Privacy
What we collect, how long we keep it, who handles it, and how to ask for a copy or deletion.
Last changed: 13 October 2026.
1. What we collect
- Your email, to make and recover an account and to send security codes.
- IP addresses, on every sign-in and request, to protect accounts and stop abuse.
- An install id and a PC key that the game client makes on your computer, so that we can tell your devices apart and keep bans. They are random values of ours, not your hardware's serials.
- Crash reports from the client when it crashes: what the program was doing, not your files.
- Chat logs and reports, for moderation and appeals.
- Purchases: what you bought, when, for how much, and the payment provider's reference. Never your card number.
- Votes: which toplist, when, and from which address.
The website itself sets no tracking cookies and uses Cloudflare Web Analytics, which has none either. Fonts are served from this site, so a visit sends nothing to Google.
2. How long we keep it
| What | Kept | Why |
|---|---|---|
| Your email, and the terms you agreed to | While the account exists | to sign you in and to reach you |
| An account that never verified its email | 7 days, then deleted | |
| Account activity (sign-ins, new devices, wrong passwords, changes), with time, place and IP address | 180 days | so you can see who used your account |
| A remembered device | Until you forget it, or 180 days unused | |
| A website sign-in session | 30 days after it ends | your own history; abuse reports |
| A sign-in in progress | 15 minutes | |
| IP addresses on website rows | Deleted with the row; on rows that are kept (orders), blanked after 180 days | |
| The game’s login, command and private-message logs | 180 days | moderation and support |
| Chat logs and reports | 180 days | moderation and appeals |
| The install id and PC key the client sends | While the account exists; blanked when it is deleted | to tell devices apart and to keep bans |
| Crash reports from the client | Until the crash is fixed | to fix the game |
| Orders, payments and the ledger | 7 years (to be confirmed by someone qualified) | tax and accounts; disputes |
| A payment provider’s callback as it arrived | 90 days | to work out what happened when a payment goes wrong |
| Votes | 90 days, then only each account’s totals | abuse checks |
| A support ticket and its pictures | 2 years after it is closed | support history |
| The website’s request log | 30 days | |
| The staff audit log (who did what to an account, with a reason) | Kept | accountability |
Off-site backups keep monthly copies for a year, so something deleted can still be in a backup for up to a year after. Backups are not read except to restore the service.
3. Who handles data for us
- Cloudflare: serves the website, the API and the files, and filters abuse.
- Resend: sends our emails (codes, receipts, sign-in alerts).
- Stripe and PayPal: take payments. Your card details go to them, not to us.
- Discord: if you join our server or link your Discord account.
- Google: only if you choose to sign in with Google, once that exists.
Nothing personal is posted to Discord by our bots: no emails, addresses, device identifiers or save files.
4. Your rights
- A copy of your data: write to [email protected] from the account's email and we send what we hold about the account.
- Deletion: ask the same way. Deleting an account removes the email, the sign-in methods, the devices, the codes and the history; your characters are detached, and the IP address and device identifiers in their files are blanked. Bans on a computer or address stay in the ban list. Orders are kept for as long as the table above says, because the law requires it.
- Corrections: you change your email and password yourself in Account settings.
5. Children
You must be 13 or older to make an account. If we learn an account belongs to someone younger, we delete it.
6. Contact
[email protected]. For a security problem,[email protected].