Privacy Policy

Data We Store

• Account data — username, password hash (salted, never stored in plaintext), email address if you provide one, and account settings.
• Gameplay data — characters, items, progress, in-game mail, market activity, and event logs needed to run and secure the game.
• Technical data — IP addresses and connection timestamps, kept in server logs for security (rate limiting, abuse investigation, ban enforcement).
• Push subscriptions — if you enable notifications, your browser's push endpoint and keys are stored so we can send expedition/alarm notifications. You can revoke this in your browser at any time.

Cookies

We use only functional cookies — no tracking or advertising cookies:

• portal_session — an httpOnly signed token that keeps you logged in.
• csrf token — protects forms against cross-site request forgery.
• language preference — remembers your chosen portal language.

What We Don't Do

• We do not sell, rent, or share your personal data with third parties.
• We do not run third-party analytics or ad trackers.
• We do not read private in-game mail or chat except when investigating a specific abuse report.

Third Parties

• Hosting — the game runs on a rented VPS; the provider processes network traffic as part of hosting.
• Web push — notifications travel through your browser vendor's push service (Mozilla/Google), governed by their own policies.
• Discord — if you join our Discord, that platform's own privacy policy applies.

Retention & Deletion

Account data is kept while the account exists. Server logs rotate automatically. To request deletion of your account and associated data, contact staff via Discord or in-game mail to an admin — deletion removes your characters and account credentials; anonymized gameplay aggregates may be retained.

Contact

Questions about this policy: reach us on the official Discord or via in-game mail to an admin.