Privacy Policy

This Privacy Policy explains how Citadel collects, uses, and shares information when you visit the Citadel website, access an official Citadel playtest or browser game, or contact the team.

Third-party destinations such as Discord and X operate under their own privacy policies after you leave our services.

The information collected depends on how you use Citadel. The public marketing site uses Cookiebot to record and apply your cookie choices. Optional analytics and marketing tags remain disabled unless you allow the corresponding category.

• Technical data, including IP address, browser and device information, timestamps, requested pages, referral information, and security or diagnostic logs generated by hosting infrastructure.
• Marketing-site analytics data, including page views, selected content, interactions with calls to action, referring pages, approximate location derived from an IP address, and browser or device details. Google Analytics uses IP addresses during collection and discards raw IP addresses after use.
• Advertising measurement data, if you allow marketing cookies, which may include visits, campaign and click identifiers, selected actions, referring pages, approximate location, and browser or device information processed by advertising platforms such as X or TikTok.
• Account and authentication data used to access a playtest, such as an account identifier, display name, and information supplied by an authentication provider.
• Gameplay and service data, including progression, inventory, fittings, match activity, interactions, reports, moderation records, and crash or performance diagnostics.
• Communications you send directly to the team, including support, legal, privacy, security, and playtest correspondence.

We use information only for legitimate operational and product purposes.

• Provide, secure, maintain, and improve Citadel.
• Measure visits to the public website, understand which content and calls to action are useful, and diagnose site performance.
• Measure advertising performance, attribute campaign results, and build advertising audiences when you allow marketing cookies.
• Authenticate players and preserve account and gameplay state.
• Investigate abuse, cheating, security incidents, and service failures.
• Respond to support, privacy, legal, and community inquiries.
• Comply with legal obligations and enforce the Terms of Service.

We may provide information to vendors that operate hosting, consent management, analytics, advertising measurement, authentication, infrastructure, security, communications, and support services on our behalf. Usercentrics provides Cookiebot, Google provides Tag Manager and Analytics, and advertising measurement may be provided by X and TikTok. These providers process information under their own terms and applicable safeguards.

We may also disclose information when required by law, to protect users or the service, or as part of a merger, financing, acquisition, or transfer of assets. We do not sell personal information. Some laws may define advertising-pixel disclosures as sharing or targeted advertising; those tags remain controlled by your marketing-cookie choice.

Cookiebot uses necessary storage to remember and apply your cookie choices. Statistics tags such as Google Analytics 4 remain blocked unless you allow statistics cookies. If allowed, Google Analytics may set first-party cookies such as _ga and _ga_<container-id> to distinguish users and preserve session state.

Advertising tags such as the X Pixel and TikTok Pixel remain blocked unless you allow marketing cookies. You can reject optional cookies and continue using the site. Use Cookie settings in the footer at any time to change or withdraw your choice.

The Cookie Policy contains the current Cookiebot declaration, including detected cookies, providers, purposes, categories, and durations.

The playable service may separately use cookies or local storage that are necessary for authentication, security, preferences, and session continuity.

We retain information only for as long as reasonably necessary to operate the service, meet legal obligations, resolve disputes, enforce agreements, and protect the security and integrity of Citadel. Retention periods vary by data type and may be shortened when information is no longer needed.

We use reasonable technical and organizational measures to protect information. No online service can guarantee absolute security.

• Attribution sessions, click touchpoints, and creator conversion events: 13 months from collection.
• Successful delivery and retry logs for analytics outbox processing: 90 days after delivery; unresolved dead-letter records are retained while investigated and then deleted or anonymized.
• Creator-program administrative audit logs and accepted-policy records: 24 months from the recorded action or the end of the creator relationship, whichever is later.
• Connected social-provider tokens and imported provider data: while the connection remains active; deleted when the creator disconnects, subject to short-lived backups and documented legal or security holds.
• Creator profiles, registered content, and campaign records: while the creator participates and for up to 24 months afterward for program administration and disputes. Eligible records are removed earlier after a verified deletion request.
• Aggregated or de-identified statistics that no longer identify a creator or player may be retained for product and program analysis.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information, and to withdraw consent where processing relies on consent.

Submit a request to legal@thecitadel.com. We may need to verify your identity before completing a request. You may also have the right to complain to your local data-protection authority.

Citadel and its providers may process information in countries other than your own. Where required, we use recognized safeguards for international transfers and require service providers to protect information consistently with applicable law.

Citadel is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided personal information, contact us so that we can investigate and delete it where required.

Players who have not reached the age of legal majority where they live should use Citadel only with permission from a parent or legal guardian.

We may revise this policy as Citadel develops. Material changes will be posted with a new effective date. Questions and privacy requests can be sent to legal@thecitadel.com.

Citadel uses YouTube API Services when a creator chooses Connect YouTube. Citadel requests read-only access to identify the creator's authorized YouTube channel and import that channel's uploaded videos into the creator workspace.

The imported data can include the channel identifier, channel name and URL; video identifiers, titles, descriptions, URLs, publication times and durations; and public engagement statistics such as views, likes and comments. Citadel also stores encrypted OAuth access and refresh tokens so it can keep the creator-facing dashboard current and match Citadel tracking links to the creator's videos. Citadel does not use this permission to modify or delete content on YouTube.

Citadel uses this data to operate the creator program, display a creator's own connected content, match campaign links, measure campaign results and provide creator support. The creator authorizes Citadel's creator-program team and infrastructure providers to process this data for those purposes. Citadel does not sell Google user data or use it for advertising, credit decisions, or training generalized artificial-intelligence models.

YouTube authorization and imported YouTube API data are retained only while the connection is active and needed for these features. Citadel refreshes connected-channel data regularly. Selecting Disconnect YouTube revokes the Google authorization when available, deletes the stored tokens and imported YouTube API data, and removes YouTube-derived metadata and metrics from content the creator registered manually. A creator can also revoke Citadel through Google Account security settings or request deletion through the contact listed in this policy.

Citadel's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Google Privacy Policy
• YouTube Terms of Service
• Manage Google account access
• Google API Services User Data Policy