Account Information: When you register, we collect your email address, your date of birth (to confirm you are 18 or over) and a hashed version of your password. We do not store your password in plain text. If an older account has no recorded birth date, we collect it before its first purchase. Checkout cannot replace a birth date already recorded on the account; contact support to correct a mistake.
Character Data: Name, race, class, stats, inventory, activity logs, messages, and other in-game data you create while playing.
Technical Data: IP address at the time of login, browser/device information (user agent), and timestamps of login activity. This information is used for security purposes and to detect abuse.
Support Messages: What you send through our contact form, with the email address you give us for the reply. We keep only a scrambled form of your IP address with it, to stop the form being flooded.
Payment Information: If you make a purchase, payment details are processed by our payment provider, Stripe. Billing address details are sent to Stripe for tax calculation. We keep the billing country, tax calculation reference, amounts and your purchase consent with the order. We do not store full card numbers or the full billing address in the game database.
Launch Measurement: We record how visitors reach the game and which parts of the demo they try. A random visit ID, the first referring host and campaign tags are kept in sessionStorage for the current browser tab. We store validated demo events and acquisition details when an account is created. A visit ID can then be associated with that account. Demo-event records do not contain a full referring URL or IP address. Visible visits record activity days and return sessions.
We use collected information to operate and improve the Platform, authenticate your identity, prevent fraud and abuse, process transactions, send service-related communications (email verification, password reset), and comply with legal obligations.
We do not sell your personal data to third parties. We do not use your data for advertising profiling.
We share your data only with: service providers who help operate the Platform (database hosting, email delivery via SendGrid, payment processing and tax calculation via Stripe, staff SMS verification via Twilio, GIF search via GIPHY, and database/storage hosting via BurchX Cloud); and law enforcement or regulatory authorities when required by law.
We use session cookies to maintain your authenticated session. We also use browser localStorage to store your active character ID client-side for performance. No third-party advertising cookies are used. SessionStorage also keeps the visit and acquisition details described above for the current tab.
Account and character data is retained for as long as your account is active. You can delete your account yourself in Settings, under Account. It is locked straight away and erased 7 days later, unless you sign in and cancel before then; we never take longer than 30 days. Erasure removes your account, email address, date of birth, characters, inventory and logs. Forum posts and messages that other players took part in stay, shown as written by [deleted], and payment records are kept without your name or account where tax law or fraud prevention requires it.
Account acquisition and activity records are removed with the account. Separate demo-event records are kept for 90 days and then removed in regular batches. Hosting application and request logs follow the provider's separate retention rules.
Depending on your jurisdiction, you may have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your account and associated data; object to or restrict certain processing; and data portability.
To exercise these rights, delete your account from Settings or write to us through our contact form.
We use industry-standard security measures including password hashing (bcrypt), HTTPS encryption, and access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security of your data.
The Platform is for adults aged 18 and over and is not directed at children. We do not knowingly collect personal information from anyone under 18. If we become aware that we have done so, we will close the account and delete that information promptly.
We may update this Privacy Policy from time to time. We will notify you of significant changes via the Platform or by email. Continued use after changes constitutes acceptance of the updated policy.
For privacy questions or requests, use our contact form and choose "Privacy or account deletion".