Privacy

Who this is

Wyrmcourt is a game run by one developer, not a company. Anything on this page - a copy of your data, a correction, a deletion, or a question you would rather ask than read - goes to [email protected].

What the island keeps

To have an account at all:

• Your character name, and the date you made it.
• Your password, as a scrypt hash. The password itself is never written down and cannot be read back out - not by us either.
• Your email address, once you confirm it. Before the click it lives only on the confirmation token, so an address typed in by mistake - or somebody else's, typed in on purpose - is attached to nothing and expires in two days.
• If you sign in with Google, Discord or GitHub: that service's id for you and the address it hands over. Not your password there, and nothing else from your account there.

To be a character: everything the game is made of - level, silver, health, position on the island, backpack, house, clan, quests, achievements, arena and dungeon history. It is the save file. Deleting it is deleting the character.

Because you said it out loud: chat lines, letters sent through the in-game post, clan messages, and the name attached to each. A letter to another player is stored so they can read it; treat it like a letter, not a diary.

Because the alpha has to be able to see cheating:

• A rolling log of your last 400 actions - what verb, when, and the gap since the one before. That is how a script that plays perfectly at 3am is told apart from a person.
• A salted hash of the network address you connect from, never the address itself. The hash answers exactly one question - are these two logins from the same place - which is what keeps a player from robbing their own second account. It cannot be turned back into where you live, and a backup of the database is not a list of addresses.
• Notes raised by the watch when something looks odd. Nobody is banned by this and nobody is told they are suspected; the notes exist for a human to read when a number stops making sense.

There is no profiling, no automated decision that affects you, no advertising identifier, no analytics script, no third-party font, and no pixel from anybody. The fonts are served from the same machine as the game for precisely this reason.

Cookies, and what sits in your browser

• session - how the island knows you are you. HttpOnly, SameSite=Lax, 90 days, sliding forward while you play. The server stores only a SHA-256 of it, so a copy of the database grants nobody a live session. Signing out deletes it.
• oauth_state - written only when you press a sign-in button, lives ten minutes, and exists to make sure the answer coming back from Google or Discord is the answer to the question we asked.
• Your browser's own storage holds three switches: music on, sound on, and whether you have seen the first-day note. They never leave your machine and we cannot read them.

There are no other cookies. None of them are for advertising, and none of them follow you off this site.

Who else touches any of it

• The host. The game runs on a machine we operate, reached through Cloudflare's network. Their edge sees the traffic in the ordinary way any network in front of a website does.
• The post. Confirmation and password-reset letters go out through Cloudflare Email Sending, which therefore handles your address and the text of those two letters. No other mail is ever sent to you: no newsletter, no "we miss you", nothing.
• Sign-in providers, and only if you choose one. Pressing the Google button tells Google you signed in to Wyrmcourt. Their handling of that is theirs, and their policies apply to it.

Nothing is sold. Nothing is handed to a data broker or an ad network - the game has no ads. Aggregate numbers about how the alpha is going ("nine registered yesterday") are reported to the developer; those are counts, with no name in them.

How long

• Your account and character: while the account exists.
• Sessions: 90 days from last use, then expired.
• Confirmation links: two days. Password-reset links: one hour. Both once only.
• The action log: the last 400 actions per player, older ones pruned automatically.
• Backups: taken nightly and rotated, so a deletion takes a little longer to leave the backups than it takes to leave the game.

This is an alpha, and alpha characters get wiped. When the balance changes far enough that old characters stop making sense, the roll is cleared and everybody starts again. That is announced beforehand, and it is a real deletion of the game state, not a reset button.

What you can ask for

Write to [email protected] from the address on the account, or ask from inside the account, and you can have:

• a copy of everything stored about you, in a form you can read;
• a correction to anything wrong;
• your account and character deleted - all of it, not hidden;
• an explanation of anything above that this page did not answer.

Deletion removes the account, the character, the log, the address hashes and the letters you sent. Lines you said in public chat may remain in other players' view of a conversation with the name detached, in the same way a sentence you said in a room does not unsay itself.

If you are in the UK or EU: the lawful bases are contract (running the game you asked to play) and legitimate interests (keeping it fair and getting you back in when you lose your password). You can complain to your national data protection authority, though writing to us first will be faster.

Children

The game is not intended for children under 13, and no part of it is designed to appeal to them in particular. If you believe a child under 13 has made an account, write to us and it will be removed.

Changes

This page changes when the game does. If a change means the island starts keeping something it did not keep before, that is said in the game as well as here, not slipped into a paragraph.