PRIVACY
Privacy policy
Last updated 18 October 2026.
The short version: we hold your account name, your email address, some IP addresses and whatever your characters do in the game. We do not sell any of it, we run no advertising and no analytics, and there is no tracking on this site.
What we hold, and why
| Data | Why | Kept |
|---|---|---|
| Account name and password | To let you in. The password is hashed by the database and is not readable by us. | Until you delete the account |
| Email address | Confirming the account, and resetting a lost password. Nothing else — we send no newsletters. | Until you delete the account |
| IP addresses | Registration, login, downloads, purchases and daily claims — to rate-limit abuse and to attribute a download. | 90 days |
| Login and play times | Running the game, and deciding whether the daily eCoin claim is available. | Until you delete the account |
| Characters, items, guilds, in-game mail | It is the game. Some of it is logged so cheating and lost items can be investigated. | Until you delete the account |
| Chat messages | What you type in the game chat, including whispers, party and guild chat, with the character name and time. Read only by staff, to deal with reports and rule breaking (harassment, threats, scams, real-money trading); an automatic filter helps spot the worst of it, and a person decides what happens next. | 30 days |
| Purchases and eCoin movements | So a balance can always be explained, and disputes settled. | Until you delete the account |
| A session cookie | To keep you signed in. Strictly necessary; there are no others and no consent banner because there is nothing to consent to. | Until you sign out |
The lawful bases are performing our agreement with you — running the account you asked for — and our legitimate interest in keeping the server working and free of cheating and abuse, which is what the IP addresses, the logs and the chat log are for.
Who else sees it
A small number of service providers help us run the server, protect the website from attacks and send the confirmation and password-reset emails. Each one only sees what it needs for that job, such as your IP address or your email address, and may not use it for anything else.
If you donate, the payment provider receives your account name, email, IP address, and the name and phone number you type on the top-up page, because it needs them to take the payment. We pass the name and phone number on and do not keep them; we keep only the record of the payment.
Beyond that, nobody. We do not sell, rent or share your data, and there is no advertising network, analytics script or tracking pixel anywhere on this site.
What you can ask for
Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to what we do with it, or to have it handed over in a portable form. Write to [email protected] and we will answer within a month.
Deleting your account deletes the account, its characters, its items, its purchase history and its eCoin. It cannot be undone and we cannot get it back for you afterwards.
If you think we have handled your data badly, you can complain to the data protection authority where you live.
Children
This is not aimed at children under 16. If you are under 16 and have made an account, ask a parent to write to us and we will remove it.
Changes
If this changes materially it will be announced in the news before it takes effect.