Privacy & data policy

Operator and data controller: Bálint Békési. Contact: abbalint@gmail.com.

Updated: 29 October 2026. This policy describes the current game application.

Data and purposes

We store your username, salted password hash, character name, chosen model and class, level, experience, kills, inventory, equipped weapon, equipped rings, display settings and account creation time. These records are needed to provide the account and multiplayer service you request (performance of a contract). We do not ask for your real name or email to register. Please use a fictional character name.

We store hashed session tokens and expiry times to keep you signed in. The server temporarily uses network addresses to limit authentication attempts for security (legitimate interest in preventing abuse). The limiter stores these in memory; entries expire after one minute and are cleaned on subsequent authentication requests or server restart.

What others can see

Nearby players can see your character name, appearance, class, location, level and game statistics. Your username, password hash and inventory are not broadcast to other players. Gameplay positions are held in server memory and reset on entry. The combat log is held in your page memory.

Chat and parties

When you use chat, the server processes your message text, character name, in-game player identifier, channel and send time to deliver the communication you request (performance of a contract). Global messages go to all currently connected players; party messages go only to current party members. Party members see each other's character names, class and level, even when outside nearby viewing range. Invitations reveal the leader's character name to the invited player.

Chat content is relayed live and is not saved to the application database, written to application logs or retained as server-side history. Each open browser page keeps at most 100 messages per channel in memory. Party chat is cleared from that page when you leave or switch parties; other recipients may retain their received messages or make copies. Account deletion cannot retract content already received or copied by others. Party membership and invitations are held in server memory and removed when you disconnect, leave or the party ends; invitations expire after one minute.

Reports sent by email are separate from live chat. If you report abuse, the operator processes the information you provide to investigate and respond (legitimate interests in protecting players and the service). Include only necessary evidence. Email handling and retention require the operator's review under the published infrastructure and retention information below.

Infrastructure and recipients

The operator and infrastructure providers supporting hosting may process connection information to deliver and protect the service. Hosting locations, infrastructure providers and any international transfer safeguards are not yet documented here. Contact the operator for details.

The application has no advertising, analytics or third-party tracking scripts and no data-sale feature. Hosting or proxy services may maintain their own operational logs.

Retention and deletion

Account data and inventory remain until you delete your account. Sessions expire after seven days; expired session records are cleaned on a subsequent successful sign-in. Logout removes the current session. Account deletion immediately removes your live account, inventory and all sessions from the application database and disconnects your character. Backup and infrastructure log retention periods are not yet documented here. Contact the operator for details; deleting an account does not promise immediate erasure of independent backups or host logs.

Your choices and rights

Use Account settings to download your account data or permanently delete your account. Contact the operator to request access, correction, restriction, objection or portability where applicable. Requests may require identity verification. Where GDPR applies, you may complain to your local data protection supervisory authority; requests are normally addressed within one month, subject to lawful extensions.

We do not use personal data for automated decisions producing legal or similarly significant effects. Security controls include salted password hashing, hashed session tokens and origin checks. No service can promise absolute security.

Changes

Material changes will be described on this page with an updated date. Review the policy before providing additional information.