Privacy Policy

What we collect, why we collect it, and how long we keep it. We have tried to make this specific rather than comprehensive-sounding.

What we store

Website account

• Your chosen username and display name.
• Your email address, used for account recovery.
• A hash of your password, produced with argon2id. We cannot read your password and we never see it after you submit it.
• When you registered and when you last signed in.

Sessions

When you sign in, we store a hash of your session token, a hashed form of your IP address, and your browser’s user-agent string. The token in your cookie is random and carries no information about you. Sessions expire, and signing out deletes the record.

Game data

The game server sends us your character’s public statistics: levels, experience, kills, deaths, killstreaks and similar. This is the same data shown on the hiscores. Your in-game password is never sent to this website and is never stored here.

Forum posts

What you write, when you wrote it, and when it was edited. Posts are public by design.

Purchases

The character a purchase is for, what was bought, the amount, and a reference from the payment provider. We never see or store your card details. Those go directly to the payment provider, who handles them under their own policy.

Addresses

IP addresses are hashed before storage and are used only for rate limiting and abuse investigation. We do not keep them in readable form and we do not use them to build a profile of you.

What we do not do

• We do not sell your data.
• We do not run advertising or third-party tracking on this site.
• We do not log passwords, API keys, or payment secrets.
• We do not email you anything other than what you asked for.

Cookies

We set two cookies, both strictly functional:

• A session cookie holding a random token. HttpOnly, so scripts cannot read it, and marked Secure in production.
• A CSRF cookie. Readable by scripts on purpose, because the protection works by the page echoing it back in a header, which a site on another domain cannot do.

No analytics or advertising cookies are set.

How long we keep it

• Sessions: until they expire or you sign out.
• Account link codes: ten minutes, then they are deleted.
• Forum posts and hiscore data: until you ask for removal, or the account is deleted.
• Order and payment records: retained for accounting and dispute resolution, because a chargeback can arrive months after a purchase.

Your data

Ask in Help & Support and we will export or delete what we hold about you. Deleting a website account does not automatically delete the game character it was linked to; say so if you want both gone.

Children

This service is not directed at children under 13. If we learn that an account belongs to one, we will remove it.