Privacy Policy

The short version

The Idle Shard is a browser game. We collect what is needed to give you an account, run your character and take payment if you choose to donate — and nothing beyond that.

We do not sell your data. We do not run advertising. There are no third-party analytics or tracking scripts on this site, and the only cookie we set is the one that keeps you logged in.

Your account

When you register we store your username, your email address, and a password hash. Your actual password is never stored: it is put through bcrypt, and what we keep cannot be turned back into the password you chose.

If you use "forgot password", we store a hashed, single-use, time-limited token and email you the matching link. The same applies to the link that "/discord" issues.

Your character and game activity

Playing the game creates records tied to your account: your character and its skills, the items you own, your house, your guild and party membership, quests, trades and deaths. This is the saved state of the game — without it there is nothing to log back in to.

Actions taken by staff (moderation and admin commands) are logged with the character names involved, so that moderation decisions can be reviewed after the fact.

We also record that you accepted our Terms of Service, which version you accepted, and when — so that both sides have a record of what was agreed.

Chat

Global and Guild chat are stored so that a backlog can be shown when you log in, and are automatically deleted after seven days. The database removes them on its own; there is no archive kept behind them.

Local chat is never written to the database at all — it is broadcast to whoever is in the room at the time and then gone.

Please treat chat as public. Anything you type in Global is sent to every player online.

Linking Discord (optional)

Linking Discord is entirely optional and nothing in the game requires it. If you type "/discord" and complete the authorisation, we store your Discord user ID, your Discord username as it was at that moment, and the date you linked.

We request only the "identify" permission — the minimum Discord offers. We do not receive your Discord email address, your friends, your servers, or any of your messages. We do not read anything you post in Discord.

Your Discord ID is used only for:

• showing a verified mark beside your name in game chat
• granting you a verified role in our Discord server
• sending you a direct message confirming the link

You can ask us to unlink at any time, and doing so removes the ID we hold.

Donations and payments

Payments are processed by Stripe. Your card details are entered on Stripe's systems and never reach our server — we cannot see, store or recover them.

What we do keep is a record of the purchase against your email address, so that your balance can be credited and restored if something goes wrong. Records of payments are kept for as long as we are required to keep financial records.

Cookies

We set one cookie: a session cookie that records that you are logged in. It is strictly necessary — without it you cannot stay signed in — and it carries no advertising or profiling function.

We do not use analytics cookies, advertising cookies, or third-party trackers.

IP addresses

When you register, your IP address is sent to Cloudflare Turnstile as part of the check that you are not a bot. IP addresses also appear in our server logs, which we use to investigate faults and abuse.

We also use IP addresses to enforce the one-account-per-household rule in our Terms of Service — that is, to detect accounts that appear to belong to the same person or household, and attempts to disguise that using VPNs or proxies. Accounts found breaking that rule may be suspended or banned.

Our legal basis for this is our legitimate interest in keeping the game fair and free of abuse.

Who else is involved

We keep the list of third parties deliberately short. Each one receives only what it needs to do its job, and none of them are given your data for their own marketing.

• Stripe — processes payments and handles card details.
• Cloudflare — provides the anti-bot check on the registration form.
• Resend — delivers our emails, such as password resets.
• Discord — receives nothing about you unless you choose to link your account. Public game announcements posted to our Discord server may include in-game character names.
• Our hosting provider — stores the database and runs the servers.

Who can see your data

Access is limited to the people who run the game, and only for operating it — support, moderation, debugging and preventing abuse. We do not sell, rent or trade personal data to anyone.

We may disclose information where we are legally required to.

How long we keep things

Account and character data are kept while your account exists. Global and Guild chat is deleted automatically after seven days. Payment records are kept as long as financial record-keeping requires.

If you ask us to delete your account, we will delete your account and character data. Some records may be retained where we have to keep them, such as payment records, and anonymous or aggregate data may remain.

Your rights

If you are in the United Kingdom or the European Economic Area, data protection law gives you rights over the personal data we hold about you.

You can:

• ask for a copy of the data we hold about you
• ask us to correct anything that is wrong
• ask us to delete your account and its data
• object to or ask us to restrict certain uses
• withdraw consent for anything optional, such as Discord linking
• complain to your data protection regulator

Contact us using the details at the bottom of this page and we will respond as promptly as we can.

Security

Passwords are stored only as bcrypt hashes. Password-reset and account-link tokens are stored as hashes too, are single-use, and expire — so a copy of the database alone cannot be replayed to take over an account. The site is served over HTTPS.

No system is perfectly secure, and we cannot promise absolute security. Please use a password you do not use anywhere else.

Children

The Idle Shard is not intended for children under 13, and you must be at least 13 to create an account. If you believe a child under that age has created one, contact us and we will remove it.

A note on development

This game is in active development and currently invite-only. Game progress may be reset, and features described here may change as the game grows. When what we do with your data changes, this page changes with it.

Changes to this policy

If we make a significant change we will say so in the game or in our Discord server, rather than quietly editing the page. The effective date at the top always reflects the current version.

Contact

The quickest way to reach us is our Discord server.

https://discord.gg/PpcRgMheS3