Privacy
What is stored, why, and for how long.
What is stored, why, and for how long.
The German version is legally binding.
Oliver Mewes, Grebs 4, 14793 Ziesar. Reachable at omewes92@gmail.com.
The website and the game load nothing from third-party servers — no fonts from Google, no videos, no ad networks, no visitor counting. There are no cookies. Your browser only remembers a few settings (see below), and they never leave your device. That's why there is no consent banner here: there is nothing to consent to.
To send you a page or the game, the server needs your IP address. We do not keep an access log of every request. The game keeps an event log: when a character enters and leaves the world (character name, level, playing time), when an account is created or a password is changed (username and IP address), which errors your browser reports (character name, location in the game world, browser identifier) and which chat lines the content filter rejected (character name and text — so we can see who tries to spread hate). The legal basis is Art. 6(1)(f) GDPR — the legitimate interest in running the game stably and detecting abuse. These entries are deleted after 14 days.
The website remembers whether you switched the music on or off. The game remembers window positions, bars, volume, the map of areas you have already seen, the character you played last and which hints you already know. Your login only lasts until you close the tab. All of this sits in your browser's storage (localStorage or sessionStorage), is not sent to us and can be deleted at any time in your browser settings. It is necessary for the function you yourself request and therefore needs no consent (Section 25(2) No. 2 TDDDG).
We store your username, your email address, an irreversible hash of your password (scrypt), the time the account was created and of your last visit, and the language we write to you in. The legal basis is Art. 6(1)(b) GDPR (no account, no game). In addition, there is the IP address the account was created from: it serves to fend off mass registrations (Art. 6(1)(f) GDPR) and is removed from the account after 30 days.
Your password is never stored in plain text and never transmitted without an encrypted connection.
You can create an account from the age of 16. If you are younger, you need your parents' permission.
We only write to you for three reasons: to confirm your address, to send you a link for a new password when you ask for one, and to warn you before an account that has gone unused for a long time is deleted. You won't get advertising from us, and the address is not passed on. The emails are plain text; measuring opens and clicks is switched off at our email provider.
Everything that makes up your characters: name, appearance, location, gear, experience, crafting, reputation, the progress of your quests and your storage. That is the save state — without it there would be no continuing. Other players see your character's name, appearance and level.
For each character we keep track of its playtime: how long it has been in the game in total, and after how many hours it reached each level. This shows us whether the game progresses too fast or too slow. The numbers belong to the character and are deleted with it.
What you write in chat is passed on to the other players and not stored permanently (exception: a report, see below). Letters you send in the game wait in the recipient's mailbox until they pick them up, for at most 30 days. Market offers remain until they are sold or expire.
When you report a bug in the game (F9), you send us your text, an image of the game window (names and chat lines of other players may be visible on it), character, location, level, active quests, your last game actions, browser identifier and window size. This is voluntary and serves to find the bug (Art. 6(1)(f) GDPR). Reports are deleted after 90 days.
So that insults and troublemakers do not go unanswered, you can report a player (right-click the name, “Report”). For this, the server keeps each player's chat lines in memory for 30 minutes (at most 20, not on disk). Only a report writes them down: who reports, who is reported (character and account), the reason, your text and those chat lines — whispers only if they were sent to you. We review the report and may ban an account temporarily or permanently; the ban and its reason are stored with the account for as long as it is in effect (Art. 6(1)(f) GDPR: a game in which people can feel safe). The same applies when the game staff mutes a character. What the game staff does is recorded with their name in the event log. Reports are deleted after 90 days. Anyone who was reported can learn on request what was reported about them, but not by whom.
So that one bug can't cost the whole world, the server backs up the save state: every five minutes (the last four hours) and once a day (the last 30 days). Anything that is deleted therefore disappears from the backups after 30 days at the latest.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR).
Most of it you can do yourself: on the Your data page you download everything stored for your account, or delete the account along with its characters. You delete a single character in the game on the character selection screen. For anything else, an email to omewes92@gmail.com is enough; you don't have to give reasons.
You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: the Brandenburg Commissioner for Data Protection and Access to Information, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.
The server is operated by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Deutschland; it is located in a data centre in the European Union.
The emails are sent by Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, Frankreich). The data is stored there in France and Germany. For technical support and maintenance, companies of this provider in the USA and India may access it; this is safeguarded by the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
A data processing agreement (Art. 28 GDPR) is in place with both.
On itch.io, a page shows our game in a frame. itch.io itself is responsible for that page; what applies there is in itch.io's privacy policy. The game in the frame connects directly to our server, and this policy applies to everything in it.
These sites are only linked, not embedded. Only when you click a link do you connect to them; their privacy policy then applies.
If something changes on this site or in the game, this policy changes with it. As of: 30 October 2026.