Privacy Policy

Who operates the site

The operator and data controller for tepanje.com is Tomaž Pačnik (tepanje.com). For privacy questions, access or deletion requests, contact contact@tepanje.com.

Information we use

• Account details: username, email address, password hash, and account creation time. The site stores a password hash, not your readable password.
• Player location: map coordinates, optional place label, and your choice about displaying your marker. Your marker is shown to another player only when you consent and that player has an accepted farm-sharing connection with you.
• Game data: farm coordinates, level, in-game gold balance, active boosts, shop visits, and records needed to prevent reuse of a shop purchase quote.
• Social and chat data: farm access requests and approvals, community messages, and private messages between the players in that conversation.
• Password recovery data: a hashed one-time reset token, its expiry and use time, plus hashed email and IP values used to rate-limit password reset requests.
• Technical data: the hosting provider and security systems may process connection details such as IP address, browser information, and request time in server or security logs.

Why we use this information

We use account and game data to provide sign-in, save your location and progress, operate farm sharing and chat, process in-game shop purchases, prevent abuse, and keep the site secure. Location display is controlled by your choice and is restricted to accepted farm-sharing connections.

Where data protection law requires a legal basis, we process account and game information to provide the features you request, use legitimate interests to secure and prevent abuse of the service, and rely on your consent for displaying your map marker and for optional advertising technologies where required. You can turn off map display in your profile; withdrawing consent does not affect processing that took place before withdrawal.

We use advertising technologies to support the site. Where required, non-essential advertising and related storage are subject to your choices through Google's certified consent management platform (CMP). The essential session cookie is used to keep sign-in and security features working.

Cookies and advertising

The site uses a PHP session cookie for sign-in and security. It is configured as HttpOnly and SameSite=Lax and, when the site is served over HTTPS, as Secure. This cookie is necessary for account features.

Google AdSense may use cookies or similar technologies, including advertising identifiers, to deliver, measure, and, where permitted by your choices, personalize ads. Google may receive information such as your IP address, browser/device information, and interactions with ads. Read Google's information about advertising technologies and manage Google advertising settings at My Ad Center.

For visitors in the EEA, UK, and Switzerland, Google requires publishers serving personalized ads to use a Google-certified CMP integrated with the IAB Transparency and Consent Framework. Use the on-site CMP controls to make or change your choices when they are shown. The publisher must configure and publish the applicable privacy message in AdSense; this policy page alone does not collect advertising consent.

Map and other external services

Some features connect directly to third-party services. Those providers receive technical connection data, and may receive coordinates or route endpoints when needed to answer your request. Their own privacy policies and terms apply.

• OpenStreetMap provides map data and tiles.
• OpenStreetMap Foundation services, including Nominatim and the Overpass API, may receive search or reverse-geocoding locations.
• The public FOSSGIS routing service receives route start and destination coordinates when you request a route.
• fuel-prices.eu supplies diesel-price information for shop estimates.
• Google Fonts and the Leaflet library hosted by unpkg.com are loaded from their respective providers.

These providers may process information in countries other than the one where you live. Review the linked provider policies for information about their own processing and safeguards.

How long information is kept

Account, location, farm, sharing, shop, and private-chat records are kept while the account is active and are deleted when the account is deleted, subject to any retention required for security or law. Password-reset request records older than seven days are purged when a valid reset request is processed; if no later request is processed, those records may remain until the next one. Reset links expire after one hour and are single-use. To request account deletion, email contact@tepanje.com from the account's email address and include your username. Never send your password.

Community messages are intended to expire after 15 seconds and are removed from storage the next time the community chat is requested. The hosting provider may retain technical logs according to its own policies and settings.

Your choices and rights

You can choose whether your map marker is displayed, manage advertising choices through the CMP when presented, and request access to, correction of, or deletion of your account information by contacting contact@tepanje.com. Depending on applicable law, you may also have rights to object to or restrict processing, receive a copy of certain information, and withdraw consent where processing is based on consent. You may lodge a complaint with your local data protection authority. In Slovenia, this is the Information Commissioner.

Security and changes

We use safeguards such as password hashing, protected session cookies, and access controls, but no internet service can guarantee absolute security. This policy may be updated when the site or its data practices change. The date above indicates the latest revision.