Privacy Policy

The only personal data the Service collects directly is:

• Email address — used for login identity, email verification, and password reset. It is never shown to other players and is never returned by any public API.
• Handle (display name) — your chosen public identity. This is shown to other players and, if you win a season, may appear permanently on the public Hall of Legends.
• Password — stored only as a salted cryptographic hash (scrypt). We never store, log, or have access to your actual password.

We also generate, as a consequence of you playing, ordinary gameplay data that is not personal in nature: in-world username, faction, points, colony names and coordinates, and cosmetic entitlements. This is the game state itself, not information about you as a person.

We do notuse cookies, analytics, or advertising trackers on the website or in the Game. The Game keeps you signed in using a login token stored in your browser's local storage, not a cookie.

We process this data to operate your account (authentication, verification, password recovery), to run the Game (season standings, cross-season history), and to communicate with you about your account when necessary (e.g. a password-reset email you requested).

When email delivery is enabled, we use Postmark (Wildbit / ActiveCampaign) to send verification and password-reset emails. Postmark receives the recipient address and message content solely to deliver that email, and holds it under its own retention policy as our data processor. We do not use any other third-party data processor, analytics provider, or advertising partner.

Account data (email, handle, password hash) is retained for as long as your account exists — until you delete it yourself or an erasure request is honoured (see below). Login sessions expire automatically (30 days by default) and are revoked on logout or password reset. Email verification and password-reset links are single-use and expire automatically (24 hours and 1 hour respectively); we store only a one-way hash of these link tokens, never the token itself.

You can, at any time, from Settings → Account in the Game:

• Exporteverything tied to your account — identity, entitlements, cross-season career record, and your current character's in-game data — as a JSON download.
• Deleteyour account permanently. This purges your email, handle, and password hash, revokes every active session, and deletes your personal cross-season career record. Your in-game character and colonies are unaffected until the next season reset (like any other player's), but are no longer linked to a durable account. If you have already won a season, your historical Hall of Legends entry is anonymized rather than deleted, so past results stay intact without identifying you.
• Sign out everywhere — immediately revoke every active login session across all devices.

If you can no longer sign in (lost password, no working email), contact us at legal@paperfoxstudio.com and we will process the same export or erasure on your behalf after verifying your request. Depending on your location, you may have additional rights under laws such as the GDPR or CCPA (for example, rectification or restriction of processing) — contact us and we will do our best to accommodate the request even where it is not yet a self-serve feature.

Anything you post in our Discord server is visible to other members and subject to Discord's own Privacy Policy, which governs data Discord itself collects. We do not control or store the data Discord collects about you as a platform.

The Service is not directed at children under 13, and we do not knowingly collect personal data from anyone under that age. If you believe a child has provided us personal data, contact us and we will delete it.

Passwords are never stored in plain text — only a salted scrypt hash. Email verification and password-reset links are stored as a one-way hash, are single-use, and expire quickly. No method of transmission or storage is 100% secure, but we take reasonable, industry-standard measures to protect your data.

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above and, where practical, announce the change in our Discord community.

Questions about this Privacy Policy, or requests regarding your data, can be sent to legal@paperfoxstudio.com or raised in our Discord community.