Privacy Notice

Alpha build — last updated for the closed playtest.

What we store

StoonGame : Ember Worlds keeps a small set of data on the game server so multiplayer and persistence work:

• Account data — username and a salted password hash for registered accounts, or a temporary guest id for guest sessions.
• Game state — saves, world snapshots, quest progress, profiles (colour, language, settings), and map presets you create.
• Community content — forum posts and shared maps you publish under your username.
• Feedback reports — only what you choose to attach: description, optional screenshot/video, system info, settings, and client logs. Each checkbox in the feedback form controls what is sent.
• E-mail sign-ups — if you join a notify list your e-mail is stored sealed (AES-256-GCM); the database itself only carries a pseudonymous key, and the game hub keeps only the sealed copy. Unconfirmed sign-ups are deleted automatically after 30 days. Every sign-up returns a signed remove-link; following it deletes the row — no account, no password needed.
• IP-derived identifiers — we never store your raw IP address. Rate-limit and anti-abuse records use a salted hash that rotates daily, so yesterday's records can't be joined to today's. Vote identities are salted, pseudonymous, and stable (needed so one person can't stack votes).

Third parties

• Cloudflare Turnstile — sign-up and similar forms run a bot check; Cloudflare processes the check token under its own privacy terms.
• LLM providers (AI-assist features) — some in-game assistant features send the text you type (and relevant game context) to a third-party large-language-model provider to generate a response. A one-time notice explains this the first time you open such a feature; if you never use them, nothing of yours is sent. Provider details appear in the admin LLM configuration.
• Google AdSense — the site build contains ad slots that only load when configured, and they are not configured today. If we enable ads, Google may set its own cookies and tracking — we will update this page before that happens.

What we don't do

• No analytics SDKs and no tracking cookies of our own.
• No selling or sharing of your data with third parties.

Retention

Guest tokens expire after 24 hours; guest identities may be removed when unused. Registered accounts persist until you ask for deletion. Unconfirmed e-mail sign-ups are purged after 30 days; confirmed ones stay until you remove them. Server logs are rotated and kept for debugging only.

Your rights — self-serve

You can exercise erasure and data-export rights directly against the API, no e-mail round-trip required:

• POST /api/gdpr/erase — removes your sign-up (sealed copy scrubbed), anonymises your forum attribution to "former user", and rewrites your attributed votes to a dead hash so aggregate counts survive. Optionally deletes specific game saves you own. Requires your account token, plus a signed remove-token for the e-mail part.
• POST /api/gdpr/export — returns one JSON bundle of everything attributable to your account: profile, saves list, votes, posts, and the decrypted sign-up row.
• GET /api/signup/confirm?e=…&t=… — confirms a pending sign-up (the link your sign-up response returns).

Or play as a guest with no registration at all. For anything the self-serve endpoints don't cover, contact [email protected].

Impressum / operator

[To be supplied by the site operator — legal name, postal address, and (where required) register and contact details go here. Placeholder pending the operator's details.]

Responsible for content: [operator name — to be supplied]
Contact: [email protected]