Privacy policy

Chrome extension · Item ID ncgdildidnfopianemhdihhiiaeefdhi · Publisher: Ebrahem (sole developer)

Travian Toolbox ("the extension") is a browser add-on that helps players of the online game Travian find inactive villages to farm, analyse raid reports, and catalogue oases. This policy explains, in full, what data the extension collects, how it is handled, where it is stored, who it is shared with, how long it is kept, and how you can delete it.

Tip — Summary. The extension collects your email address and name (for the paid membership account) and your Travian player name and game server (to tie a membership to one game account). Everything else — game data it reads to build results — stays on your own computer in local browser storage and is never transmitted anywhere. No data is ever sold, rented, or shared with advertisers or data brokers, and none of it is used for advertising, profiling, or creditworthiness.

1. Who is responsible for your data

The extension is developed and operated by an individual developer ("we", "us"). We are the data controller for the information described in this policy. Contact details are in section 11.

2. Data we collect

2.1 Account and identity data — transmitted to our server

The extension includes paid membership features. To create and verify a membership, we collect and transmit the following:

Data	When it is collected	Why
Email address	When you register, log in, or sign in with Google	Identifies your account, enables login, and lets us contact you about your membership
Name (as you enter it)	When you register	Labels your account
Password	When you register or log in with email	Authenticates you. Sent over HTTPS and stored only in hashed form on our server; we never store it in the browser
Google account token	Only if you choose "Sign in with Google"	Exchanged with our server to verify your identity and read your email address and basic profile. Obtained through Chrome's identity API using the OAuth scopes openid, email, and profile
Travian player name and server host	When your membership is validated or activated	Locks one membership to one game account, so a licence cannot be shared between players
Session token	Issued by our server on successful login	Keeps you signed in. Stored locally in the browser; sent back to our server to authorise licence checks

These requests go to https://travian-toolbox.ebrahem.dev/api/v1 over HTTPS, to the endpoints /auth/register, /auth/login, /auth/google, /auth/logout, /memberships, /account-status, and /validate.

2.2 Game data — read and stored locally only

To do its job, the extension reads pages you are already logged into and viewing on your Travian game server, and pages from inactivesearch.com. This includes:

Your current server hostname, village name, village coordinates, and player name, detected from the game page
Your farm lists and the villages already in them
Villages returned by inactive-village searches (coordinates, population, tribe, alliance, owner name)
Raid report contents from your rally point (wave times, troop losses, resources hauled)
Oases and their animal counts, collected as you pan the game map
Your filter settings, chosen language, sort order, and which tool was last open

Note — Important. None of the game data in section 2.2 is ever transmitted off your device. It is written to chrome.storage.local, which lives on your own computer, and it is read back only by the extension itself to display your results. We cannot see it.

2.3 Data we do not collect

We do not collect your Travian username or password. The extension never asks for game credentials and never sees them — it reads pages your browser is already authenticated for.
We do not collect browsing history, and we do not read pages outside the game servers and inactivesearch.com.
We do not collect health, financial, biometric, location, or personal communications data.
We do not use analytics, tracking pixels, advertising SDKs, or third-party trackers of any kind.
We do not use cookies for tracking.

3. How we handle and use your data

We use the data in section 2.1 strictly for the following purposes:

Authentication — creating your account and keeping you signed in.
Licence enforcement — checking whether your membership is active, and binding it to a single Travian player name so one licence is not used by several people.
Support and billing correspondence — if you contact us about your membership, your email address identifies your account. Where you choose to contact us via WhatsApp, a prefilled message may include your email address so we can locate your account.

We do not use your data for automated decision-making that produces legal effects, for profiling, for advertising, or for training machine-learning models. We do not sell or rent it, and we do not transfer it to third parties for their own purposes.

4. Where your data is stored

On your device. All game data, your filter preferences, and your session token are stored in chrome.storage.local on your own computer. This area is private to the extension and is not synced to other devices by us.
On our server. Your name, email address, hashed password, membership status, and the Travian player name and server bound to your membership are stored on our licensing server at travian-toolbox.ebrahem.dev. All traffic between the extension and that server uses HTTPS/TLS. Access to the server is restricted to the developer.

We do not sell, rent, trade, or otherwise transfer your personal data for commercial purposes. Data is shared only in these limited cases:

Recipient	What is shared	Why
Google (only if you use Sign in with Google)	The OAuth exchange necessary to authenticate you	To verify your identity and return your email and basic profile. Governed by the Google Privacy Policy
Our hosting provider	Account data at rest, as part of hosting the licensing server	Infrastructure only; the provider processes data on our instructions and does not use it for its own purposes
Legal authorities	Only what is legally compelled	Where required by valid law, regulation, or legal process

inactivesearch.com and Travian: the extension requests pages from these sites the same way your browser would when you visit them yourself. Search requests to inactivesearch.com are sent without your cookies or credentials. Requests to your Travian server reuse your existing game session, because reading your own farm lists and reports requires you to be logged in. We send no personal data of our own to either site; their handling of your visit is governed by their own privacy policies.

6. Use of Chrome permissions

Each permission the extension requests is used only for the purpose stated:

Permission	Purpose
`storage`	Save your settings and results locally on your device
`tabs`, `activeTab`, `scripting`	Detect which game server and village you are on, and read the game pages needed to build your results
`downloads`	Export your own results to a file when you click export
`identity`	Optional "Sign in with Google" for your membership account
Host access to `*.travian.com`, `inactivesearch.com`, `travian-toolbox.ebrahem.dev`	Read game and search pages, and contact the licensing server. The extension does not run on any other website

7. How long we keep data

Local data on your device is kept until you clear it from the extension, or until you uninstall the extension, at which point Chrome deletes it automatically.
Account data on our server is kept for as long as your account exists. If you ask us to delete your account, we remove your personal data within 30 days, except where we must retain limited records to meet a legal or accounting obligation.

8. Your rights and choices

You may, at any time:

Access the personal data we hold about you.
Correct inaccurate data.
Delete your account and the personal data attached to it.
Export a copy of your account data.
Withdraw consent by signing out and uninstalling the extension.
Object to or restrict processing, where applicable law provides that right.

To exercise any of these, contact us on one of the channels in section 11. We respond within 30 days. If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection authority.

To delete local data immediately: remove the extension from chrome://extensions. Chrome erases its local storage on uninstall.

9. Security

All communication with our licensing server uses HTTPS/TLS. Passwords are stored only as salted hashes and are never stored on your device. Session tokens are held in the extension's private local storage and are invalidated when you sign out. We limit server access to the developer alone. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security, but we take reasonable measures appropriate to the data involved.

10. Children

The extension is not directed at children under 13 (or the minimum age of digital consent in your country). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Contact

For privacy questions, data access requests, or account deletion:

Message us on Discord or WhatsApp.

Please include the email address associated with your account so we can locate it.

12. Changes to this policy

We may update this policy as the extension changes. The "last updated" date at the top of this page always reflects the current version. Material changes affecting how we handle your personal data will be announced through the extension or by email to registered users before they take effect. Continued use after a change takes effect constitutes acceptance of the revised policy.

13. Compliance with Chrome Web Store policies

We affirm that our collection and use of information complies with the Chrome Web Store Developer Program Policies, including the Limited Use requirements. Specifically:

We collect only data required for the user-facing features described above.
We do not sell user data, transfer it for advertising or creditworthiness purposes, or use it for personalised advertising.
We do not transfer user data to third parties except as set out in section 5, and never for their independent use.
Humans do not read user data except with your explicit consent for support, where required for security, or where compelled by law.

Travian Toolbox is an unofficial, independent tool. It is not affiliated with, endorsed by, or sponsored by Travian Games GmbH or inactivesearch.com. All trademarks belong to their respective owners.