Privacy Policy — "Odłamki Świtu"

Effective from: [DATA WEJŚCIA W ŻYCIE] · Version: 1.0 · Wersja polska

In short #

• To play, we only need your e-mail address and a password. We store the password only as a hash that cannot be reversed.
• We do not ask for your name, date of birth or address. We do not track you, show ads, or sell or share data for marketing.
• Other players see your character's name, level, class, guild, and what you write on the map, guild and party channels. Do not share your real-life details in chat.
• We keep chat messages for 90 days. A moderator may read a private conversation only if someone reports it or there is a reasonable suspicion of a rules violation.
• You can download your data or delete your account at any time in the account settings in the game. The account is gone after 14 days — until then you can change your mind.
• Questions: [E-MAIL KONTAKTOWY].

1. Who is the controller of your data #

The controller of your personal data is [IMIĘ I NAZWISKO OPERATORA], [ADRES], e-mail: [E-MAIL KONTAKTOWY] ("we", "the operator"). We run the game "Odłamki Świtu" at https://shardsofdawn.com (the "Game").

We have not appointed a data protection officer, because at this scale of processing one is not required. For any data matter, write to the address above.

2. Where your data comes from #

Most data you give us yourself: your e-mail and password when you register, your character name, your messages. Some data is created as you play: progress, items, trade history. Some data your browser sends automatically: your IP address and browser details. Other players may also tell us about your character, for example in a report.

3. What data we process #

3.1 Account #

• e-mail address (login and account-related contact);
• password, as a cryptographic hash — we never know the password itself;
• account creation date;
• whether the e-mail address is confirmed, and a new address waiting for confirmation after a change in the settings;
• the date and version of the accepted terms, and your confirmation that you are at least [MINIMALNY WIEK] years old;
• a hash of your session token and when it was issued (keeps you logged in).

3.2 Character and gameplay #

• character name (visible to others), class, level, experience, health, gold;
• position on the map, whether you are currently in the game, and the time of your last activity;
• equipment, cards and deck, skills, quests, scenes watched, maps discovered;
• the state of ongoing fights, duels and trades.

3.3 Friends and guilds #

• friend invitations and your friend list (friends can see whether you are online);
• guild membership, rank and guild invitations; the guild's name and tag are shown next to your character's name.

3.4 Messages #

• messages on the map, guild and party channels, and private messages (whispers): content, author, recipient or channel, time;
• how far you have read each private conversation.

3.5 Trading #

• trades with other players, auctions and bids in the auction house;
• a trade and auction log: who gave what to whom, for how much gold and when, with the character names as they were at that moment. Players cannot see this log; it is used to investigate scams and detect bots.

3.6 Moderation #

• mutes, blocks and other moderation decisions, with their reasons;
• reports you send and reports about you, including a copy of the reported content;
• appeals and their outcome.

3.7 Technical data #

• IP address, browser details (User-Agent), date and time, and the requested address — in server logs;
• the IP address and the e-mail entered at login — in counters that protect against password guessing and mass account creation.

3.8 Correspondence #

If you write to us: your e-mail address, the content of your message, and the data needed to handle it.

3.9 What we do not collect #

Your name, date of birth, address, phone number, device location, payment data, or special categories of data (e.g. health or beliefs). Please do not put them in chat or in your character's name.

4. Why we process data, on what legal basis, and for how long #

We do not process data on the basis of consent and do not send marketing messages.

Providing an e-mail address and a password is required to create an account — you cannot play without them. All other data arises during play.

Live notifications (a new message, an invitation, other players moving) pass through our notification server, which does not store them. Each notification reaches only the people it concerns.

5. Who can access your data #

• Other players — see your character's name, level, class and appearance, your guild, what you write on public channels and your auction listings; your friends see whether you are online; the recipient of a whisper sees the whisper.
• The operator and moderators — people acting on our authority and bound to confidentiality. A moderator sees the data needed to handle a case and reads a private conversation only in connection with a report or a reasonable suspicion of a violation. Every such access is recorded.
• Cloudflare, Inc. (USA) — the network provider through which the Game connects to the internet (encrypting the connection, protection against attacks). It processes data on our behalf under a data processing agreement.
• [DOSTAWCA POCZTY] — the provider of the [E-MAIL KONTAKTOWY] mailbox, if you write to us.
• [DOSTAWCA WYSYŁKI POCZTY] ([KRAJ SIEDZIBY DOSTAWCY WYSYŁKI]) — sends the Game's messages on our behalf, e.g. the link to set a new password. It receives your e-mail address and the content of the message and processes them on our behalf under a data processing agreement.
• Public authorities — only when the law requires it, e.g. at the request of a court, prosecutor or police, or when we must report a suspected criminal offence threatening someone's life or safety.

The game server belongs to the operator and is located in Poland; we do not use third-party hosting. We do not sell data or pass it to advertisers.

6. Transfers outside the European Economic Area #

Cloudflare, Inc. is based in the USA and may also process data there. The transfer relies on the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework (Cloudflare is a listed participant) and, in addition, on the standard contractual clauses included in Cloudflare's data processing agreement. You can obtain a copy of the safeguards by writing to [E-MAIL KONTAKTOWY].

7. Browser storage and cookies #

The Game stores in your browser's localStorage only what is strictly necessary for the Game you asked to use. That is why we do not ask for consent (Article 399 of the Polish Electronic Communications Law), but we tell you what it is:

We do not use cookies or any analytics, advertising or tracking tools. Cloudflare may set technical security cookies (e.g. __cf_bm, cf_clearance) when it needs to tell humans from bots. The administration panel, used only by staff, uses a session cookie.

You can delete this data in your browser settings. Deleting the token logs you out.

8. Your rights #

You have the right to:

• access your data and get a copy — the "Download my data" button in the account settings (a JSON file), or write to us;
• rectification — e.g. change your e-mail address in the account settings, or ask us to change your character's name;
• erasure — the "Delete account" button in the account settings; the account is deleted after 14 days, during which you can take the request back (see §9);
• restriction of processing — e.g. while you contest the accuracy of data;
• data portability for data you provided — in the file from "Download my data";
• object to processing based on legitimate interest (Art. 6(1)(f)) on grounds relating to your particular situation. We will stop unless we show compelling legitimate grounds, e.g. evidence in an ongoing case;
• lodge a complaint with the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland (uodo.gov.pl), or with the supervisory authority where you live. We encourage you to contact us first.

We reply without undue delay and within one month at the latest; for complex requests we may extend this by two months and will tell you so. To make sure we are talking to the account owner, please write from the e-mail address linked to the account or make the request in the Game while logged in. We do not ask for scans of ID documents.

9. What happens when you delete your account #

• The request. The "Delete account" button (after you enter your password and type the confirmation word) schedules the account's deletion in 14 days. At that moment we end all your sessions, and your character leaves the world: it leaves its party, an open trade is cancelled, a running duel is surrendered, and challenges nobody has answered yet are withdrawn or declined.
• For 14 days you can log in, but you cannot enter the Game. You will see the deletion date and can cancel the deletion, download your data or log out. Your data stays as it is meanwhile: your guild, auctions, friends and messages wait, and other players see your character in guild and friend lists as offline and can still write to it. After cancelling you play on as before.
• After 14 days we delete the account, the character and its game state, friends, guild membership, auctions, your messages, and the private conversations you took part in. This happens by itself — you do not need to log in or confirm anything. Gold other players put into your auctions goes back to them.
• If you ask us to delete your account by e-mail, or we delete it for reasons set out in the terms of service, we delete it at once, without the 14 days.
• If you founded a guild, the master rank passes to another member or the guild is dissolved; its members are notified.
• The trade and auction log and reports and moderation decisions are kept until the end of their period in §4 (12 months), because other players may need them, e.g. to investigate a scam. Then they are deleted.
• Data may remain in backups for up to 30 days. If we ever had to restore a backup, we would delete your account again, and an account still waiting for its deletion keeps its date.
• Once the 14 days are over, deletion cannot be undone. Characters and items cannot be recovered.

10. Children #

You may create an account if you are at least [MINIMALNY WIEK] years old. You confirm your age when registering. If we learn that an account belongs to a younger person, we will delete it. A parent or guardian who believes their child has created an account can write to [E-MAIL KONTAKTOWY].

11. Security #

We store passwords only as hashes and session tokens only as token hashes. The connection to the Game is encrypted (HTTPS). Login is protected against password guessing, only authorised people can access the administration panel, and backups are accessible only to the operator. We never ask for your password — neither in chat nor by e-mail. If someone asks for it pretending to be us, report it.

If a personal data breach occurs that may put your rights at risk, we will notify you and the supervisory authority as required by the GDPR.

12. Automated decisions #

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. The only automated measures are short-lived limits that protect the Game: at most 5 messages per 10 seconds, and a limit on login and registration attempts. Every moderation decision is made by a human.

13. Changes to this policy #

We will announce changes in the Game in advance. The current version is always available at https://shardsofdawn.com/prywatnosc-en.html; its date and version number are at the top of the document.

14. Contact #

[IMIĘ I NAZWISKO OPERATORA], [ADRES], [E-MAIL KONTAKTOWY].