Privacy Policy
The English version of this document is the sole legally binding version; translations are provided for convenience only.
Last updated: September 13, 2026
This Privacy Policy explains how personal data is collected, used, disclosed, and protected on the website FOE-Tools (foe.tools) and its associated applications (together, the "Service"). Please read it together with the Cookie Policy and the Legal Notice.
For any privacy-related request, please use the contact form and select the "Legal" reason.
1. Data Controller
The data controller responsible for the processing described in this Policy is:
Krytos, a French société par actions simplifiée unipersonnelle (SASU), share capital €1,000.
- Registered office: 9 rue des Colonnes, 75002 Paris, France.
- RCS Paris 981 775 232; SIRET 981 775 232 00011; intra-community VAT FR54 981 775 232.
- Publication director: Quentin Dauprat.
No data protection officer (DPO) has been appointed, as this is not legally required here. Privacy requests are handled through the contact form (select the "Legal" reason). Beyond the registered office listed above, there is no separate postal address for privacy requests.
2. Nature of the Service
FOE-Tools is a fan-made, independent set of calculators and planners for the game Forge of Empires. The Service is not affiliated with, endorsed, or sponsored by InnoGames GmbH. Forge of Empires and its related marks belong to InnoGames and their respective owners. Some game data may come from the Forge of Empires Fandom wiki (licensed CC-BY-SA). The design, source code, and algorithms of the Service are the property of Krytos SASU.
3. Categories of Personal Data, Purposes, and Legal Bases
The table below summarizes the personal data processed, the purpose of each processing activity, and, for users in the EU/EEA and the United Kingdom, the applicable legal basis under the GDPR / UK GDPR. Where the legal basis is legitimate interest, the interest pursued is stated.
| Category of data | Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Account data (email address, hashed password or authentication credentials, session) | Create and operate a user account, and keep the user signed in | Performance of a contract (Art. 6(1)(b)) |
| User profiles and saved settings (in-game profile data the user chooses to save, such as Great Building levels or tracked worlds, synced across devices when signed in) | Provide and synchronize saved tools and preferences | Performance of a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) in keeping saved settings available across the user's devices |
| Payment and subscription data (billing details, VAT and country, subscription status, handled by Polar as Merchant of Record; card numbers are never stored by Krytos) | Process subscriptions and meet tax and accounting obligations | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Contact and support data (email address, message content, and any optional attachments the user adds, such as a screenshot or a profile-data export) | Answer and manage contact and support requests | Performance of a contract, or legitimate interest (Art. 6(1)(f)) in handling and resolving requests; consent (Art. 6(1)(a)) for the email verification of anonymous requests |
| Anti-bot challenge data (limited technical signals processed by Cloudflare Turnstile on the contact and support forms) | Tell humans and bots apart, and prevent abuse | Legitimate interest (Art. 6(1)(f)) in protecting the Service against bots, abuse, and fraud |
| Technical and security logs (IP address and request metadata, used transiently) | Rate-limiting, web application firewall (WAF), and abuse prevention | Legitimate interest (Art. 6(1)(f)) in keeping the Service secure and diagnosing incidents |
| Error monitoring (technical error context such as stack traces, the URL, and coarse technical metadata, via Sentry) | Diagnose crashes and keep the Service reliable | Legitimate interest (Art. 6(1)(f)) in detecting and fixing errors |
| Analytics (aggregate, cookieless traffic measurement via Cabin) | Measure overall site usage | Legitimate interest (Art. 6(1)(f)) in measuring aggregate audience and improving the Service; no cookies are set, so no consent is required |
| Advertising (advertising identifiers and technical data set by the ad network and Google for ad-supported visitors) | Ad delivery, frequency capping, and, where consent is given, personalization | Consent (Art. 6(1)(a)) via the IAB TCF 2.2 consent management platform |
Providing account and contact data is necessary to create an account or to receive support; without it, the corresponding features of the Service cannot be offered. Personal data is collected directly from you and from your device or browser (for example, technical request metadata).
Anonymous (not signed-in) users
When a user is not signed in, profile data such as saved calculator settings stays in the browser using localStorage and never leaves the device. This is not a server-side processing activity: Krytos does not receive or store this data unless the user creates an account and then chooses to save it.
Anonymous contact requests
For anonymous contact and support requests, a double opt-in email verification (including an MX record check) confirms the email address before a ticket is processed. Tickets that are not verified are purged.
Support attachments
Support requests are handled through a ticket system on the site, not by email. Any attachments you add to a ticket (for example a screenshot, or an export of your saved profile data) are stored in a private Cloudflare R2 object-storage bucket reserved for support attachments, under a key generated on the server from your ticket reference. This bucket is never served from the main website: an attachment is made available only through a short-lived signed link, to you on your ticket page and to support staff. Image attachments are validated and re-encoded before they are stored, and the storage key is always generated server-side (never supplied by the client). Attachments are deleted together with their ticket when the ticket is purged (see Section 7).
4. Advertising and Free vs. Paid Tiers
The Service is free and ad-supported for visitors who do not subscribe. For ad-supported visitors:
- A single advertising network, either Playwire (RAMP platform) or NitroPay, serves all ad-supported visitors at any given time. Krytos selects it on the server, and the two networks never run side by side.
- Advertising cookies and identifiers are set only after consent is given through the IAB TCF 2.2 consent management platform (CMP) provided by the ad network.
- Google Consent Mode v2 applies, with a default of "denied" for advertising and analytics storage until consent is given.
- Paid subscribers do not see ads.
See the Cookie Policy for details, and for how to manage or withdraw advertising consent.
5. Recipients and Subprocessors
Personal data may be processed by the recipients below, acting either as processors or as independent recipients. Where a recipient is located outside the EU/EEA, the transfer safeguard relied upon is indicated (see Section 6).
| Name | Role and purpose | Location | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) | CDN, static hosting (Cloudflare Pages), object storage (R2, which holds user avatars and portraits, and support-ticket attachments), edge caching, WAF and rate-limiting, and Turnstile anti-bot | USA | EU-US Data Privacy Framework and/or Standard Contractual Clauses |
| netcup GmbH (Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany) | Application server (the authenticated app) and PostgreSQL database hosting | Germany (EU) | Within the EU (no transfer) |
| Polar (Polar Software Inc.) | Merchant of Record for subscriptions and payments; seller of record; billing and EU/OSS VAT; card data processed by Polar and its underlying payment processors (for example, Stripe) | USA | EU-US Data Privacy Framework and/or Standard Contractual Clauses |
| Scaleway (Scaleway SAS) (8 rue de la Ville l'Évêque, 75008 Paris, France) | Transactional email delivery (account, support, and verification emails) over SMTP, via Scaleway Transactional Email (TEM) | France (EU) | Within the EU (no transfer) |
| Playwire (Intergi / RAMP platform) or NitroPay | Advertising networks (header bidding); only one of the two is active at any given time; advertising cookies are set only after consent | USA | EU-US Data Privacy Framework and/or Standard Contractual Clauses |
| Google (Google Ireland Ltd / Google LLC) | AdSense, Ad Manager, and DoubleClick served through the ad network above; Consent Mode v2 (default denied); TCF 2.2 consent signaling | USA / EU | EU-US Data Privacy Framework and/or Standard Contractual Clauses |
| Cabin (withcabin.com) | Privacy-friendly, cookieless website analytics; aggregate traffic measurement only, with no cookies and no cross-site tracking | Outside the EU/EEA where applicable | Standard Contractual Clauses where applicable |
| Sentry (Functional Software, Inc.) | Application error monitoring (client and server) | USA | EU-US Data Privacy Framework and/or Standard Contractual Clauses |
Better Auth is a self-hosted authentication library used for session management. It runs on the Krytos-controlled netcup server and is not a third-party recipient; it is mentioned here only as the mechanism behind the session cookie.
6. International Transfers
Personal data is processed both in the EU (netcup, in Germany; Scaleway, in France) and in the United States (Cloudflare, Polar, Sentry, Google, and the applicable ad network). Transfers to the United States rely on the EU-US Data Privacy Framework and/or the Standard Contractual Clauses, together with any applicable supplementary measures. For users in the United Kingdom, transfers rely on the UK Extension to the Data Privacy Framework and/or the UK International Data Transfer Addendum (IDTA) to the Standard Contractual Clauses. A copy of the relevant safeguards can be requested through the contact form (select the "Legal" reason).
7. Retention
- Account data is kept until the user deletes the account or requests erasure.
- Beta phase notice. During the current public beta, data may be wiped when the Service launches. Users are warned of this in advance through an in-app banner.
- Support tickets are automatically closed and then purged after a defined period. When a ticket is purged, its messages and any stored attachments (in R2) are deleted with it. Unverified anonymous tickets, together with their attachments, are purged shortly after submission if the email address is not confirmed.
- Technical and security logs are kept only for as long as they are needed for security and abuse prevention, and no longer.
- Payment and accounting records are kept by Polar as Merchant of Record for the period required by applicable tax and accounting law (in France, generally 10 years for accounting records).
8. Your Rights (EU/EEA and UK: GDPR / UK GDPR)
Subject to the conditions and exemptions in applicable law, you have the right to:
- access your personal data;
- rectify inaccurate or incomplete data;
- erase your data (the "right to be forgotten");
- restrict processing;
- port your data;
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal; and
- lodge a complaint with a supervisory authority.
To exercise these rights, please use the contact form (select the "Legal" reason).
Supervisory authority. The lead supervisory authority is the CNIL (Commission Nationale de l'Informatique et des Libertés), France (www.cnil.fr). Users in the EU/EEA may also lodge a complaint with the supervisory authority of their country of residence; users in the UK may complain to the Information Commissioner's Office (ICO).
9. Your Rights (California: CCPA / CPRA)
If you are a California resident, you have the right to:
- know and access the personal information collected about you;
- delete personal information;
- correct inaccurate personal information; and
- opt out of the "sale" or "sharing" of personal information.
Categories of sources. Personal information is collected mainly directly from you and from your device or browser (for example, technical request metadata).
"Do Not Sell or Share My Personal Information." Krytos does not sell your personal information for money. That said, when you consent to personalized advertising, sharing advertising identifiers and related data with our advertising partners and Google may amount to a "sale" and/or "sharing" (cross-context behavioral advertising) as those terms are defined under the CCPA/CPRA. You can opt out at any time using the "Do Not Sell or Share My Personal Information" control in our consent tool (see the Cookie Policy), and we treat a Global Privacy Control (GPC) browser signal as a valid opt-out request where our consent management platform supports it.
You will not be discriminated against for exercising your rights. To submit a request, please use the contact form (select the "Legal" reason).
10. Security
Krytos uses appropriate technical and organizational measures to protect personal data, including a web application firewall, rate-limiting, anti-bot challenges (Cloudflare Turnstile), transport encryption, hashed authentication credentials, and access controls. No method of transmission or storage is completely secure, and absolute security cannot be guaranteed.
11. Children
The Service is not directed to children under the age of 16 (in the EU/EEA) or 13 (in the United States). Krytos does not knowingly collect personal data from children below these ages. If you believe a child has provided personal data, please use the contact form so the data can be deleted.
12. Changes to This Policy
This Policy may be updated from time to time. The "Last updated" date at the top shows the most recent revision. Where appropriate, material changes will be communicated through the Service.
13. Contact
For any question or request about this Policy or your personal data, please use the contact form and select the "Legal" reason. See also the Cookie Policy and the Legal Notice.