Privacy Policy

The only personal data the Service collects directly is:

• Email address — used for login identity, email verification, and password reset. It is never shown to other players and is never returned by any public API.
• Handle (display name) — your chosen public identity. This is shown to other players and, if you win a season, may appear permanently on the public Hall of Legends.
• Password — stored only as a salted cryptographic hash (scrypt). We never store, log, or have access to your actual password.

We also generate, as a consequence of you playing, ordinary gameplay data that is not personal in nature: in-world username, faction, points, colony names and coordinates, and cosmetic entitlements. This is the game state itself, not information about you as a person.

We do notuse cookies, analytics, or advertising trackers on the website or in the Game. The Game keeps you signed in using a login token stored in your browser's local storage, not a cookie.

We process this data to operate your account (authentication, verification, password recovery), to run the Game (season standings, cross-season history), and to communicate with you about your account when necessary (e.g. a password-reset email you requested).

If you sign up for alpha access on our website, we collect the email address you provide and, solely to enforce a rate limit against automated abuse, the IP address the signup request came from. We do not use that IP address for any other purpose, and we do not combine it with your email in any record beyond what the rate limit itself needs.

We use the email address to send you (a) a one-time confirmation that you're on the waitlist, and (b) later, an invite email once an alpha slot is available for you. These are the only messages we send from the waitlist — we do not currently operate any other recurring newsletter or promotional email list. If that changes, this Policy will be updated first.

To be removed from the waitlist and stop receiving these emails, contact us at hello@paperfoxstudio.com and we will delete your entry. We are working toward a self-serve unsubscribe link in the emails themselves; until then, a request to that address is honored promptly.

When email delivery is enabled, we use Postmark (Wildbit / ActiveCampaign) or Resend, depending on configuration, to send verification and password-reset emails and the alpha waitlist emails described above. Whichever provider is active receives the recipient address and message content solely to deliver that email, and holds it under its own retention policy as our data processor. We do not use any other third-party data processor, analytics provider, or advertising partner.

Account data (email, handle, password hash) is retained for as long as your account exists — until you delete it yourself or an erasure request is honoured (see below). Login sessions expire automatically (30 days by default) and are revoked on logout or password reset. Email verification and password-reset links are single-use and expire automatically (24 hours and 1 hour respectively); we store only a one-way hash of these link tokens, never the token itself.

You can, at any time, from Settings → Account in the Game:

• Exporteverything tied to your account — identity, entitlements, cross-season career record, and your current character's in-game data — as a JSON download.
• Deleteyour account permanently. This purges your email, handle, and password hash, revokes every active session, and deletes your personal cross-season career record. Your in-game character and colonies are unaffected until the next season reset (like any other player's), but are no longer linked to a durable account. If you have already won a season, your historical Hall of Legends entry is anonymized rather than deleted, so past results stay intact without identifying you.
• Sign out everywhere — immediately revoke every active login session across all devices.

If you can no longer sign in (lost password, no working email), contact us at hello@paperfoxstudio.com and we will process the same export or erasure on your behalf after verifying your request. Depending on your location, you may have additional rights under laws such as the GDPR or CCPA (for example, rectification or restriction of processing) — contact us and we will do our best to accommodate the request even where it is not yet a self-serve feature.

Anything you post in our Discord server is visible to other members and subject to Discord's own Privacy Policy, which governs data Discord itself collects. We do not control or store the data Discord collects about you as a platform.

The Service is not directed at children under 13, and we do not knowingly collect personal data from anyone under that age. If you believe a child has provided us personal data, contact us and we will delete it.

Passwords are never stored in plain text — only a salted scrypt hash. Email verification and password-reset links are stored as a one-way hash, are single-use, and expire quickly. No method of transmission or storage is 100% secure, but we take reasonable, industry-standard measures to protect your data.

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above and, where practical, announce the change in our Discord community.

Questions about this Privacy Policy, or requests regarding your data, can be sent to hello@paperfoxstudio.com or raised in our Discord community.