Privacy Policy

This Privacy Policy describes how the Eve Empire application ("the App", "we", "us") handles your information when you use it on iOS, Android, macOS, or Windows. Eve Empire is a free, fan-made companion application for the MMO game EVE Online. It is not operated by, affiliated with, or endorsed by CCP Games.

Summary

• The App runs on your device and talks directly to EVE Online's official servers and a small number of public game-related APIs.
• We run one small relay server, used only if you pair a phone with the desktop App (sync and phone alerts). It forwards data and keeps only what pairing and delivery need. See Phone ↔ PC sync and Phone alerts.
• We do not collect personal data such as your name, email or EVE login.
• We do not use analytics, tracking, advertising, or third-party SDKs that profile users.
• Your EVE Online login is handled by EVE Online's own SSO. Your password never leaves login.eveonline.com and is never seen, transmitted, or stored by the App.
• All character data, fittings, settings, and cached images are stored locally on your device. They leave it only when sent to EVE Online's official servers as required to display your data, or, if you pair a phone, when synced between your own devices through the relay.

Information we access

EVE Online account data

When you choose to add a character, the App opens EVE Online's official Single Sign-On page in a secure browser session. You authenticate with CCP Games directly. EVE SSO returns to the App an OAuth 2.0 access token and refresh token for the scopes you authorized (skills, wallet, assets, mail, industry, planetary interaction, mining ledger, and similar).

The App uses these tokens to call EVE Online's public ESI API directly from your device, in order to fetch and display your characters' data inside the App. The tokens and the data are stored on your device only.

Where tokens are stored

OAuth tokens are stored in the operating system's secure credential storage:

• iOS / macOS: Apple Keychain (hardware-encrypted)
• Android: Android Keystore (hardware-encrypted on devices that support it)
• Windows: Windows Credential Locker

Tokens are never written to plaintext files or logs and are never transmitted to any party other than EVE Online's own OAuth and ESI servers. They are not synced to a paired phone and never pass through our relay.

Static game data (SDE)

The App downloads EVE Online's public Static Data Export — item types, ship stats, market group structure — from a public GitHub release. This download sends your IP address and the standard request headers to GitHub, governed by GitHub's privacy policy. It contains no personal information about you.

Killboard data (optional)

When you open the Killboard feature, the App fetches public killmail data from the third-party service zKillboard. This sends your IP address to zKillboard. zKillboard data is publicly available; the App does not send any personally identifying information.

Phone ↔ PC sync (optional)

If you pair a phone with the desktop App, your plans, calculations, industry setup, fittings and map bookmarks can be synced between the two. Sync data passes through our relay on Cloudflare (relay.eve-empire.org), encrypted in transit (TLS), and is not stored there. Your EVE login tokens are never synced.

For each pairing the relay stores: a room id, hashes of the access tokens, the device name, a pairing id, and, if you use phone alerts, the phone's push token, its public key, the alert on/off settings and daily usage counters. Like any web host, Cloudflare sees the IP address of each request; the relay counts requests per IP address to limit abuse and keeps these counts for about 2 days.

Pairing data is deleted when you unpair, or after 30 days without activity. A phone's daily quota record is deleted after 30 days without activity. If you never pair a phone, the App does not contact the relay.

Phone alerts (push notifications)

This feature is optional and off by default. When you pair a phone with the desktop App and turn on Alerts on this phone, intel alerts from rules you marked Send to phone are delivered to the phone as push notifications.

What goes through Cloudflare (our relay)

Pairing, sync and alerts pass through a small relay we run on Cloudflare (relay.eve-empire.org), over TLS. The relay forwards messages and does not store their content. It keeps only:

• hashes of the pairing tokens and the device names you paired;
• for push: the phone's Firebase Cloud Messaging token (the address used to deliver a notification) and a public key created by the App on the phone, used to check that registration requests really come from that phone;
• daily counters of alerts, used for the daily limits.

What goes through Google and Apple

Each alert is sent through Google Firebase Cloud Messaging and, on iPhone, also through the Apple Push Notification service. The alert contains the rule name, the solar system, pilot names and the message from your intel channels. That message can be text from private alliance or corporation channels. See Firebase privacy information and the Apple privacy policy.

Delivery and display

• Delivery is best effort. Google, Apple or the phone's operating system may delay or drop a notification, and missed alerts are not sent again.
• The phone shows alerts on the lock screen according to its notification settings. On Android the lock screen shows only "Intel alert"; the details appear after unlocking. On iPhone the system preview setting applies.

How to turn it off

• Turn off the Alerts on this phone switch in the App on the phone (Settings → Devices), or
• unpair the phone, on the phone or on the computer.

Retention

• The Firebase token and the phone's public key are deleted from the relay when the phone is unpaired, or after 30 days without any connection or alert.
• Daily counters reset every day.

Information we do not collect

• We do not collect names, email addresses, phone numbers, or any contact information.
• We do not collect advertising IDs or location data. If you pair a phone for alerts, the relay keeps that phone's push token and an App-created public key, used only to deliver alerts and to apply usage limits.
• We do not collect crash reports, usage metrics, telemetry, or diagnostic events.
• We do not use cookies, fingerprinting, or any cross-app tracking.
• We do not have a user database. The only server data is the small pairing and delivery record described above, and only if you pair a phone.

Third-party services

The App communicates with the following third-party services, only as required to provide its functionality:

• EVE Online SSO and ESI API (CCP Games hf) — authentication and your character data. CCP privacy policy.
• zKillboard — public killmail data, used only when you open the Killboard feature. zKillboard.com.
• GitHub — distribution of static game data updates and desktop app installers. GitHub privacy policy.
• EVE Online image servers (images.evetech.net) — portraits, ship renders, and item icons used inside the App.
• Cloudflare — hosts our relay, used only if you pair a phone with the desktop App. Cloudflare privacy policy.
• Google Firebase Cloud Messaging — delivers phone alerts, used only if you turn them on. Firebase is used only for push; no Firebase Analytics or Crashlytics. Firebase privacy information.
• Apple Push Notification service — delivers phone alerts on iPhone, used only if you turn them on. Apple privacy policy.

No third-party advertising, analytics, or attribution SDKs are integrated into the App.

Data retention and deletion

Your data lives on your devices. The only exception is the small relay record for a paired phone, described in Phone ↔ PC sync. To delete it:

• Remove a character from inside the App (Settings → Character Management) to revoke the OAuth token and erase the cached data for that character.
• Unpair the phone (on the phone or on the computer) to delete the pairing data on the relay.
• Uninstall the App to remove all locally stored tokens, cache, and settings.
• Revoke access from EVE Online's side at any time: community.eveonline.com/support/third-party-applications.

Apart from the relay record, which is deleted on unpair or after 30 days without activity, we store nothing about you on our side.

Security

All network communication uses HTTPS/TLS. OAuth uses the authorization-code flow with PKCE, so even a compromised network cannot replay your authorization. Tokens are stored in hardware-backed keystores where available. EVE tokens and game data are not stored on any server of ours; the relay stores only token hashes and the pairing and delivery record described above.

Children's privacy

EVE Online's End User License Agreement requires players to be at least 13 years old. The App is not intended for and not marketed to children under 13. The App does not knowingly collect any information from children.

Changes to this policy

If we ever change this Privacy Policy — for example, to add a new optional third-party service — we will update the "Last updated" date at the top of this page and announce the change in the App's release notes.

Contact

Questions or concerns about this policy can be sent to supportforapp@gmail.com.

---

Eve Empire is not affiliated with or endorsed by CCP Games. EVE Online and the EVE logo are the registered trademarks of CCP hf.