. Updating the app ends that. In such a version, blocking googletagmanager.com, google-analytics.com, cloud.umami.is and gateway.umami.is in a firewall or DNS filter stops both.

Services the Game Contacts

Any service you connect to sees your IP address and basic browser information. These are the services the game contacts besides your AI provider and, after a yes, the two visit counters:

The game's fonts are part of the game and of the website; none are fetched from Google. A picture that the text of a scenario or of an AI answer points to on another website is not loaded by itself: it is shown as a link. Links to Discord, Reddit, GitHub and other sites open in your browser; those sites' own policies apply there.

Discord (desktop app)

When the Discord app is running on the same computer, the desktop app (and a copy of the game's server you start yourself) tells it what you are playing: the country you lead, the scenario and the in-game date, with how long you have been playing and a link to openhistoria.com. Discord shows this on your profile to people who can see your activity. This passes between the two apps on your computer and never reaches us; Discord's own privacy policy covers what it shows and keeps. To stop it, switch off "Show what I am playing on Discord" under Settings → General → Privacy, or turn off activity sharing in Discord (User Settings → Activity Privacy). In versions without that setting, only Discord's own switch stops it.

The World Map (website only)

On the website, the world map is downloaded while you play. In the stable version it comes from our Cloudflare Worker and from content nodes: computers run by volunteers that keep copies of the map files, so that we do not have to serve them all. When the game opens, it asks the Worker for the list of nodes, checks which of them answer, and then keeps in touch with the one it uses about every 20 seconds while you play. Each node it contacts sees your IP address and your browser type; map files may be loaded from any of them, and the node you use sees which map and hub files you load. Nodes are not run by us and their operators are not vetted. The map files they serve are checked against the project's signature before the game uses them, so a node cannot change the map; a community file fetched through a node is not checked in that way. The node software we publish keeps the addresses of its current visitors in memory for about two minutes to count them, and writes nothing down.

The beta versions do not contact content nodes at all: there the map is part of the site or of the app, and comes from wherever the site is hosted.

Import Counts

The hub shows how many times each scenario's file has been downloaded. GitHub counts that itself when the game downloads the file from the hub, and the count is public. The game reports nothing of its own.

Versions of the game from before 6 October 2026 reported each import to a counter we ran. To count each install once, it kept a one-way hash of your IP address, mixed with a secret, for 365 days, and for an import made while signed in to an old website account, a scrambled marker of that account. That counter no longer stores anything, and the hashes it already holds expire by themselves within a year of being written.

Shared Games

The beta versions can play one game together. Hosting needs the desktop app; anyone can join with an invite code. When you host or join:

• Finding each other. The game posts short sealed messages to public relay servers of the Nostr network (relay.damus.io, nos.lol, relay.primal.net, nostr.mom and relay.nostr.net, each run by its own operator, in various countries) and asks address-lookup servers run by Cloudflare and Google what your public address is. Each of these sees your IP address. The relays cannot read the messages, which are locked with a key made from the invite code.
• Playing. The game then connects you directly to the host. The host's device and yours see each other's IP address. The game does not show your address to the other players, but the messages that set the connection up are locked only with the invite code, so somebody who holds the code and a modified copy of the game could work out the addresses of others who join. Share an invite code only with people you would trust with that.
• What the host receives. The name you chose, the country you play, your version of the game, a key that identifies your installation (so the host can keep your seat and remove or ban a player), and everything you do in the game: your orders, your diplomacy and chat. The host's game sends these to the host's AI provider as part of the shared game, and they can appear in the host's logs and AI records.
• What other players see. Your name, your country and whether you are ready.

None of this passes through or is stored on a server of ours. A host is another player, not us: play with people you trust.

Publishing to the Community Hub

The community hub is a public GitHub repository, and every post there is a GitHub issue. Publishing needs a GitHub account: the game prepares the file and opens GitHub's form, and you submit the post yourself. Everything in a post is public, including:

• your GitHub username and avatar, and the title, description and any credit you write;
• the whole scenario, flag or basemap file, with its covers, flags and maps;
• a random scenario key that links the post to your copy of the scenario, so it can receive updates and suggestions.

The hub checks every file and republishes the checked copy, together with a list of the posts (your username, avatar and the post's text), in the same public repository; that list and those copies are what the game reads. Suggesting changes to someone's scenario posts a public comment with a file of your changes and the name and note you give. Likes are public GitHub reactions.

Scenarios are public domain. Every scenario made in Open Historia that is posted or shared in any way, and every change suggested to one, is dedicated to the public domain under CC0 1.0: anyone may copy, change and share it, for any purpose, without asking or giving credit. That cannot be taken back.

You can edit your posts on GitHub. To take one down, close it on GitHub with "Close as not planned", or ask us: its file and its entry are then removed from the hub. Copies people already downloaded, and the repository's history, are beyond our reach. We close or remove posts that are broken or abusive. GitHub's privacy statement covers GitHub itself.

Old Website Accounts

Earlier versions of the website offered an optional account, through an email link or Google sign-in, to sync games between devices. That feature has been removed, and the game deletes what an old sign-in left in your browser the next time it opens. If you made an account, we still hold on our server: your email address, the copies of what you synced, and a record of which content node you last used. The synced copies are encrypted, but the key can be recovered by us (that is how an account could be recovered), so we are technically able to read them. We don't. Email us from the address you signed up with and we will delete everything tied to it, or send you a copy first if you ask.

Running a Content Node

If you run a content node, our registry records its id, address, public key, capabilities, region, software version, capacity, when it was first and last seen, and the optional operator name you give. The public directory lists the id, address and status; the operator name is shown only to us. We keep the record until the node is removed; email us to have yours removed. As an operator you see the IP addresses of the players your node serves: use them for nothing but serving the files, and keep no record of them.

Contributing Code

Contributions to the code need a signed Contributor License Agreement, collected through cla-assistant.io with your GitHub account. It records your name, email address and, if you sign for one, your organisation. Commits you make are public on GitHub with the name and email address you gave them.

The Android App's Permissions

• Internet and network state: to reach your AI provider, the community hub, the map and updates, and to tell whether you are online.
• Install packages (beta versions): to install its own updates. Android asks you to confirm each one. The stable app does not ask for it: it opens the update's download in your browser.
• Storage (Android 10 and older only): to save exported games and scenarios to your Downloads folder.

The app asks for no location, contacts, camera, microphone or advertising identifier, and contains no advertising or analytics software.

What We Hold, and for How Long

Requests to our website and our Worker pass through Cloudflare, which keeps its own short-lived technical logs. We keep no logs of our own of who visits or plays.

Why We Use It: Our Legal Bases

Where data-protection law such as the EU's GDPR or the UK GDPR applies, this is what we rely on for each thing:

You never have to give us personal information to play, and there is no contract that requires it. We make no decisions about you by automated means and build no profiles.

Your Rights

Most of what the game handles never reaches us, so you control it on your device. For anything we hold, email [email protected]. We answer within 30 days, free of charge, and we may ask you to show that the data is yours (for an old account, by writing from its email address). Data held by Google Analytics, Umami, GitHub, Discord or your AI provider is covered by their own policies, but we will help where we can.

In the European Economic Area, the United Kingdom and Switzerland

You have the right to:

• know whether we hold personal data about you, and receive a copy of it;
• have it corrected or deleted;
• have its use restricted, and receive it in a form you can take elsewhere;
• object, at any time, to anything we do on the basis of our legitimate interests. We then stop unless we have compelling grounds that the law accepts;
• withdraw consent at any time (see Counting Visits). That does not undo what was counted before;
• complain to a data-protection authority: the one where you live, work or think the law was broken. In the EU, the authorities are listed by the European Data Protection Board; in the UK it is the Information Commissioner's Office; in Switzerland, the FDPIC. We would be glad to hear from you first.

In the United States

This section is the notice that the laws of California and of other US states ask for, whether or not those laws apply to a project of this size.

• What we collect. Identifiers and internet activity: your IP address and what you request, seen by the services listed above when you use them; and, only if you said yes, the visit information described under Counting Visits, from which the counters estimate a rough location (a city at most). For old website accounts: an email address. For content node operators and code contributors: the details listed in their sections. We collect no sensitive personal information.
• Where it comes from. From you and your device.
• Why. To run the game and its website, to count visits, and to answer you.
• Who receives it. The service providers named in this policy, each for the purpose given beside it. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done either in the past 12 months, and we do not knowingly do it with the information of anyone under 16.
• Your rights. To know what we hold about you and get a copy, to have it deleted or corrected, and to opt out of sale or sharing (there is none). Email us to use them. You may use an authorised agent; we will ask for proof that the agent acts for you. We will not treat you differently for using your rights.
• Global Privacy Control. We honour it as described under Counting Visits.
• Do Not Track, and tracking by others. A Do Not Track signal is treated as a no to both counters. We do not follow you across other websites. If you say yes to counting, Google Analytics, as a third party, may collect information about your visits to this site over time; its advertising features are switched off here.
• We do not disclose personal information to others for their own direct marketing.

Where Data Is Processed

We are based in the United States, and so are most of the services above: Cloudflare, Google, Umami, GitHub, Esri, Amazon, Discord and most AI providers. Komoot is in Germany. The relay servers shared games use, and content nodes, are run by their own operators in various countries. Your data may therefore be processed in the United States and other countries whose laws differ from yours.

For personal data from the European Economic Area, the United Kingdom and Switzerland, these transfers rest on the European Commission's and the UK's adequacy decisions for US companies certified under the Data Privacy Framework, where the provider is certified, and otherwise on standard contractual clauses in the provider's terms, or on the fact that the transfer is needed to do what you asked for, such as connecting a shared game or fetching a file. Email us if you would like to know which applies to a particular provider.

Children

Open Historia isn't directed at children under 13, or under 16 where the law sets that age, and we don't knowingly collect personal information from children. The game has no accounts, no advertising and no profiling, and the visit counters stay off unless someone says yes. If you are under the age at which you can agree to that yourself where you live (13 in the United States and the United Kingdom, up to 16 in parts of Europe), please answer no, or ask a parent or guardian. If you believe a child's personal information has reached us, email us and we will delete it.

Keeping Your Keys Safe

Because your AI keys are stored on your device without encryption, don't share your device or browser profile with people you don't trust with them. Set a spending limit with your AI provider, and revoke a key there if you think someone else has it.

Changes to This Policy

When the game starts handling data differently, we update this page and the date at the top. We announce significant changes in the release notes and on our Discord, and if a change affects something you agreed to, you are asked again.

Contact

Questions or requests about privacy: [email protected]. The source code of the game is public on GitHub, so you can check what this page says about it for yourself.

Play Open Historia