Privacy Policy

Last updated and in effect from 6 November 2026

Open Historia is a free, open-source strategy game. It runs on your own device: in the browser at openhistoria.com, as a desktop app for Windows, macOS and Linux, and as an Android app. This policy covers all of them, in their stable and beta versions. It explains what the game keeps on your device, what it sends elsewhere and to whom, what the project itself holds about you, and the rights you have.

Who is responsible. "We" means Nicholas Krol, an individual in the United States who runs the Open Historia project and its servers, and who is the data controller for what this policy describes. You can reach us at nichojkrol@gmail.com. Open Historia is a non-commercial project: it has no advertising, sells nothing and has no paid accounts.

The Short Version

What Stays on Your Device

Everything you make and play is stored on your device: in your browser's storage on the website, in the app's storage on Android, and in the app's data folder on the desktop. That includes:

• your games, scenarios, maps, flags, basemaps and settings, and any language packs the game builds for you;
• your AI keys and endpoints. They are stored as they are, without encryption, so anyone who can use your device or browser profile could read them. On Android, if device backup is turned on, Android may include the app's data, keys among it, in your backup;
• the place feeds Rostra's Search has shown you (the posts your AI model wrote about a place), kept so that opening one again costs no AI request (beta versions);
• a record of recent AI calls (the prompts and the answers: the last 200, and more from the session you are in), which the AI debug console shows and can save to a file exactly as recorded. It is kept unless you turn off Record AI telemetry in Settings; in the beta Android app it is kept only if you turn that on;
• the diagnostics log: warnings, errors and milestones, and the text of advisor and diplomacy conversations only if you turn on detailed logging. It is never sent automatically. It leaves your device only when you copy or save it yourself, for example to attach to a bug report. Keys and tokens are removed from it first. What stays in it: your browser and operating system, screen size and language; the name of your game, scenario and country, its date, round and difficulty; your settings, with the names of your AI provider, model and connections and the host names of the AI endpoints you set up; the text of orders you have queued; and, on the desktop, the app's own log. Saving the file from an error message can add the AI answer that caused the error. Bug reports are GitHub issues, so anything you attach to one is public: read a log before you post it;
• on the desktop, a log file of the app's own errors and warnings (failed requests, messages from the updater), kept in the app's data folder in at most five files of 5 MB. It is not sent anywhere;
• games and scenarios you deleted. In the beta versions the library keeps them under Recently deleted so you can restore them: for 30 days in the desktop app, and for 7 days on the website and Android, where only the last five things you deleted are kept; emptying Recently deleted removes them at once. In the stable version, the website and the Android app delete them at once, and the desktop app moves them into a folder named .trash inside its data folder, where they stay until you delete that folder;
• on the desktop, downloaded community scenarios: a cache of up to 1 GB that you can clear in Settings in the beta versions; in the stable version it has no limit, and is cleared by deleting the hub-cache folder in the app's data folder;
• music a scenario plays (beta versions): each track is downloaded from the community hub once and kept on your device, in the desktop app and on the website, so that it is not downloaded again when another scenario plays it. It stays until you clear it in Settings, until the last scenario that plays it is deleted, or until it is replaced by newer tracks at the limit (1 GB in the desktop app, 300 MB on the website). The Android app keeps none: it plays a track from the hub each time;
• detailed maps you download (beta versions, desktop app): each is downloaded from the community hub once, checked, and kept in the app's data folder for every scenario that uses it;
• the speech model for the Advisor's microphone, if you downloaded one (beta versions; see The Advisor's Microphone), kept in the game's storage until you clear it;
• the translation model, if you downloaded one (beta versions; see Translation on Your Device): one language's, kept in the game's storage until you clear it, and, if you turn on "Translate with my AI", what your AI provider translated, kept beside it;
• if you use your own Agent (beta versions, on the desktop; see Your AI Provider): a folder in the app's data folder holding the instructions the game writes for your Agent, and each prompt waiting for it, deleted as soon as it is answered or cancelled;
• your answer about counting visits (see Counting Visits).

You can delete any of it in the game, by clearing the site's data in your browser, or by uninstalling the app. On the desktop, uninstalling leaves the app's data folder in place: delete that folder too if you want everything gone.

Playing over your own network. If you turn on "Let other devices connect" in the desktop app, any device on your network can open, change and delete your games and scenarios and read the app's log, because the app's server has no password and no encryption. It is off unless you turn it on; use it only on a network you trust. If you run the game's server yourself, you are the one holding everything it stores.

Cookies and storage on your device

Umami sets no cookie and stores nothing on your device. Nothing else in Open Historia sets cookies.

Your AI Provider

To play, you connect an AI provider: for example Google Gemini, OpenAI, Anthropic, Groq, OpenRouter or DeepSeek, or a model running on your own computer or network. The game sends that provider prompts built from your game: the state of the world, recent events, and what you type as orders, chat and diplomacy. It can also do this in the background while a game is open. The game is translated on your device, and never by your provider, unless you turn on "Translate with my AI" (beta versions): then, if you play in a language other than English, it also sends scenario text, names on the map, the titles and descriptions of community posts, and in some languages the game's own text, to be translated (see Translation on Your Device). Your key is sent with every request.

What happens to that data is set by the provider's own privacy policy and terms; the provider, not us, is responsible for it. Some providers keep prompts, and some may use them to train models, depending on your plan. We never receive your key or your prompts. On the desktop app, a request that a provider won't accept straight from the page passes through the app's own local server on your computer on its way; it is not stored. If you let other devices on your network send AI calls through the desktop app (a setting in the beta versions), their keys and prompts cross your network without encryption. On Android, a request to a model on your local network is sent by the app itself.

Your own Agent (beta versions, on the desktop). Instead of a key, you can let an agent program you run yourself (Claude Code, Codex, OpenCode or Antigravity CLI) answer what you start. The game then writes each prompt as a file in a folder of its own inside the app's data folder, and your Agent reads it through the app's local server, which answers only this computer and only with the token the game writes into that folder. The file is deleted as soon as the prompt is answered or cancelled. Your Agent sends the prompt to its own provider under your account there, so that provider's terms apply, as above. The game never starts your Agent and never reads its sign-in.

If you want nothing to leave your computer, use a local model through Ollama, LM Studio or llama.cpp. The AI setup guide explains how.

Counting Visits

We would like to know how many people visit and play, and which version they use. For that the website's pages, and the game itself on the website and in the desktop app, can load two visit counters, only after you say yes. The first time you open a page it asks; until you answer, and if you say no, neither counter is loaded and nothing is sent to either. Saying no costs you nothing: everything works the same.

Change my answer

You can also change it in the game under Settings → General → Privacy, or with the Privacy choices link at the foot of each page. Taking a yes back switches both counters off at once and deletes Google's cookies. Your answer is kept on your device for 180 days, and then you are asked again.

Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a no: neither counter is loaded and you are not asked.

If you say yes:

• Google Analytics (Google LLC) receives the address of the page, where you came from, your browser and device type, screen size and language, and your IP address (Google says it uses the IP address to estimate your location and does not store it). It sets the cookies listed above. We use it only to count visits and to see which pages, platforms and versions are used: its advertising features, Google signals and ad personalisation are switched off. Google keeps the detailed data for the period set in our Google Analytics property, at most 14 months; the totals in our reports are kept longer. Google's privacy policy applies.
• Umami (Umami Cloud, run by Umami Software, Inc.) receives the address of the page, where you came from, your browser, operating system and device type, screen size and language, and your IP address, which it uses to estimate your country, region and city and says it does not store. It tells one visitor from another with a scrambled value made from your IP address and browser details, which Umami says changes every month, so it does not follow you from month to month or from site to site. Umami's privacy policy applies. Its servers are cloud.umami.is and gateway.umami.is.

The game also tells Umami which application it is: the website, the desktop app, the desktop beta, or a copy of the game's server that you run yourself. That is how we count the players of each. From the desktop app the address the counters receive is only localhost. A server you run yourself is counted only when you open it on the same computer, never at any other address, and not at all if you start it with OH_VISIT_COUNT=0. Our Umami account is in the United States, and we keep these counts for as long as the project runs; nothing in them is your name, an email address, an IP address or a cookie.

The Android app loads neither counter and never asks.

Older versions. Desktop versions released before 13 October 2026 loaded both counters whenever the game was open and online, without asking. Updating the app ends that. In such a version, blocking googletagmanager.com, google-analytics.com, cloud.umami.is and gateway.umami.is in a firewall or DNS filter stops both.

Services the Game Contacts

Any service you connect to sees your IP address and basic browser information. These are the services the game contacts besides your AI provider and, after a yes, the two visit counters:

The game's fonts are part of the game and of the website; none are fetched from Google. A picture that the text of a scenario or of an AI answer points to on another website is not loaded by itself: it is shown as a link. Links to Discord, Reddit, GitHub and other sites open in your browser; those sites' own policies apply there.

Discord (desktop app)

When the Discord app is running on the same computer, the desktop app (and a copy of the game's server you start yourself) tells it what you are playing: the country you lead, the scenario and the in-game date, with how long you have been playing and a link to openhistoria.com. Discord shows this on your profile to people who can see your activity. This passes between the two apps on your computer and never reaches us; Discord's own privacy policy covers what it shows and keeps. To stop it, switch off "Show what I am playing on Discord" under Settings → General → Privacy, or turn off activity sharing in Discord (User Settings → Activity Privacy). In versions without that setting, only Discord's own switch stops it.

The Advisor's Microphone (beta versions)

The microphone on the Advisor's input bar turns what you say into a message. It never uses your AI provider: only the text you send reaches it, as if you had typed it. Which recogniser listens depends on where you play:

• In the desktop app on Windows, Windows' own speech recognition listens first. Windows recognises dictation through Microsoft's online speech service, so while it listens your voice is sent to Microsoft, under Microsoft's privacy statement. It only works if you have turned on Online speech recognition in Windows (Settings → Privacy & security → Speech); the game never turns it on for you. Where it is off, or Windows has no speech recognition for your language, the speech model below is used instead.
• In the desktop app on macOS, macOS's own speech recognition listens first. Where the Mac has the language's model, it recognises your speech on the Mac and nothing is sent; otherwise macOS sends your voice to Apple to be recognised, under Apple's privacy policy. macOS asks you once whether the app may use speech recognition and the microphone. If you say no, or it cannot listen, the speech model below is used instead.
• In the desktop app on Linux, wherever the system's speech recognition cannot listen, and in a browser with no speech recognition of its own (such as Firefox), a speech model runs on your device: Whisper base, for every language (about 80 MB). It is downloaded from Hugging Face the first time, only after you press Download, and kept in the game's storage. With it, your voice never leaves your device.
• In a browser that has speech recognition (such as Chrome, Edge or Safari), the game uses the browser's. The browser may send your voice to its maker's service to be recognised (Chrome sends it to Google), under that company's privacy policy.
• In the Android app, the phone's own speech recognition service listens (on most phones, Google's). Depending on the phone and its settings, it may recognise speech on the phone or send it to that service.

Nothing you say is recorded or sent to us. The microphone listens only from when you press it until your message is sent or you press it again.

Translation on Your Device (beta versions)

In some languages (Arabic, Chinese, Dutch, French, German, Indonesian, Italian, Portuguese, Russian, Spanish and Swedish, and Czech, Danish, Estonian, Finnish, Greek, Hebrew, Hungarian, Irish, Latvian, Lithuanian, Maltese, Romanian and Slovak) what the game's language packs do not cover is translated on your device, by an Opus-MT model from the University of Helsinki (CC BY 4.0). The game asks first, with the size of the download (110 to 150 MB, for your language only). The model is downloaded once, after you press Download, from Hugging Face or, for some languages, from the game's own copy on GitHub, and kept in the game's storage; it runs in the game, so the text it translates never leaves your device, and nothing is sent to your AI provider to be translated. If you prefer your AI provider's translations, Settings → General → Language has a switch, "Translate with my AI", which is off unless you turn it on, and is offered only once the model is downloaded. On, the text the model would translate is sent to your AI provider instead, as above, a few large requests at a time that count against your AI requests; what it translates is kept on your device, and the model translates whatever your provider does not answer. Off again, the model translates it all, and nothing more is sent.

The World Map (website only)

On the website, the world map is part of the site: its files are loaded from openhistoria.com itself, like the rest of the page, and nothing else is contacted for them.

Install Counts

To know how many people install the game, each app downloads one small text file of its own from the game's GitHub releases: main app.txt (the desktop app), beta app.txt (the desktop beta), native app.txt (the native app), android app.txt and android beta app.txt (the two Android apps). It does this once, the first time it starts after being installed, or after being updated to the version that added this. GitHub counts how many times each file is downloaded, and those counts are public on the release page. The request carries nothing about you or your games: no identifier, no settings and nothing added to the address. As with any website, GitHub sees your IP address and basic details of the connection, and GitHub's privacy statement applies.

The app then notes on your device that it has done this (in its own data folder, or in the Android app's own settings) and never downloads the file again. If you are offline it tries again on a later start, until one download goes through. It happens once per install whatever you answered about counting visits, because it counts installs, not visits. Removing the app together with its data and installing it again counts again. The website, and a copy of the game run from its source code, never download these files.

Import Counts

The hub shows how many times each scenario's file has been downloaded. GitHub counts that itself when the game downloads the file from the hub, and the count is public. The game reports nothing of its own.

Versions of the game from before 6 October 2026 reported each import to a counter we ran. To count each install once, it kept a one-way hash of your IP address, mixed with a secret, for 365 days, and for an import made while signed in to an old website account, a scrambled marker of that account. That counter no longer stores anything, and the hashes it already holds expire by themselves within a year of being written.

Publishing to the Community Hub

The community hub is a public GitHub repository, and every post there is a GitHub issue. Publishing needs a GitHub account: the game prepares the file and opens GitHub's form, and you submit the post yourself. Everything in a post is public, including:

• your GitHub username and avatar, and the title, description and any credit you write;
• the whole scenario, flag or basemap file, with its covers, flags and maps;
• a random scenario key that links the post to your copy of the scenario, so it can receive updates and suggestions.

The hub checks every file and republishes the checked copy, together with a list of the posts (your username, avatar and the post's text), in the same public repository; that list and those copies are what the game reads. Suggesting changes to someone's scenario posts a public comment with a file of your changes and the name and note you give. Likes are public GitHub reactions.

Scenarios are released under CC BY 4.0. Every scenario made in Open Historia that is posted or shared in any way, and every change suggested to one, is released under the Creative Commons Attribution 4.0 International licence. That cannot be taken back.

You can edit your posts on GitHub. To take one down, close it on GitHub with "Close as not planned", or ask us: its file and its entry are then removed from the hub. Copies people already downloaded, and the repository's history, are beyond our reach. We close or remove posts that are broken or abusive. GitHub's privacy statement covers GitHub itself.

Old Website Accounts

Earlier versions of the website offered an optional account, through an email link or Google sign-in, to sync games between devices. That feature has been removed, and the game deletes what an old sign-in left in your browser the next time it opens. If you made an account, we still hold on our server: your email address and the copies of what you synced. The synced copies are encrypted, but the key can be recovered by us (that is how an account could be recovered), so we are technically able to read them. We don't. Email us from the address you signed up with and we will delete everything tied to it, or send you a copy first if you ask.

Contributing Code

Contributions to the code need a signed Contributor License Agreement, collected through cla-assistant.io with your GitHub account. It records your name, email address and, if you sign for one, your organisation. Commits you make are public on GitHub with the name and email address you gave them.

The Android App's Permissions

• Internet and network state: to reach your AI provider, the community hub, the map and updates, and to tell whether you are online.
• Install packages (beta versions): to install its own updates. Android asks you to confirm each one. The stable app does not ask for it: it opens the update's download in your browser.
• Storage (Android 10 and older only): to save exported games and scenarios to your Downloads folder.
• Microphone (beta versions): for the Advisor's microphone, which hands what you say to the phone's speech recognition (see The Advisor's Microphone). Android asks the first time you press it.

The app asks for no location, contacts, camera or advertising identifier, and contains no advertising or analytics software.

What We Hold, and for How Long

Requests to our website and our Worker pass through Cloudflare, which keeps its own short-lived technical logs. We keep no logs of our own of who visits or plays.

Why We Use It: Our Legal Bases

Where data-protection law such as the EU's GDPR or the UK GDPR applies, this is what we rely on for each thing:

You never have to give us personal information to play, and there is no contract that requires it. We make no decisions about you by automated means and build no profiles.

Your Rights

Most of what the game handles never reaches us, so you control it on your device. For anything we hold, email nichojkrol@gmail.com. We answer within 30 days, free of charge, and we may ask you to show that the data is yours (for an old account, by writing from its email address). Data held by Google Analytics, Umami, GitHub, Discord or your AI provider is covered by their own policies, but we will help where we can.

In the European Economic Area, the United Kingdom and Switzerland

You have the right to:

• know whether we hold personal data about you, and receive a copy of it;
• have it corrected or deleted;
• have its use restricted, and receive it in a form you can take elsewhere;
• object, at any time, to anything we do on the basis of our legitimate interests. We then stop unless we have compelling grounds that the law accepts;
• withdraw consent at any time (see Counting Visits). That does not undo what was counted before;
• complain to a data-protection authority: the one where you live, work or think the law was broken. In the EU, the authorities are listed by the European Data Protection Board; in the UK it is the Information Commissioner's Office; in Switzerland, the FDPIC. We would be glad to hear from you first.

In the United States

This section is the notice that the laws of California and of other US states ask for, whether or not those laws apply to a project of this size.

• What we collect. Identifiers and internet activity: your IP address and what you request, seen by the services listed above when you use them; and, only if you said yes, the visit information described under Counting Visits, from which the counters estimate a rough location (a city at most). For old website accounts: an email address. For code contributors: the details listed in their section. We collect no sensitive personal information.
• Where it comes from. From you and your device.
• Why. To run the game and its website, to count visits, and to answer you.
• Who receives it. The service providers named in this policy, each for the purpose given beside it. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done either in the past 12 months, and we do not knowingly do it with the information of anyone under 16.
• Your rights. To know what we hold about you and get a copy, to have it deleted or corrected, and to opt out of sale or sharing (there is none). Email us to use them. You may use an authorised agent; we will ask for proof that the agent acts for you. We will not treat you differently for using your rights.
• Global Privacy Control. We honour it as described under Counting Visits.
• Do Not Track, and tracking by others. A Do Not Track signal is treated as a no to both counters. We do not follow you across other websites. If you say yes to counting, Google Analytics, as a third party, may collect information about your visits to this site over time; its advertising features are switched off here.
• We do not disclose personal information to others for their own direct marketing.

Where Data Is Processed

We are based in the United States, and so are most of the services above: Cloudflare, Google, Umami, GitHub, Hugging Face, Esri, Amazon, Discord, Microsoft, Apple and most AI providers. Komoot is in Germany. Your data may therefore be processed in the United States and other countries whose laws differ from yours.

For personal data from the European Economic Area, the United Kingdom and Switzerland, these transfers rest on the European Commission's and the UK's adequacy decisions for US companies certified under the Data Privacy Framework, where the provider is certified, and otherwise on standard contractual clauses in the provider's terms, or on the fact that the transfer is needed to do what you asked for, such as fetching a file. Email us if you would like to know which applies to a particular provider.

Children

Open Historia isn't directed at children under 13, or under 16 where the law sets that age, and we don't knowingly collect personal information from children. The game has no accounts, no advertising and no profiling, and the visit counters stay off unless someone says yes. If you are under the age at which you can agree to that yourself where you live (13 in the United States and the United Kingdom, up to 16 in parts of Europe), please answer no, or ask a parent or guardian. If you believe a child's personal information has reached us, email us and we will delete it.

Keeping Your Keys Safe

Because your AI keys are stored on your device without encryption, don't share your device or browser profile with people you don't trust with them. Set a spending limit with your AI provider, and revoke a key there if you think someone else has it.

Changes to This Policy

When the game starts handling data differently, we update this page and the date at the top. We announce significant changes in the release notes and on our Discord, and if a change affects something you agreed to, you are asked again.

Contact

Questions or requests about privacy: nichojkrol@gmail.com. The source code of the game is public on GitHub, so you can check what this page says about it for yourself.

Play Open Historia